Travel groups warn over enforcement of Spain’s new data rule

Travel associations have urged the Spanish government to suspend the enforcement of a new regulation forcing travel companies to collect extensive traveller data from 2 December.

The regulation, known as the Royal Decree 933/2021, requires travel agencies, hotels and car rental firms to report data on travellers visiting Spain. This includes phone numbers, contact emails, family relationship details and payment methods used.

The decree was originally introduced in January 2023 but an “adaptation” period delaying its enforcement has been extended several times over the past two years. The government currently intends to start enforcing the decree from 2 December, despite strong opposition by the Spanish parliament and senate.

The European Travel Agents’ and Tour Operators’ Associations (ECTAA), alongside Spanish travel agency body ACAVE, have warned about the “seriousness of this regulation”.

In a joint statement, the groups said: “Travel agencies, tourist accommodation and car rental companies will be required to provide the Ministry of the Interior with more than 40 pieces of information for accommodation bookings and over 60 for car rental bookings, many of which are sensitive personal data.

“This regulation was developed by the Ministry of the Interior with the goal of security and providing police forces with more information about travellers arriving in and passing through Spain. However, the scope of the requested data is excessive and could violate data protection regulations.”

ECTAA and ACAVE are warning of “severe repercussions for the European tourism market and the protection of travellers’ personal data” if the government does not suspend the enforcement of the decree. They also argue that it could also “constitute a violation of European data protection laws”.