Spanish record-keeping and reporting obligations imposed on travellers may violate the data protection regulations

The European Commission has launched infringement proceedings against Spain for failing to comply with EU data protection rules on collecting and processing travellers’ personal data.

Royal Decree 933/2021 establishing the record-keeping and reporting obligations (Royal Decree 933/2021) requires accommodation providers, online platforms, and car rental companies to collect, retain, and transmit travellers’ personal data to a centralized government database that is accessible to law enforcement authorities.

But, according to the Commission, this system breaches the Law Enforcement Directive (Directive 2016/680), which governs how personal data is processed by competent authorities in criminal matters and is intended to safeguard the fundamental right to data protection. Directive 2016/680 states that any processing of personal data by law enforcement bodies has to be necessary, proportionate, and tied to clearly defined purposes. Same principles are contained in the GDPR and the Spanish Fundamental Act 3/2018 on the processing of personal data.

Brussels has decided that Royal Decree 933/2021 doesn’t meet these standards. The Commission highlighted that the range of data collected is excessively broad, encompassing not only identification details but also sensitive categories such as payment information and GPS data. This breadth of data collection goes beyond what is considered strictly necessary for law enforcement purposes.

The Commission also raised concerns regarding how the data is accessed and retained. Access by law enforcement authorities, it argues, isn’t limited to specific and explicit purposes, as required under EU law. This lack of clear purpose limitation undermines one of the core principles of Directive 2016/680, which is designed to prevent arbitrary or overly broad use of personal data.

Spain’s policy of retaining all collected data for three years is also viewed as disproportionate. EU data protection rules require that personal data be kept only for as long as necessary to fulfil the purpose for which it was collected. In this case, the Commission considered the blanket three‑year retention period excessive and not sufficiently justified.

The opening of the case was formalized through the letter of formal notice sent to Spain. We’ll follow up this case and analyse whether the current obligations imposed by the Spanish government introduce any changes.