EU probes Spain's extensive traveler data collection rules

The European Commission has initiated infringement proceedings against Spain concerning its regulations that mandate tourism companies to collect extensive traveler data. European industry organizations representing hoteliers, travel agencies, and campsites have welcomed the Commission's decision. The Spanish decree, Royal Decree 933/2021, requires tourism service providers to transmit a wide range of customer information. Industry groups contend that these requirements exceed what is necessary for public security objectives. They have been engaged in dialogue with Spanish authorities and the European Commission since 2024, presenting legal analyses and highlighting the risks associated with overly broad regulations. The primary point of contention is the data collection itself. Organizations point out that the regulations encompass not only basic identification details but also payment and location data. The European Commission is scrutinizing whether the catalog of required information is too extensive. The three-year data retention period and the extent of access granted to law enforcement agencies are also under review. Tourism sector representatives feel caught in a difficult position, needing to comply with Spanish rules while also adhering to European data protection laws. While the industry supports anti-terrorism and organized crime efforts, it stresses that security measures must align with principles of necessity, proportionality, and legal certainty. The outcome of this proceeding could influence future regulations on traveler data collection across the entire European Union.