Photographing or requesting a photocopy of the National Identity Document (DNI) may seem like a routine procedure in various transactions, such as package deliveries, venue access, or service contracts. However, the Spanish Data Protection Agency (AEPD) has reiterated that this practice is not always legal.
The DNI contains information beyond what is necessary to verify a person's identity, such as the photograph, expiry date, or issuance details. According to the AEPD, storing or processing this data without absolute necessity may violate the data minimization principle and increase the risk of identity theft.
The AEPD reminds that, as a general rule, it is not necessary to provide a copy of the DNI to exercise rights such as access, rectification, or deletion of data. Additional information may only be requested if there are reasonable doubts about the identity of the applicant.
In sectors such as hotels, tourist accommodations, or vehicle rental companies, where regulations may require collecting traveler data, the Agency considers that often it is sufficient to fill out a form and visually verify the document, without keeping a copy.
The most notable case is the €100,000 fine imposed on Orange, after a courier photographed a customer's DNI on both sides to deliver a package. The sanction was based on collecting more data than strictly necessary for identity verification.
This practice violates Article 5.1.c of the General Data Protection Regulation (GDPR), which states that personal data must be adequate, relevant, and limited to what is necessary for the purpose of processing.
The risk to citizens is significant, as a copy of the DNI can be used to open bank accounts, contract services, make fraudulent purchases, or commit identity theft. Therefore, the AEPD insists on limiting the information provided and, if necessary, obscuring non-essential data or using alternative verification methods.
If you find yourself in this situation, it is advisable to inquire about the reason for requesting the full copy and the legal basis authorizing it. If in doubt or if the company insists without justification, you can refuse to provide the copy and request an alternative method. If data processing is improper, a complaint can be filed with the AEPD.
The Agency's message is clear: the DNI contains sensitive personal data, and its uncontrolled copying can open the door to fraud.
