Can ID cards be copied in the Czech Republic? And what does the AML Act say?

Czech law provides enhanced protection for such identity documents, expressly prohibiting their copying without the consent of the data subject. If such consent is given, it should be verifiable and it should also comply with the requirements of the GDPR, as the copying of an identity document and its subsequent storage constitutes the processing of personal data. 

Copying or scanning an identity document, albeit with the consent of the data subject, should always be exceptional, necessary and justified. Moreover, the data subject should not be subject to any form of coercion, for example by being denied a service or goods. Another good example is that of couriers copying the data subject’s identity document when delivering a parcel to them; such practise has been considered illegal by the Czech supervisory authority. This was also the case with an employer who illegally and redundantly made and kept copies of employees’ ID cards. Therefore, in many cases, the mere presentation of an identity document without it having to be copied will be sufficient in practice and according to the Czech supervisory authority will not constitute the processing of personal data per se.

However, there are exceptions to the foregoing prohibition on making copies, as set forth in certain special laws, such as the Police Act, the Tax Code, the Inspection Code and the Money Laundering Act (“AML Act”), to name but a few. And indeed, the AML Act is somewhat of an enigma in the Czech Republic in this respect. 

To combat money laundering and terrorist financing, it is necessary to keep a record of asset movements, including a record of who the assets are being transferred to and from. This is mainly done by identifying the client as required by the AML Act. Copies of identity documents therefore constitute important and indispensable evidence and function as a tool for combating money laundering.

According to the Czech AML Act, obligated persons (such as a bank, a lawyer depositing money, or a real estate agent mediating the sale of real estate) who conduct AML identification are not obligated to make a copy of the data subject’s identity document, they are only entitled to do so. This has led to confusion in the past as to whether copies should be made or not. 

In the summer of 2023, the Czech Financial Analytical Office (FAO), an AML supervisory authority, issued a new methodology clarifying this issue. The FAO stated that an obligated person may copy ID cards and passports for the purposes of the AML Act even without the holder’s consent, if its risk assessment and data protection impact assessment (DPIA) pursuant to Article 35 of the GDPR show that the identity documents should be copied in this case. Therefore, the DPIA is mandatory for this purpose and the copying of the identity documents should also be based on the obligated person’s internal AML documentation (in the so-called AML risk assessment).

The FAO also emphasised that copies should be of sufficient quality, in colour and show all the pages of the identity document with the relevant data. It identified typical situations in which it is appropriate to make copies, such as the safekeeping of valuables, the use of a damaged or obviously forged identity document, or the use of foreign identity documents. 

The obligated person may only use a copy thus made for the purposes of the AML Act. In order to use it for other purposes, the obligated person must have further legal authorisation to process personal data. 

Going forward, digital ID documents will continue to play a role in the future, although their protection in cyberspace will become much more complex. ​