An identity document includes an identity card, passport, residence card, and sailing book (under certain conditions). In practice, to establish identity (or entitlements), driving licenses, military books, or student ID cards are also commonly used.
The mere act of photocopying documents confirming identity is a strictly technical action. This view was expressed, among others, in the judgment of the Supreme Administrative Court of December 19, 2001 (case file II SA 2869/2000), according to which the collection of data by making a copy of a document containing personal data is a technical matter; the use of one technique or another for preserving this data (copying or transcribing) does not in itself determine the legality or illegality of such preservation (processing).
From the perspective of the provisions of the Personal Data Protection Act, it is essential that the entity performing this action has one of the grounds for legality of processing, which for so-called ordinary data (such as name, surname, residential address, PESEL number) are specified in Article 23(1)(1-5) of the mentioned Act.
For example, an employer who photocopies an employee's identity card or driving license obtains information about the employee that does not directly arise from the Labor Code, and thus processes it without an appropriate legal basis, exposing themselves to criminal liability.
According to the opinion of the General Inspector for Personal Data Protection, the document confirming identity should only serve to confirm the information or entitlements contained therein (e.g., entitlement to drive motor vehicles).
We would like to draw attention to the fact that for the past two years, there has been an increase in attempts to fraudulently obtain loans based on stolen or forged identity documents (according to the report by the Credit Information Bureau). In 2014 alone, 8,814 such attempts were reported. The highest number of such cases was recorded in the Silesian and Masovian Voivodeships. In addition to loan fraud, identity theft can result in:
Receive a package of free GDPR guides and micro-trainings
- forging an identity card to carry out various legal activities,
- conducting fraudulent business activities and obtaining, for example, tax refunds,
- opening a bank account using stolen data,
- renting an apartment or hotel room for the purpose of stealing furnishings,
- theft of a rented car and other items,
- entering into a contract with a telecommunications operator,
- making various types of purchases,
- involvement in money laundering processes,
- creating a fake online account or a false profile,
- posting or distributing offensive opinions or comments online in the name of the person whose document was stolen.
