Users must only submit verification requests where they are the data owner or have lawful authority and consent.