It's not actually that unfeasible. A pretty standard first step in complying with a Subject Access Request is to verify the identity of the person you're talkin

It's not actually that unfeasible. A pretty standard first step in complying with a Subject Access Request is to verify the identity of the person you're talking to (wouldn't want to hand over a load of personal data to some random after all), so checking their nationality at the same time isn't miles off.