New Data Collection Law in Spain: What Expats and Tourists Need to Know

In a significant development that is set to impact both expats and tourists in Spain, a new data collection law has come into effect, prompting concerns over data privacy and the tourist experience.

The New Law: Royal Decree 933/2021

As of December 2, 2024, Spain has implemented Royal Decree 933/2021, a law that mandates hotels, holiday rentals, campsites, travel agencies, and car rental companies to collect and report an extensive array of personal data from their guests. This decree, part of a broader effort to combat terrorism and organized crime, requires the collection of over 40 pieces of information for accommodation bookings and more than 60 for car rentals.

What Data Must Be Provided?

Tourists will now be required to share sensitive information such as their home address, banking details, phone numbers, and family relationship details. This is in addition to the already mandatory disclosure of full name, email address, and passport or ID number. Minors are not exempt from this requirement, and all collected data will be stored for three years.

Impact on Tourists and Businesses

The Confederation of Spanish Hoteliers and Tourist Accommodation (CEHAT) has been a vocal critic of the law, arguing that it will complicate the check-in process, leading to longer wait times and a less pleasant experience for visitors. CEHAT has also expressed concerns about the security risks associated with collecting such sensitive information, particularly in the event of cyberattacks.

Businesses that fail to comply with the new regulations face significant fines of up to €30,000. The law applies to mainland Spain as well as the Canary and Balearic Islands, and businesses must register with the Ministry of Interior and maintain detailed records.

Concerns Over Data Privacy

Industry experts and travel associations have criticized the law for its potential infringement on the right to protection of personal data. The European Travel Agents and Tour Operators Associations have warned that the data collection is excessive and could be used for purposes beyond combating terrorism and organized crime. There are also concerns about compliance with the European Union’s General Data Protection Regulation (GDPR).

Legal Challenges

CEHAT is currently exploring legal action against the decree due to the lack of dialogue with the government and the perceived negative impact on both businesses and tourists. The association has emphasized the need for transparency and compliance with European data privacy laws.

Practical Implications for Expats and Tourists

For expats and tourists, this new law means a more complex and time-consuming check-in process. It also raises concerns about the security of their personal data. Given the sensitive nature of the information required, it is crucial for travelers to be aware of the potential risks and to ensure that the businesses they interact with are compliant with the new regulations.

As Spain continues to navigate the implications of this new law, it remains to be seen how it will affect the tourism sector and the overall experience of visitors to the country.