Re: Indefensible
OK, I found a legal obligation to keep a record of a contract, such as supply of a service like telecommunications, made in the UK.
The relevant words there are "record of a contract." That's likley to include the fact that the contract exists, and the required indentifying information for the signee (i.e. name, and possibly address). GDPR is also going to limit the uses you can access, and use, that information to those specified in the legal requirement to hold that information in the first place. I'm pretty sure theta wouldn't include using it to verify someone's identity because you have continued to hold other information about them that they (reasonably) want expunged - i.e. an email account.
Biting the hand that feeds IT
