Asked for a photo of your ID card? Learn when to say no (and what to do)
A note for readers outside Spain. The concrete references in this article — the Spanish DNI identity card, the Cl@ve and VÀLid digital identity systems, the police forces and the Spanish Data Protection Agency — are the ones that apply where I write from. The criteria are the same anywhere in the European Union: substitute your own national ID document, your own national electronic identity scheme and your own data protection authority.
It has become an automatic gesture. You sign up at a coworking space, rent a flat, join a platform or buy something second-hand, and someone says: "send me a photo of your ID, both sides". And you take it and send it over WhatsApp without thinking, because everyone asks for it and it feels normal.
It is not that normal. A photo of your ID card is, literally, the key to your identity. And once you have sent it, you no longer control where it ends up.
What someone can do with a photo of your ID
With an image of the document — especially both sides, which is what people tend to ask for — somebody can try to open accounts or take out services in your name, apply for small loans, duplicate your SIM card to receive your verification texts, or get past the weaker identity checks of other platforms.
And the person misusing it need not be the one who asked. It is enough for that photo to sit in a chat, an inbox or a poorly protected server and for somebody to reach it one day. An ID card is not changed like a password: if it leaks, the problem can stay with you for years.
Where it makes sense and where it does not
The key question is not "are they allowed to ask?", but "is it necessary and proportionate for what I am doing?". The GDPR says you can only be asked for the data that is indispensable for a specific purpose.
It is usually justified at a bank opening an account, a telecoms operator setting up a line, public administration, a notary, or a rental or employment contract: these are cases where the law requires verifying who you are. But justified does not mean "over WhatsApp": it has to go through that organisation's official, secure channel — its app, its online portal, or in person.
By contrast, you should be wary of a private second-hand seller, a WhatsApp group, a social network asking for your ID "to verify you are real", an unfamiliar website, or anyone putting you under time pressure. Here you almost never need to send the whole document, and often you do not need to show it at all.
The six habits that protect you
1. Ask before sending anything. "What exactly do you need it for? Is it mandatory? On what legal basis?" A serious organisation will be able to answer. If they get uncomfortable or cannot justify it, that is a bad sign.
2. Show it in person whenever you can. What is seen and not kept cannot leak. Sometimes showing it is enough, leaving no copy behind.
3. If you have to send it, use the official channel. Never over WhatsApp or a random email. An app's secure upload is far better than a chat that half an office later forwards.
4. Add a watermark. Write across the image, over the data but without completely obscuring it, a line such as: "Copy exclusively for [purpose], [date]. Not valid for any other use." It is not infallible, but it makes the photo harder to reuse and makes clear that any other use is fraudulent. There are free apps that do it in seconds.
5. Send the minimum. If they only need to check your face, cover the number; if they only need the number, hide the rest. Do not give more than you are asked for.
6. Use official digital identity. Cl@ve, the electronic DNI or, in Catalonia, the VÀLid system exist precisely so you can identify yourself without scattering copies of the document around.
And if you have already sent it, or it is being misused?
Do not panic, but act. If you suspect somebody is making improper use of it, you can exercise your GDPR rights and ask whoever received it to delete it. Watch for accounts, contracts or bills you do not recognise, and if you detect fraud, report it to the police and notify the Spanish Data Protection Agency. The sooner you catch it, the easier it is to stop.
Ethics as a shield
The usual idea: protecting yourself costs neither money nor technology, it costs stopping to think for three seconds before sending. An ID card is one of the few things that, once it leaves your hands, you cannot get back. It is worth treating it as what it is.
About this article
iaetica.cat is a space for public writing: I publish here what I am learning about artificial intelligence, its ethics and its law.
— Laura Graells