Lorraine Williamson
Spanish authorities are tightening the rules on how businesses handle customer identity documents. The country’s data watchdog, the AEPD (Agencia Española de Protección de Datos), has begun issuing heavy fines to companies that copy or scan ID cards without legal grounds or customer consent.
What was once seen as a routine step in hotels, gyms, estate agencies or even offices is now under strict scrutiny. The new approach highlights how Spain is enforcing European GDPR principles more stringently, placing customer privacy front and centre.
Why ID scanning is risky
Identity documents carry sensitive personal details: photos, signatures, ID numbers and dates of birth. Storing this information unnecessarily creates opportunities for fraud and data breaches. Under GDPR, the principle of “data minimisation” applies: organisations may only process what is essential for their service. Anything more is unlawful.
Fines now reach record levels
Penalties have risen sharply in recent months. While past fines ranged from €1,000 to €30,000, cases now exceed €70,000. One rental company was ordered to pay €42,000 after it automatically scanned IDs. The business claimed no data was saved, but regulators ruled the process itself breached privacy law. The message from the AEPD is clear: cutting corners on data protection will cost dearly.
What businesses can do
Companies may ask to see a customer’s ID and record key details such as name and number. However, photocopying or scanning is forbidden unless required by law. In the tourism sector, a digital reporting system introduced in December 2024 obliges hotels and landlords to submit guest details to the government. Even in that context, full scans of ID cards remain prohibited.
Alternative methods, such as confirming identity through secure payments or SMS verification, are encouraged. These options reduce risks while meeting legal obligations.
Privacy as part of business practice
Entrepreneurs are being urged to adapt quickly. Staff should be trained to handle customer data carefully and only collect the bare minimum. Investing in privacy-friendly systems not only avoids fines but also strengthens customer trust. In a country where data protection is increasingly prioritised, compliance is not just a legal requirement — it is good business sense.
Source: La Razon