Four surprising penalties for making photocopies or taking photos of your ID that you can receive starting today

Taking a photo or photocopy of the DNI may seem like a harmless action, but the reality is that it can lead to fines of up to 100,000 euros. It’s no joke nor a law written by someone who doesn’t drive: personal data protection is more closely monitored than ever.

The authorities and the Spanish Data Protection Agency (AEPD) have a very clear position on who, when, and how the information on your DNI can be handled. And no, it’s not as simple as we’d like to think when we are asked for a photocopy in a store or company.

Why should you care about fines for photographing or photocopying the DNI?

When you are asked for the DNI, it is usually to confirm your identity. However, being asked does not mean you can hand over a photocopy or photo just like that. This can have serious consequences for your privacy and even legal ones.

Data protection law is very clear: personal data must be adequate, relevant, and limited to what is necessary. And when we talk about the DNI, this means that only strictly essential information can be requested.

What exactly does the regulation say about the use of the DNI?

The General Data Protection Regulation, in its article 5.1.c, establishes that those responsible for processing must limit the information they collect and that it must be the minimum necessary for the specified purpose.

In expert words, this means that a company or establishment cannot make a photocopy or photograph of the DNI unless it is absolutely necessary, and doing so can be considered misuse.

What practical cases exemplify fines for misuse of the DNI?

The most notorious case is that of Orange, which in March 2023 had to pay a 100,000 euro fine after one of its couriers photographed both sides of customers’ DNI to deliver packages.

This type of practice is exactly what the AEPD wants to prevent to protect citizens’ privacy and for this reason it monitors and punishes severely.

Who can request the DNI and under what conditions?

Authorities, such as the National Police, Mossos d’Esquadra, Ertzaintza, or the Guàrdia Foral of Navarra, have the right to ask you to show the DNI to confirm your identity whenever necessary.

But that does not mean anyone can make a photocopy or photo of your document. Security guards at an establishment, for example, can only ask for the DNI to authorize access, but they do not have the right to copy it without a justified reason.

When is it mandatory to show the DNI?

Anyone requested by the competent authority for identification is obliged to show it. Refusing can result in no police assistance to facilitate identification, but it does not mean you must allow them to make a photocopy or photo.

What happens if you refuse a photocopy or photograph of the DNI?

There is no legal obligation to provide a copy of the DNI to request services or complete procedures unless the law states otherwise. Refusal to give a photocopy should not have negative consequences for you, but it is common for some establishments to pressure or try to convince you otherwise.

What are the sanctions and how do they affect you?

Sanctions for improper use of personal data from the DNI can reach up to 100,000 euros, a figure that highlights the seriousness with which data protection is treated in Spain.

Keep in mind that not only companies but also individuals can face sanctions if they handle data improperly, meaning the responsibility is shared.

What are the most common sanctions?

• Fines up to €100,000 for serious data protection breaches.
• Warnings and requirements when the infringement is less serious or can be corrected.
• Civil or criminal liability if there is fraudulent use of data for identity theft.

How can you protect yourself from improper photocopies or photos?

The first is never to hand over photocopies of the DNI unless it is strictly necessary. It is also advisable to ask why it is needed and what use will be made of the copy.

The AEPD recommends exercising your rights of access and information to control the processing of your personal data. If you suspect misuse, you can report it and request information.

The reality is that data protection is everyone’s business and staying informed is the best way to avoid problems. Had you never thought about it this way?