Starting next December, temporary accommodation and vehicle rental companies will request much more data from their clients than they have been doing until now, due to a new law promoted by the Ministry of the Interior.
There are just 3 months left until a new law comes into effect that will significantly change the way in which tourist accommodation and rent-a-car companies relate to their clients. When you are going to book a hotel room, an Airbnb, or rent a car, you always have to offer your DNI information, such as the number or date of birth, or even facilitate a photocopy of the document.
However, starting next December 2, when the new Royal Decree 933/2021the amount of data that these companies must collect from their clients increases drastically, and with this, the privacy of both Spanish and foreign citizens decreases, who will have to accept that personal data such as bank details or the address of their habitual residence enters in the systems of the Secretary of State for Security (not in those of the Police, as was the case before).
Specifically, there are 18 new data that users will have to provide. Travel agencies, hotels, accommodation or rent-a-car, for their part, will have to provide 10 new data about their company.
In addition to those mentioned above, clients will be obliged to inform the holder of the payment method, the expiration date if paying by card, the date and time of entry and exit of the establishment, the ID support number. , and detail the relationship when there are several guests and one is a minor.
The measure, promoted by the Minister of the Interior Fernando Grande-Marlaska, is justified by the Government in the improvement of security against possible terrorist acts: “Special importance will be given to the possibility of interconnection with other police databases for the purposes to improve effectiveness in the prevention and investigation of terrorist crimes or those related to serious organized crime,” can be read in the BOE.
Criticism from the sector and privacy advocates
Approaching the date of entry into force, the new law has been generating criticism both from the tourism sector and from a part of the citizenry concerned about the intrusion into their privacy. Some European and American newspapers have also echoed and cast doubt on the convenience of this regulation.
This is legislation without equivalents in other countries due to the large amount of data it requires to be extracted, and it causes anger among businessmen in the sector due to the technical difficulties when collecting all this data. They speak, for example, of an increase in the duration of the check-in process due to the need for the receptionist to enter all this data into the system by hand.
Companies face fines of up to 30,000 euros if they do not comply with the law. In addition, they could face light sanctions even for entering erroneous data, since the law contemplates punishment for “irregularities or deficiencies in the completion of the records provided for in this royal decree.”
Some disseminators and law experts, such as Borja Adsuara, have openly criticized the measure, pointing out that it could conflict with the General Data Protection Regulation of the European Union or even with the rules of the Spanish Data Protection Agency itself. Data (AEPD).
At the same time, the greater the amount of data collected, the greater risk citizens run in the event of a possible cyber attack or data leak by public administrations. As recognized by the AEPDwith the permanent interconnection between Administration systems “massive personal data breaches of high risk for fundamental rights may occur.”
The 18 pieces of information that must be provided
Below, we list each of the new data that car rental users or hotel or accommodation guests will have to provide to the business, as can be read in the BOE:
- DNI support number
- Place of usual residence (full address, town, country)
- landline telephone
- mobile phone
- Number of travelers
- Kinship relationship between travelers in the event that one is a minor
- Contract reference number
- Contract date
- Date and time of entry and exit (previously only the entry date was provided)
- Payment details (cash, credit card, platform or transfer)
- Identification of the payment method (card type and number, bank account IBAN, mobile payment solution and others)
- Owner of the payment method
- Card expiration date
- Date of payment
Added to these are three pieces of information about the tourist establishment or accommodation:
- Complete address of the property
- Number of rooms
- Internet connection (yes/no)
