Supporters submitted Subject Access Requests (SARs) to find out what Manchester United has actually done with their data. Today, a few people have messaged me to say United has responded with what looks like clear delay tactics. Let's look at United's response. It starts with: "We have received your subject access request. We are sure you will appreciate that, as a data controller, we have a legal obligation to ensure that we do not disclose personal data to anyone who is not authorised to receive it." "To enable us to process your request, please provide a copy of a document which confirms your identity. This could be a passport or a driving licence, or a recent utility bill showing your name and address. We will use this document only to confirm we can proceed with your request, and will not retain it." The basic point is simple: under UK GDPR, a company shouldn’t default to demanding a passport, driving licence, or utility bill whenever someone submits a SAR. Under ICO guidance, an organisation can request additional identification only if it has genuine, articulable, and reasonable doubts about who the person actually is. If the request came directly from the primary email address registered to the ticketing account, quoting the supporter's name, address, and Supporter ID, you have to seriously question why additional sensitive documentation is necessary. What specific reason does the club have to doubt the person’s identity? Unless United already has a passport photo or driving licence on file to cross-reference, demanding government photo ID is completely disproportionate and unnecessary. And I’m not sure if I’ve ever mentioned it, but sending a photo of these via email IS NOT SECURE (xitter.cf/OhCheesesChrist/status…) Then we get to the next section: "In addition to the above, we would be grateful if you could assist us in identifying the personal data you are hoping to receive by confirming the context in which you expect us to hold your data, and what information you would particularly like us to search for. Please note that our obligation is to carry out reasonable and proportionate searches, and this information will speed up our ability to locate and provide your data." They are asking the supporter to narrow down and clarify what data they want, despite this being explicitly and comprehensively outlined in the original request: "I would also like details of any organisations or categories of recipients with whom our identifiable personal information has been shared or made accessible. This should include, where applicable, third-party software providers, cloud services, automated processing systems, AI platforms, large language models or other external technology providers used for customer service, analysis or operational purposes. Where such records are held, please provide relevant logs, records or audit information showing occasions on which our identifiable details have been transmitted to, accessed by or processed through third-party systems or external tools. Please also confirm whether either of our personal data has been associated with any recorded data breach, security incident, unauthorised disclosure or similar event, including incidents which may not have resulted in individual notification." Then comes the attempt to pause the statutory clock: "The legislation requires us to provide the personal data to you, usually within one month. That time period is paused whilst we request further information from you. Once you have provided the details we have requested in this email, we will confirm next steps and the timescales." Under UK GDPR rules, a data controller cannot arbitrarily hit pause on the statutory one-month deadline by issuing blanket, boilerplate clarification queries. A controller can stop the clock only if clarification is genuinely required to conduct a search, or if there are legitimate doubts about identity. Using a template email to freeze the clock before doing any work is textbook stonewalling. To top it all off: when running their email through detection tools, this response email comes back with a 70% probability of being written by AI, which immediately raises concerns about whether fan communications and data are being fed into third-party AI tools in the first place.