The Spanish Data Protection Agency (AEPD) has issued a warning regarding the common practice of requesting photocopies of the National Identity Document (DNI) for various procedures. Improper use of the data contained in this personal and non-transferable document can lead to serious consequences, both for the holder and for the entity using it, including financial penalties that can reach 100,000 euros.
The DNI, mandatory from the age of 14, contains sensitive information such as the photograph, signature, and support data which, if they fall into the wrong hands, facilitate fraud and identity theft. Although security forces and private guards may request identification, the key is proportionality. In many cases, a simple visual check is sufficient, without the need to photocopy, photograph, or store the document, especially in routine private activities, accommodations, or hiring processes.
The AEPD emphasizes that, as a general rule, it is not necessary to provide a copy of the DNI to exercise rights such as data access or rectification. Only in cases of reasonable doubt about identity can the data controller request additional information. For hiring, identity can often be verified through other means, such as electronic signatures, except in specific cases like anti-money laundering regulations. If a copy is essential, it is recommended to protect unnecessary data and use secure channels for electronic submission.
In the accommodation sector, such as hotels and apartments, regulations require the collection of certain guest data but do not authorize requesting a copy of the DNI or passport, as it violates the data minimization principle. In-person verification with a simple visual check is sufficient, and for online procedures, alternative authentication mechanisms are recommended.
Excessive use of DNI data can lead to significant penalties. A well-known example is the 100,000 euro fine imposed on Orange for photographing both sides of a customer's DNI during a parcel delivery. The agency reminds that data must be adequate, relevant, and limited to what is necessary. Before requesting a photocopy, companies must justify the need, the retention period, and the security guarantees. Citizens are advised to inquire about the reason and legal basis before providing a copy of their document.
