I am developing an online registration form for a discount program whose eligibility can be determined by examining a person's ID. When a user submits the form, he or she is asked to upload a photocopy of the ID will be sent via email to the organization for verification. I have steered the stakeholders away from allowing a photocopy of a drivers license for security concerns, but there are other types of ID I'm not sure about. The examples I was given were:

  • A student ID
  • A student metro card (the organization is in New York)
  • An NYCid (I assume referring to this: https://www1.nyc.gov/site/idnyc/index.page)
  • A military ID
  • A medicare card
  • A Social Security benefit card
  • A WIC card
  • Any union ID

I did some research and I'm getting various answers about each type. Is "don't email any id at all" just the best rule to follow?

  • There are quite a few anti-counterfeiting measures on most government IDs, which by design can't be replicated from (just) a photocopy. So the ID itself can't be faked from the photocopy. There might be sensitive information on it, though, and I don't know anything about that (or I'd be posting an answer).
    – anon
    Commented Jul 23, 2019 at 20:59
  • Because many IDs have an online use, I wouldn't expect very many would be immune to problems from a photocopy. I'd say that for most: if you can't swipe it, you can type it.
    – mbomb007
    Commented Jul 23, 2019 at 21:47

1 Answer 1


"Safe" for whom? I'm seeing a significant risk for your organisation to accept any of those things.

Personal data is a "toxic asset", which means its liabilities are greater than its assets. If you accept those things, then you are responsible for those things for as long as you store them. There are many regulations that you would have to be mindful of, and if the data was leaked, your legal liabilities would be higher than normal.

None of those things is safe for the end user, either. Each one poses a significant ID theft risk. Maybe not the Metro card.

And then you are emailing these documents. Each email server in the chain from the sender to the recipient would get a copy of the ID. At least, if you decide to do this, provide a web-based upload facility instead of email.

As a privacy expert, I would strongly advise against any of these things.

If you need official ID verification, use a 3rd party service, like Yoti, or something. Else, design your service to not require an error-prone, easily-faked process such as a scan of paper documents.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .