"Document confirming identity" – a phrase that, despite its lack of legal definition, holds significant significance for each of us. Simply put, it's how we can confirm our personal data. The most common document confirming identity is an ID card, possession of which is not only a right but also an obligation under generally applicable law. According to Article 5, Section 1 of the Act of August 6, 2010, on Identity Cards, " Every citizen of the Republic of Poland has the right to possess an ID card ," while Section 2 states that " An adult citizen of the Republic of Poland residing within its territory is obliged to possess an ID card ."
The following article addresses the issue of using contractors' identity cards by obligated institutions, including mainly the right to copy them.
Due to the identified practice by banks of copying documents confirming the identity of contractors, the President of the Personal Data Protection Office conducted an analysis to examine the legality of such activities. Pursuant to Article 112b of the Banking Law, "Banks may process information contained in identity documents of natural persons for the purposes of their banking activities." According to the President of the Personal Data Protection Office, this provision only authorizes banks to access information contained in identity documents as part of their processing, which should not be treated as equivalent to the ability to create copies of documents containing the data in question. However, the President of the Personal Data Protection Office's position is not absolute due to an exception arising from the provisions of the AML Act.
Article 34, section 4 of the AML Act states that "For the purposes of applying financial security measures, obligated institutions may process information contained in the identity documents of the client and the person authorized to act on their behalf, and make copies thereof." Therefore, when analyzing both cited provisions, it is important to note that, in addition to the duplicate right to "process" data, the ability to "copy" is contained only in Article 34 of the AML Act. According to the President of the Personal Data Protection Office, the literal wording of the cited provisions leads to the assumption that making copies of identity documents is justified only in the event of the application of security measures aimed at counteracting money laundering and terrorism financing. Otherwise, to the extent it does not meet the above purpose, it should probably be treated as made without a legal basis.
It's worth noting, incidentally, that scholars have expressed disapproval of the conclusions presented by the Personal Data Protection Office (UODO). Such arguments, given the partially different scope of the provisions in question, raise doubts about their actual applicability and the manner of their application.
The question therefore remains whether the scope of "processing" also includes "copying," since the legislator clearly distinguished between these two rights in Article 34 of the AML Act. The definition of "processing" was regulated by the legislator in Article 4(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and means "an operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction";
Taking the above division into account, it should be considered whether, if the legislator's intention was to provide banks with the possibility of copying documents confirming the identity of a given contractor under Article 112 of the Banking Law, this right would not be enumerated in the text of the provision, especially since it is not included in the above definition of "processing".
This article is for informational purposes only and does not constitute legal advice.
Legal status as of September 21, 2022
author:
