Spain's Traveler Registry Breached EU Data Rules, Brussels Says 2026

Spain's Traveler Registry, which requires hotels, digital platforms, and car rental companies to collect and transmit personal data of tourists to a state database, has been found by the European Commission to breach EU data protection rules. The Commission opened an infringement procedure against Spain on Thursday, giving the country two months to respond and address the concerns.

The registry, regulated by Royal Decree 933/2021 and fully operational since late last year, mandates that accommodations, travel agencies, and vehicle rental companies upload client data to the 'ses.hospedajes' application and forward it to a centralized government database. The declared goal, as stated in the decree's preamble, is to strengthen the fight against terrorism and organized crime, where lodging and vehicle use are argued to have special logistical relevance.

What Exactly Is the Traveler Registry?

The Traveler Registry is a Spanish government mandate that compels businesses in the tourism sector to collect detailed personal information from their customers and report it to authorities. This includes data such as names, identification numbers, contact details, and payment information. The information is then stored in a central database accessible to the police.

The regulation applies to a wide range of entities: hotels, hostels, short-term rental platforms like Airbnb, travel agencies, and car rental companies. Since its full implementation, these businesses have had to adapt their systems to comply with the data transmission requirements, often at significant administrative and financial cost.

Brussels' Three Main Concerns

The European Commission has identified three specific problems with the Spanish registry. First, it considers the categories of data collected and stored to be "excessive," given the variety of data sets required. The Commission argues that the scope of information goes beyond what is necessary for the stated purpose of fighting crime.

Second, the Commission questions the proportionality of the measure. While acknowledging the importance of combating terrorism and organized crime, it suggests that the blanket collection of data from all travelers is not proportionate to the objective. Third, there are concerns about the lack of adequate safeguards for data protection, particularly regarding access to the data by law enforcement.

Why This Matters for Businesses and Travelers

For businesses in the tourism sector, the infringement procedure creates uncertainty. If Spain is forced to amend or repeal parts of the registry, companies may need to adjust their data collection processes again. Meanwhile, travelers may see changes in how their information is handled, potentially reducing privacy risks.

The outcome of this procedure could also set a precedent for other EU member states considering similar measures. It underscores the tension between security needs and privacy rights within the EU's legal framework. The background to this story is set out in RNLI Data Breach: Supporters Warned After Cyber Attack. A related thread runs through Spain's AP-68 Toll Goes Cashless: Basque Country Registration Required. Earlier coverage in UK State Investment Agency Data Breach Exposes Officials shows how the argument developed.

• Infringement procedure: The European Commission has formally notified Spain of the breach, starting a legal process that could lead to the Court of Justice of the EU.
• Two-month deadline: Spain has two months to respond to the Commission's concerns and outline corrective measures.
• Data categories deemed excessive: The Commission believes the registry collects more data than necessary for its stated purpose.
• Impact on tourism sector: Hotels, rental platforms, and car rental companies face compliance costs and potential changes.
• Privacy implications: Travelers' personal data is stored in a police-accessible database, raising concerns about misuse.

What Happens Next?

Spain now has two months to respond to the Commission's letter of formal notice. If the response is unsatisfactory, the Commission can issue a reasoned opinion, giving Spain another two months to comply. If Spain still fails to address the issues, the case can be referred to the Court of Justice of the European Union, which can impose financial penalties. A closer look at the same subject appears in Asos Data Breach: Hacker Accessed Customer Data via Trusted Contact. Anyone following the wider picture can start with Why a Divorce Registry Would Be a Lifesaver for the Newly Single. The same theme surfaces in Lloyd's Ex-CEO Breached Compliance Rules Over Close Relationship, which takes a different angle.

The Spanish government has not yet commented publicly on the procedure. However, given the registry's controversial nature, it is likely to defend the measure as necessary for security. The outcome will depend on whether Spain can justify the data collection as proportionate under EU law. Context on how this played out before sits in Land Registry Paywall Removal Delayed as Ownership Data Remains Opaque. A companion piece, Land Registry Paywall Removal Delayed as Ownership Data Stays Opaque, approaches the same subject from another angle.