Draft Opinion of the Protection of Privacy Authority regarding the Collection of ID Card Numbers and Photocopies of ID Cards

Dear clients and colleagues, We would like to draw your attention that a few days ago, the Protection of Privacy Authority (the “PPA“) published, for public’s comments, a draft opinion regarding the collection of identification card numbers and photocopies of identification cards (the “Draft Opinion“). The Draft Opinion reviews the PPA’s position regarding the legality and legitimacy of businesses collecting identification card numbers and photocopies of identification cards. The fundamental position of the PPA is that an individual’s identification number serves as a “key” to accessing additional information about the person in various areas. Therefore, this number should be regarded as “information” under the Protection of Privacy Law, 1981 (the “Law“). Additional personal information appearing on the card, such as marital status and place of birth, as well as data on the card itself and on the identification card attachment, are considered information protected under the provisions of the Law and sometimes even the “private affairs” of a person, which are entitled to certain protection under the Law. The position of the PPA is that with respect to the collection of identification card numbers and photocopies of identification cards, businesses should adhere to the following principles:

• Notification obligation – To comply with the transparency requirement set out under Section 11 of the Law and in any request made to a customer to provide an identification card number or a photocopy of an identification card, the customer should be provided with a notice containing the following details: whether the customer is under a legal obligation to provide the information or if the disclosure of the information is voluntary and subject to their consent; the purpose for which the information is requested; to whom the information will be transferred and the purposes of the transfer. Additionally, if the business requires a photocopy of an identification card, the customer must be notified of such request prior to completing the transaction, even if the request for the photocopy is made by a courier company acting on behalf of the business.

 

• Avoidance of collecting and storing excessive information – It is necessary to refrain from collecting unnecessary information that is not required for providing the service to the customer, and to avoid requesting to photograph the entire identification card unless all the information appearing on the identification card is necessary for the purpose of collection. Additionally, customers should be allowed to request the concealment of irrelevant details from the identification card, and if the photocopies are stored in a database, all non-essential details should be redacted.

 

• Preservation of the principle of proportionality – Businesses are required to examine whether collecting identification card numbers or photocopies of identification cards is the most effective mean to achieve the purpose. In cases where it is possible to do so, it is preferable to use alternative identity verification methods that have less impact on privacy, such as verification through a code sent to the customer.

 

• Adherence to the principle of purpose limitation – It is important to refrain from using an individual’s identification number or a photocopy of an identification card for any purpose other than the intended purpose for which they were provided.

 

• Data Minimization – A database owner is required to review, as part of the annual review mandated by Regulation 2(c) of the Protection of Privacy Regulations (Information Security), 2017, whether the information stored in the database (including identification card numbers or their photocopies stored on mobile devices) still serves the purposes for which the information was collected. The database owner must reasonably document the review process, including the identity of the individual within the organization that conducted the review.

  Comments on the Draft Opinion can be submitted until July 14, 2023, at 12:00 PM. For the full text of the Draft Opinion (in Hebrew) – click here.   We are happy to address any questions or clarifications you may have on the topic. Sincerely, Herzog Fox & Neeman