NatWest SAR - identity verification by HooYu

[parity4all]

I need to lodge a Subject Access Request (SAR) to Natwest and ask for information they hold about any previous accounts. Remember having an account with them around 2006-2007 but it was closed a few years (two or three years) later. 

There is no longer any record of the account in any of my credit agency files. Chances are that Natwest won't have either. 

 

Anyhow, it seems Natwest have automated the SAR process and are using HooYu for the identity verification (the same ID verification system they use for account opening, I believe):

https://personal.natwest.com/personal/gdpr-triage-page.html#continue

 

Has anyone lodged a SAR to Natwest using this system? Is it straightforward?

The reviews on Trustpilot about HooYu isn't great. 87% of 1 star reviews from a total of 39 reviews. None of the reviews have been responded to by HooYu. They have a facebook fanpage, however, no review section and comments by customers are not responded to. 
 

[BankFodder]

The bank is entitled to make reasonable enquiries to ascertain you identity assuming that is necessary.  Of course if you are already a customer and they have you on record then it is completely unnecessary.

 however they are not entitled to impose a particular form of identity verification on you and if you can verify your identity by  other means than they are bound to accept that.

 

Not only that, the 30-day deadline for responding to an Sar  begins from the date that they received the request and they are not entitled to delay that simply in order to verify your identity.

In other words they must start preparing the disclosure even though your identity is not verified although they are not obliged to make the disclosure until they are satisfied that they know who they are dealing with.

 

I think I would be worried about this verification service as well .  I can't imagine that they aren't gathering some of your personal data for use as some kind of marketing tool or something.

 

I think someone should raise a complaint to the ICO.

 

Also if you wanted some fun you could make an ordinary written request for disclosure to the bank including reasonable verification documents such as a utility bill and passport and see whether they knocked you back. If they did then they would be in breach which clearly would cause sufficient distress to warrant a small claim and to get a few quid out of it as well as giving the bank a much-needed slap.