The Spanish Data Protection Agency (AEPD) sanctioned an accommodation establishment for requiring a double-sided copy of its clients' identity documents for registration, deeming this practice contrary to the data minimization principle.

Facts and context

The Spanish data protection authority (AEPD) issued a sanction decision against the company ***EMPRESA.2 SL, including a fine of €4,000, for breaches related to the data minimization principle.

The case originated from a complaint by a person who was asked to send by email a double-sided copy of their identity document to register at an accommodation on November 8, 2023. The procedure was initially opened against another entity, ***EMPRESA.1, before being redirected to ***EMPRESA.2 SL, which had taken over management of the establishment before the facts.

Reasons for the decision

• Data minimization obligation (Article 5(1)(c) of the GDPR): The authority found that the company required clients to provide a double-sided copy of their national identity document (DNI) or passport. It recalled that while Spanish sectoral regulations (notably Order INT/1922/2003 and Royal Decree 933/2021) require accommodations to collect certain identification data of travelers, they do not legitimize the collection of a full copy of the document. Consequently, this collection was deemed excessive and unnecessary for the purpose of registering travelers. The authority qualified the company's conduct as negligent, highlighting its refusal to offer a less intrusive alternative, and noted the unnecessary risk created for individuals' rights and freedoms, notably the risk of identity theft. To assess the severity, the AEPD referred to the European Data Protection Board's Guidelines 04/2022, which classify national identification numbers among categories of data deserving particular attention.

Authority's decision

Consequently, the authority imposed a fine of €4,000 on ***EMPRESA.2 SL.

Furthermore, the authority ordered the company, pursuant to Article 58(2)(d) of the GDPR, to bring its practices into compliance within one month by adopting measures to collect legally required data without demanding a copy of the identity document.

Lessons learned

This decision reminds that:

• The existence of a legal obligation to collect certain identification information does not in itself justify collecting a full copy of the document containing it; the data controller must favor the least intrusive method.
• The collection of a copy of an official identity document, such as a national identity card, is considered a high-risk processing due to the potential for identity theft, and its necessity must be rigorously demonstrated.
• The refusal to consider less privacy-intrusive alternatives proposed by the data subject, such as on-site visual verification, may be regarded as an element of negligence aggravating the data controller's responsibility.