Fine for requesting a copy of an identity document

Privacy Law

30 March 2022

Fine for requesting a copy of an identity document

Stelt u zich eens voor: u werkt al jaren met dezelfde zelfstandige. Hij stuurt facturen, factureert btw en heeft een eigen kvk-nummer. Toch krijgt u in 2026 ineens vragen van de Belastingdienst over de aard van uw samenwerking. Hoe heeft het zo ver kunnen komen?

Many entrepreneurs, as standard practice, request additional personal data from a customer. For example, when that customer wants access to the personal data being processed about them at the company concerned. Media company DPG Magazines (DPG) was fined no less than €525,000 for this. DPG is the parent company of nu.nl, Tweakers, and the publisher of major newspapers and magazines such as de Volkskrant and Autoweek. This article brings you up to speed on the new privacy regulations and the important action points for 2022.

The amount mentioned above is the base fine for a breach of Article 12(2) of the General Data Protection Regulation (GDPR). Under Article 12(2) of the GDPR, the controller must facilitate the exercise of the data subject’s rights under Articles 15 to 22 of the GDPR. This includes the right of access to personal data (Article 15 GDPR) and the right to erasure of personal data (Article 17 GDPR).

At DPG, a copy of a data subject’s identity document was requested as standard practice for a request, for example, for access to or erasure of personal data. Anyone who wanted to know what personal data DPG Media held, or wanted data erased, first had to upload or send in an identity document. Moreover, when sending the identity document digitally, these people were not informed by DPG Media that they were allowed to redact certain data on it. According to the Dutch Data Protection Authority (AP), this is contrary to the GDPR.

GDPR

One of the rights under the GDPR for the data subject is that they may request access to, or erasure of, their personal data from the controller. The controller in this case is therefore an organisation such as DPG. However, a controller is permitted under the GDPR to request additional information from the person concerned who requests amendment or erasure of personal data. The issue was simply that DPG requested this as standard practice for every request from the data subject.

AP decision

The AP takes the view that a controller may not erect unnecessary obstacles for data subjects to exercise their rights under the GDPR. In doing so, the principles of proportionality and subsidiarity must be observed.

Proportionality

Proportionality means that the interest in requesting the additional personal data must be proportionate to the intrusion into personal data. The processing of copies of identity documents poses a major risk to the security of personal data. As an entrepreneur, you don’t want to have it on your conscience that copies end up in the wrong hands through a ransomware attack or another data breach.

Moreover, requesting a copy of an identity document is not proportionate to the nature and amount of personal data to which the data subject’s request relates. It is therefore not proportionate to request a copy of the identity document as standard practice to verify identity for a request to amend or erase personal data.

Subsidiarity

Subsidiarity means that it must be examined whether requesting the additional personal data is the best way to verify identity, or whether other ways are also possible. In DPG’s case, the AP ruled that it is disproportionate to request a copy of the identity document if the data subject’s identity can also be verified in another way.

The AP concluded that DPG must primarily identify a data subject as much as possible using personal data that DPG already processes. This could, for example, include a subscriber or customer number in combination with the name, address and/or email address of a requester.

A citizen service number (BSN) may only be processed if there is a specific statutory basis for doing so.

TikTok also fined for an incorrect privacy statement

The privacy statement of TikTok — the social medium used mainly by dancing children — also did not comply with the GDPR, according to the AP. This page with information about data processing was in English. Normally that is not an objection, but for TikTok it was. After all, the GDPR requires that it be clear to data subjects (primarily Dutch children) what happens to their personal data. According to the AP, the English information was not readily understandable for children. TikTok should therefore have provided the privacy statement in Dutch. TikTok was fined €750,000.

Conclusion

It is advisable for entrepreneurs to examine for themselves whether requesting additional personal data as standard practice is necessary to establish the identity of the data subject, or whether this might also be possible in another way. It is recommended to verify identity using data already processed by the organisation.

If it really is necessary to request a copy of the identity document, then at least ask the data subject to redact the details on the identity document. This concerns the details that are not necessary for establishing identity, as well as the citizen service number (BSN).

Does your organisation already operate in line with the latest privacy legislation?

It’s not only government organisations or large companies that get fined — in more and more other respects, companies are increasingly having to deal with this too. Would you like to be informed of the new privacy regulations and the important action points for 2022?

The Legal Company is organising a free lunch session on 12 May 2022: GDPR updates for entrepreneurs.

During this lunch session, corporate lawyer Hella Vercammen will bring you up to date on:

The new privacy regulations and action points in 2022
The fines issued in 2021 and the lessons we can draw from them

For more information and to register, click here.

Our lawyers specialise in privacy law and look, on a daily basis, at internal privacy policy, privacy statements, data processing agreements, processing registers, etc.

Do you have questions or need advice? Contact us by calling 020-345 0152 or fill in the contact form.

Nothing is as changeable as legislation and regulations. Please note that our blogs may no longer reflect current legislation and regulations and may therefore be outdated. If you have questions or a problem relating to this blog, or wish to obtain legal assistance, please contact us.

De afgelopen jaren stonden in het teken van de Wet VBAR, het wetsvoorstel dat een einde moest maken aan onduidelijkheid over de zzp’er. Het kabinet heeft delen van dat voorstel inmiddels geschrapt. Op het eerste gezicht is dat goed nieuws: minder regels, minder administratieve last. Maar in de praktijk blijven dezelfde toetsen overeind.

“De inhoud van de samenwerking is leidend, niet wat er op papier staat.”

De Belastingdienst handhaaft sinds 1 januari 2025 weer actief op schijnzelfstandigheid. En recente uitspraken van de Hoge Raad bevestigen dat rechters strikt toetsen of er sprake is van ondergeschiktheid en gezagsverhouding.

Voor uw praktijk betekent dit drie dingen. Een: leg de samenwerking duidelijk vast, met aandacht voor de inhoud. Twee: voorkom dat een zzp’er feitelijk werkt als werknemer. Drie: wees voorbereid op een controle, en weet hoe u de relatie kunt herzien als dat moet.

Heeft u vragen over uw concrete situatie? Wij sparren dagelijks met opdrachtgevers over hun zzp-relaties. Vraag een offerte op of bekijk onze Legal Safe abonnementen.