– The European tourism sector reacts
The European Commission has launched infringement proceedings over Spain’s system for recording visitor data. Hotels, travel agencies, and hospitality organisations describe the rules as excessive data collection and an undue administrative burden.
More specifically, the dispute over Spain’s system for collecting travellers’ personal data is taking on a significant European dimension, as the European Commission has decided to initiate formal infringement proceedings against Spain, challenging the compatibility of Royal Decree 933/2021 with EU data protection law.
The development was welcomed by a broad coalition of European tourism and travel organisations, including ECTAA, HOTREC, ETOA, EFCO&HPA and RuralTour, which have been calling for years for a revision of the Spanish framework.
What the Spanish system provides
Royal Decree 933/2021, which was fully implemented at the end of 2024, requires hotels, tourist accommodation providers, travel agencies, car rental companies, and other tourism service providers to collect and transmit a large volume of personal data from travellers to state authorities.
The information requested includes personal identification data, contact details, information on accompanying persons and family members, payment data, transaction records, as well as details related to guests’ accommodation and travel.
According to the Spanish authorities, the measure is intended to enhance security and improve the fight against terrorism and organised crime.
The Commission’s objections
On 4 June, the European Commission announced that it had sent a formal notice to Spain, expressing serious concerns about the compatibility of the system with EU data protection rules.
According to the Commission, questions arise regarding:
- the scope of personal data being collected,
- the collection of payment and location-related information,
- the extent of access granted to law enforcement authorities,
- the data retention period, which extends up to three years.
The Commission considers that it must be assessed whether these measures are necessary and proportionate to the security objectives pursued.
Long-standing pressure from the tourism sector
The Commission’s intervention did not come as a surprise. European tourism organisations note that in recent years they have made extensive representations to Spanish and EU authorities, warning about the impact of this regulatory framework.
Since 2024, associations have repeatedly sent joint letters to Spain’s Ministries of the Interior and Tourism, the Spanish Data Protection Authority, the European Commission, and other relevant bodies.
At the same time, they submitted detailed legal opinions and participated in public consultations, arguing that certain provisions may be in conflict with the GDPR and the European data protection framework.
Hotels and travel agencies describe excessive burdens
Representatives of the tourism sector argue that the Spanish system not only raises concerns over personal data protection, but also places a significant burden on businesses.
As they note, the requirements for collecting and transmitting large volumes of information create higher administrative costs, additional bureaucracy, technical compliance difficulties, increased risks in the event of data breaches, and legal uncertainty regarding the application of the GDPR. These burdens affect not only Spanish businesses but also thousands of European travel agencies, tour operators, and accommodation providers operating in the Spanish market.
Security and fundamental rights
The coalition of European associations makes clear that it fully recognises the importance of measures aimed at combating terrorism and organised crime.
However, it stresses that any security measures must respect the fundamental principles of EU law, such as:
- necessity,
- proportionality,
- legal certainty,
- the protection of citizens’ fundamental rights.
According to the industry, achieving security objectives should not lead to unjustified mass collection of personal data or create disproportionate obligations for businesses.
What comes next
The issuance of a formal notice marks the first stage of infringement proceedings. Spain is now required to respond to the European Commission’s concerns and justify the system’s compatibility with EU law. If the response is not considered satisfactory, the procedure may advance to the next stages, potentially leading to the country being referred to the Court of Justice of the European Union.
Broader implications for European tourism
The case is being closely monitored by the European tourism sector, as it could set an important precedent for how issues related to the collection and processing of traveller data will be handled in the future. The final outcome of the proceedings is expected to affect not only Spain, but also the broader European approach to balancing public security, personal data protection, and the functioning of the tourism industry.
For hotels, travel agencies, booking platforms, and tourism service providers across Europe, the case is already considered one of the most significant regulatory developments in recent years in the hospitality and travel sector.
