Data protection

The Spanish Data Protection Agency (AEPD) has analyzed a quite common case in which a university asks the student to send a full copy of the ID card as a condition to process the issuance of an official university degree The discussion is not about whether the applicant needs to be identified (that is accepted), but whether it is proportional to require the entire ID card for that procedure.

According to the resolution, the regulations of the degree issuance procedure require verifying the identity of the interested party and that the degree includes certain personal data (for example, name and surnames, place and date of birth, and nationality). But the AEPD highlights a key idea, which is that the rule requiring identification does not mean obliging to provide a complete photocopy of the ID card or that, for that simple reason, the university can collect all the data it contains.

Here comes into play the principle of minimization of the GDPR where only appropriate, relevant, and limited data can be processed adequate, relevant, and limited data Furthermore, the AEPD reminds that the

university usually already has student data already has student data first use the information that already exists first use the information that already exists In the analyzed case, it is considered sufficient to

request only specific data request only specific data and contrary to minimization, even if the student ultimately does not end up sending that copy (because requesting it is already part of the processing). excessive processing and contrary to minimization, even if the student ultimately does not send that copy (because requesting it is already part of the processing).

Our professionals are at your disposal to advise you on data protection matters and to exercise, if necessary, the defense of your rights