Spain's Data Protection Agency fines firms up to €100,000 for copying IDs

The Spanish Data Protection Agency (AEPD) is enforcing GDPR’s data‑minimisation principle by penalising companies that retain full copies of the national identity document (DNI) without a legitimate reason. The agency states that merely showing the ID is sufficient for most transactions and that storing a photograph or scan breaches privacy rules.

Fines can reach €100,000. Notable cases include a €100,000 sanction on telecom operator Orange for photographing both sides of a customer's DNI during a parcel delivery, €30,000 on a hotel chain for systematically scanning guests' IDs at check‑in, and €30,000 on a dental clinic that required a photocopy to process a refund. The AEPD warns that such practices expose individuals to identity‑theft risks and will continue to be prosecuted.