Spain’s own data protection agency found that laws which force hotels and travel agencies to collect tourist data including passport and bank card information break the European Union’s rules
New “Big Brother” laws in Spain that force tourists to provide the government with their passport information been ruled unlawful, but holidaymakers have no choice but to comply.
Since December, Spain’s interior ministry has demanded hotels, travel agencies and car rental companies collect up to 43 pieces of data from tourists, including passport and bank card information, and share it with the government.
The rules are designed to help police track organised crime gangs and terrorists, but travel associations in Spain and other parts of Europe have likened the change to helping create “Big Brother” levels of surveillance.
Now Spain’s own data protection agency (AEPD) has found that the new law breaches the European Union’s data protection rules regarding the copying of passport information and also increases the risk of identity theft.
However, the state agency, which has the authority to investigate issues and impose fines, lacks the power to veto regulations passed by the government, leaving tourists vulnerable to privacy breaches.
It means that British tourists, who made up 18 million of Spain’s visitors last year, will have to comply with the rules that require personal data, including email addresses, phone numbers, and home addresses, to be stored by the country’s government.
“People who come to Spain want to enjoy their holidays and not get bogged down by an intrusive administration which puts their privacy at risk,” said Jorge Marichal, president of Cehat, Spain’s largest hoteliers’ association. He added that it could cause uncertainty for tourists and the industry alike.
Catiana Tur, director of Acave, one of the largest travel agencies’ associations in Spain, said the regulations seemed “just like Big Brother”.
“The data protection agency has said that copying passports or ID cards is not permitted. However, it did not say anything about the fact that tourists, hoteliers and travel agencies have to supply all the rest of this information, according to the government regulations,” she told The i Paper.
Ms Tur claimed these rules are the “strictest regulations in Europe” which could cause delays for tourists or might even put people off coming to Spain.
Tourists have separately been the subject of widespread protests in Spain over the past year, with some even soaked with water pistols in Barcelona and Mallorca during demonstrations over the affects of over-tourism on local people and the cost of living.
The new rules put further pressure on tourism companies and accommodation owners, who face fines of up to €30,000 (£25,645) if they fail to comply with the data demands.
It means holidaymakers must supply all the requested information when they book a hotel or hire a car, perhaps months before travelling, and then again when they arrive in Spain.
The need to input the additional information could cause long queues for tourists when they arrive at a hotel or pick up their car hire, while people at front desks send their personal data and credit card information to the Spanish authorities.
Spain’s AEPD states that the new law contravenes the European Union’s data rules because making a copy of a passport or national identity card infringes EU data minimisation principles. These principles are designed to ensure organisations collect only the minimum amount of personal data necessary for a specific, clearly defined purpose.
The AEPD said: “The agency establishes… that this collection of information does not authorise requesting a copy of the client’s identity document, as this would violate the principle of data minimisation and constitute excessive processing.
“Documents such as the DNI (national identity document) include additional information beyond that required by law (such as a photograph, expiration date, national identity document or parents’ names), the processing of which increases the risk of identity theft.”
Spain’s interior ministry said the information will be kept confidential.
Fernando Grande-Marlaska, Spanish interior minister, said last year that the new rules “balanced all considerations, including both the right to privacy as well as the need to protect the security of society as a whole”.