La Agencia Española de Protección de Datos has reprimanded la Diputación de Pontevedra for demanding and keeping a copy of the DNI of a citizen who submitted a statement of allegations against a fine. The body considers that this practice violated the current regulations as it was data not necessary for that administrative management.
The AEPD finds a violation of the principle of minimization
The resolution concludes that article 5.1 c) of the General Data Protection Regulation was breached, which requires that personal data be adequate, relevant, and limited to what is necessary for the purpose of processing. In this case, the infringement occurred by requiring and archiving a photocopy or image of the DNI to admit some allegations.
The Provincial Council of Pontevedra defended that in the registration assistance offices, the exhibition or copy of the document was requested to verify the identity of the interested party. However, the Agency understands that this verification could be carried out without the need to incorporate a copy of the document into the file.
The identity could be accredited without keeping the copy of the document
The AEPD maintains that the citizen's identity could be accredited through the diligence of the official of the assistance office, without requiring or retaining the reproduction of the DNI. This criterion leads the agency to appreciate an excessive collection of personal data with respect to the pursued purpose.
"While this Agency positively values the adoption of corrective measures implemented (…) which allow for the visual verification of the DNI, the validation in the application and the registration of the confirmation, said actions do not exempt from responsibility for the infraction already committed nor eliminate the effects derived from it" - Agencia Española de Protección de Datos
The Provincial Council changes the protocol after the resolution
Following the Agency's action, the Provincial Council of Pontevedra has modified the protocol of the ORAL registration assistance offices so that copies of the ID cards of interested parties are not incorporated. Furthermore, it has proceeded to the deletion of the ID card copy provided by the claimant.
The resolution thus establishes that the visual verification of the document, together with the validation in the application and the record of that verification, is sufficient in this type of procedures, although the subsequent correction of the procedure does not avoid the reproach for the infraction already committed.