It is in the news that HelloFresh is accused of charging people for deliveries they did not request, and said they would "send a third-party debt collector round" in the case of non-payment. HelloFresh claim that the individuals made the orders.
If one was in such a situation, and one made a GDPR Subject Access Request of the company claiming the debt, would they be required to provide the evidence on which they base their claim?
The idea being that by requiring the company to provide the information up front one can assess the strength of their claim for the money and decide whether to pay the requested sum.
