  The right to access is a great tool provided by the GDPR to empower data
subjects with their data. However, it needs to be implemented properly
otherwise it could turn subject access requests against the subjects privacy.
Indeed, recent works have shown that it is possible to abuse the right to
access using impersonation attacks. We propose to extend those impersonation
attacks by considering that the adversary has an access to governmental
resources. In this case, the adversary can forge official documents or exploit
copy of them. Our attack affects more people than one may expect. To defeat the
attacks from this kind of adversary, several solutions are available like
multi-factors or proof of aliveness. Our attacks highlight the need for strong
procedures to authenticate subject access requests.
