Information newsletter
Issue 4(16), April 2005

Case of the month: Is it legitimate to be asked for a copy of your ID
Darina Palova, AIP

Case:

The Prisons directorate within the Ministry of Justice requires a copy of the IDs as part of the application documents of people who wish to work on probation. Is this legitimate?

Comment:

The requirement for potential workers to submit a copy of their personal identification documents is a common practice for most employers. Besides, a large number of data controllers impose the same requirement on those willing to benefit from social services or on those who are buying leased goods. Even the Personal Data Commission itself had a similar requirement towards those natural persons who submitted their documents for registration as data controllers¹.

It’s hardly possible to give an unequivocal answer whether this is a legitimate requirement. Without any doubt, there is a violation if the employers retain the personal identity card of potential employees in order to collect the necessary data. The card is the basic identification document for all Bulgarian citizens, according to the Bulgarian Identification Documents Act and can only be detained by institutions within the Minsitry of Interior, and then only in specifically defined cases.

Obviously, employers do not need all information contained in personal identification cards - they should only write down the Personal ID number, the card registration number, and the address of their future employees. The personal identity card contains a lot of other information not directly related to the data controllers, like the place of birth, the height, the eyecolor and other distinguishing features of the job candidates. Collecting all this additional information is usually done "just in case", without a relevant purpose. In this sense, we would recommend collecting only the necessary data from the identity card, without requiring the job candidates to provide a photocopy.

Consequently, without an explicit legally defined provision requiring job candidates to submit photocopies of their IDs and authorizing employers to collect and retain them, they can only be collected with the explicit consent of each individual candidate without this being a requirement. Even when photocopies of IDs are voluntarily submitted, the data controllers are obliged to inform the job candidates how (for what purpose) the photocopies of their personal identification cards will be used. Employers should also destroy all collected personal data after processing them and after they have fulfilled their purpose.

1. Amendment № 2 to Art. 33, paragraph 1 of the Internal rules of the Personal Data Protection Commission and its administration.