On 12 July 2019, the provisions of the Act on Public Documents entered into force. It provides, inter alia, for a penalty of up to two years in prison for manufacturing, offering, selling or storing in order to sell a replica of a public document. As a consequence, some have arisen questions as to whether a photocopy or a scan of the ID card, which employers often make, is covered by this criminal sanction. 

In the light of the new regulations, it is forbidden to make a replica of a public document. A photocopy or a scan of an ID card cannot be considered as a replica within the meaning of these provisions. These types of copies do not have the features of authenticity, such as optically variable paint, elements visible under UV light or other elements that ensure the security of an identity card. This means that copying or scanning ID cards is not an offence.

This does not mean, however, that it is possible to copy or scan ID cards or other documents without restrictions. The rules governing processing of personal data apply, including the GDPR rules. According to the principle of data minimisation, processing (including storage) of data is allowed only to the extent that is necessary for the purpose of this processing. The retention period for ID copies should also be limited to the minimum necessary to fulfil this purpose. Hence, although storage of documents is not punishable by imprisonment, if their retention is not necessary for the purpose of processing personal data or the obligation to store them does not arise directly from legal provisions, there is a risk of liability for incorrect processing of personal data, including administrative fines.