Data protection agency issues identity card and passport copy warning for hotel and holiday rental guests in Spain

Faced with numerous complaints, the Spanish data protection agency (AEPD) has stated that, according to the law, hotels and other types of holiday accommodation in Spain have no right to take a copy of guests' ID cards and passports.

AEPD stated that this common practice violates the principle of data protection and entails "excessive" processing, as the document contains more data than establishments are required to obtain (photograph, expiry date of the document, the 6-digit number in the corner of the Spanish ID card and the names of parents).

The AEPD added that a copy of personal documentation implies, among other things, an "unnecessary" risk of identity theft, which "must be avoided or, at least, effectively mitigated".

According to the AEPD, accommodation establishments can collect the information they need by asking the guest to complete a form, providing full name, sex, ID number, date of birth and mobile phone number. To authenticate the data provided in the form, a simple and quick visual check of the corresponding identity document should be enough, for which a copy is not needed.

In the case that data is collected without the guest being there in person, mechanisms such as digital certificates can help. "It is also possible to verify that the data matches by checking the payment method used," said AEPD.

Additionally, security codes sent to the guest's phone number or email address can be used as authentication factors, among the possible measures.