GDPR does not allow disproportionality in the verification process.