Can Identity Cards Be Photocopied Following the Entry into Force of the Public Documents Act?

ANSWER

The Act of 22 November 2018 on Public Documents regulated which documents are to be considered public documents. Pursuant to Article 5(2) of that Act, identity cards fall within its scope. However, it does not prohibit data controllers from retaining copies of a document where this is necessary for the controller to fulfil its obligations under applicable law. Article 58 of that Act provides: 'Whoever produces, offers, sells, or stores for the purpose of sale a replica of a public document shall be liable to a fine, restriction of liberty, or imprisonment of up to two years'.

A data controller such as a nursing care facility (ZOL) will not retain a replica of an identity card for the purpose of sale, but rather in order to fulfil obligations imposed on the controller by law.

It should nonetheless be noted that an identity card may contain personal data that the data controller does not need to process — for example, the physical appearance of the natural person. Neither Article 25 of the Act on Patients' Rights and the Patient Rights Ombudsman, nor Article 95 of the Act on Civil Status Records, grants the data controller the right to process the personal data in the form of a physical likeness in this case. Accordingly, retaining a photocopy of an identity card may be regarded by a supervisory body as the processing of excessive personal data and a breach of the data minimisation principle under Article 5(1)(c) GDPR.