Is it legal for hotels and Airbnb owners in Spain to take a photo or scan your ID?

If you're a tourist you'll typically be asked for your passport when checking in to your accommodation, but if you're a foreign resident in Spain you can also show your tarjeta de identidad de extranjero or TIE. 

The information they collect usually includes your full name, date of birth, nationality and passport number or foreign identity number NIE.

These details are required by the Spanish authorities and Airbnb hosts or hoteliers are obliged to complete a guest registration called the 'Parte de Entrada de Viajeros'.

This helps the authorities to monitor immigration, keep a record of tourist stats, and ensure the safety of both residents and visitors.

If you’re doing a self check-in your host will likely ask you to send a photo or scan of your passport or other ID card in order to gather the information.

If you’re checking in at a hotel reception they will either take your details directly from your passport or ID card, scan or photocopy them to gather the information at a later time.

READ ALSO: Can my neighbours stop me from renting out my Spanish flat on Airbnb?

But is it actually legal for hotels and accommodation hosts to ask for a photo, scan or photocopy of your ID?

Your passport, TIE or Spanish DNI card contains a lot of personal data and if it falls into the wrong hands, it could be used for phishing scams or identity fraud.

In fact, according to Spain's Federation of Consumers and Users (CECU) the law does not require the establishment to send a photograph or scan to the authorities, only the necessary data.

The Spanish Data Protection Agency (AEPD) states that making a copy of these documents is actually illegal and some cases can involve a fine of up to €100,000.

In 2022, a hotel was fined €30,000 because it collected and used customer photographs obtained at registration to control access and billing for their drinks during their stay.

The guests were unaware of this since the hotel did not include information about the use of these images in its personal data protection policy.

The CECU explained that “Under data protection regulations, more data than is strictly necessary to fulfil the contract cannot be requested, unless the law requires it or the user is informed and gives their consent. If it is not complied with the appropriate sanction must be imposed”.

This means that under no circumstances are hotels or Airbnb hosts allowed to keep copies or photos of your ID cards or passports. If they do ask for photos or scan them, they must delete or destroy the copies straight away after collecting the necessary information.

What can I do to protect myself and my data?

There are several steps you can take in order to protect yourself and prevent hotels and other accommodation providers from making or keeping copies of your data.

• Firstly, if you’re checking-in in person and your hotel asks for your passport or TIE in order to photocopy or scan it, you can remind them that this isn’t actually legal and ask them to just note down the relevant data instead.
  
  
• If doing a self check-in and your accommodation provider is asking for a photo of your ID, you can give them the necessary details instead of an actual photo. Remember to only submit your data via secure platforms and check that the web page has a padlock symbol or green bar to indicate it’s secure.
  
  
• If you are asked to send a photo of your ID by an apartment host via WhatsApp or text message you can either refuse and only send them the information that’s necessary or ask them to delete the photo as soon as they’ve taken down the details they need. Ask them to ensure they’re not storing a copy on their phone.
  
  
• If you’ve discovered that your accommodation website or messaging service via Booking.com for example has been hacked, it’s important to report the incident to the local police so that they’re aware that someone else could be using your identity.