Hotels in Spain obliged to collect up to 42 pieces of personal ...

Hotels in Spain will need to provide more personal information about their customers to central government after a new data law came into effect this Monday 2 December. Businesses that do not comply with the rules, which also apply to rental properties, campsites and car rental agencies, face fines of up to 30,000 euros.

The tourism sector has criticised the new rules, calling them out for the bureaucracy involved, and fearing a possible loss of competitiveness and breach of tourists' privacy. However, the ministry of the interior said the new rules are justified and that transparency had been key during the process of drafting and approving the decree.

Businesses will need to be registered on the ses.hospedajes platform, which has been available since 2022 and which has already registered 61,540 hotels, 1,994 travel agencies, 222 digital platforms, and 1,720 car rental agencies. These registrations contribute to a total of 4.77 million user data.

The department headed by Fernando Grande-Marlaska said the new decree is being brought in for national security reasons, adding that the biggest attacks on the public are carried out by both terrorists and organised crime. In both cases, acquiring accommodation and rental vehicles, usually done online, are crucial to their criminal plans, Grande-Marlaska added.

He said the current 65-year-old rules are "obsolete" and do not include new types of accommodation such as short-stays operated by companies or individuals. This equates to a total of almost 4.8 million data, which is 18,584 people now in national or international databases, according to the interior ministry.

Companies affected

The new rules apply to companies or individuals who carry out services such as operating accommodation or vehicle rental agencies. Accommodation activities are those carried out, whether professionally or not, for the purpose of providing, in exchange for a fee, a room or space for overnight stay to people. This ranges from hotels, hostels, guesthouses and rural tourism establishments to campsites and caravan parks.

Meanwhile, car rental activities include facilitating third parties by renting out any vehicle for a specific period of time in exchange for a fee. Excluded from the provisions of this section is the hire of auto taxis and the hire of vehicles with a driver.

The new rules also include tour operators that provide intermediation services between travel businesses and tourists, and the activity of digital platforms dedicated, for a fee or free of charge, to intermediation in these activities.

The interior department said the new register does not have to result in an increase in costs for the companies affected, given that "the data collected are the same as before".

Mandatory data

The ministry said that companies will not collect more data than they are already collecting at present. Operators that offer accommodation services will need to provide the following:

Details of the lessor company: Name or company name of the owner, CIF or NIF, municipality, province, landline and/or mobile phone number, e-mail address, company website and url.

- Establishment details: Type of establishment, name, full address, postcode, town and province.

- Tourists' details: full name, sex, identity document number, type of document (ID card, passport, TIE), nationality, date of birth, usual place of residence (full address, town and country), landline and mobile phone, e-mail, number of tourists and relationship between tourists (if any of them are minors).

- Transaction data: Contract (reference number, date and signatures), contract execution data (date and time of entry and date and time of exit) and payment data (type, identification of the payment means such as card type and number, holder of the payment means, card expiry date and date of payment).

In addition, for non-professional accommodation some data varies, including full name, gender and ID of the owner of the property, as well as number of rooms or internet connection of the site.

In the case of car rental agencies, the data to be provided are similar to those for accommodation, but with the addition of the corresponding information on the main driver and the second driver (if applicable).

Sanctions

Although the ministry wanted to make it clear that this regulation does not have "a collection purpose to fill the state's coffers", minor and serious sanctions will be imposed on companies that fail to comply with the regulations. Irregularities in the data provided, or incomplete data, could be considered minor offences and result in fines ranging from 100 to 600 euros.

Serious penalties include a lack of documentary records provided and the omission of data and could result in fines ranging from 601 to 30,000 euros.