Spain reminds hotels that it's illegal to make a copy of guests' IDs

The Spanish Data Protection Agency (AEPD) has sent a reminder to hotels that they are not authorised to make or request copies of passports and ID cards from their guests.

The notification was also sent to Spain’s Interior Ministry and the Confederation of Companies warning that copies can pose a risk to people's privacy.

A 2021 decree states that hotels and other tourist accommodation must collect certain pieces data from guests such as name, passport or ID number, address and date of birth.

Many of these are found in passports and ID cards and the agency has noticed that many hotels simply take a copy of these to get all the information at once, instead of asking guests to fill out each detail themselves.

While this might save time for both the hotel and the guest, it also violates the principle of data minimisation.

This means that these types of travel documents contain much more information than is required by law.

READ ALSO: How much will a holiday in Spain cost this summer?

Photographs, expiration date and parents' names for example are not necessary to check into a hotel, but by photocopying a passport, hotels automatically has all these as well.

This in turn increases a risk of identity theft, with hotel staff potentially able to get hold of these information and sell it on to others on the black market.

According to the Spanish Data Protection Agency, the ID cards are not a valid means of complying with the regulation, and sending a copy of documents does not allow for accurate verification of the identity of the person sending it.

AEPD advises that to authenticate the data provided in person, a visual verification of the document is enough.

If done online, digital certificates can be used as a form of authentication, but as these are usually only held by people in Spain, they are not useful for clients coming from abroad.

Therefore, the agency also suggests that codes could be sent to the customer's phone or email to verify them.

READ ALSO: Why is Spain's new 'Big Brother' tourist registration so unpopular?

One of the biggest issues is that at the beginning of December 2024, the Spanish government announced that hotels and other tour agencies, as well as car rental companies, would have to collate even more personal data from their customers.

Royal Decree 933/2021, now requires around 18 extra pieces of information from travellers, bringing it to a total of 42 separate details needed when registering tourists in Spain.

This is a lot of information to ask from tourists at check-in after a long flight or even to ask over e-mail. This goes a long way in explaining why many just decide to photocopy or ask for pictures of passports or ID cards instead.