Spain’s New Tourist Data Rules: Privacy Concerns and Industry Confusion

Spain has introduced new data-collection regulations aimed at enhancing anti-terrorism measures, which have sparked significant debate and confusion within the travel industry. These rules mandate that accommodations, car rental companies, and travel agencies collect over 20 pieces of personal information from tourists and submit them to the Spanish Interior Ministry. The initiative, officially termed Royal Decree 933/2021, has been met with criticism and uncertainty, both domestically and internationally.

Industry Reactions and Concerns

Travel advisors and suppliers have expressed confusion over the specifics of these regulations. Tom Jenkins, CEO of the European Tour Operators Association, noted that initial discussions with Spanish authorities suggested the rules would only apply to domestic companies. However, the final regulations did not include this provision, leaving many international tour operators uncertain about their obligations. The European Travel Agents’ and Tour Operators’ Associations have also voiced concerns, arguing that the decree could expose travelers to cyberattacks and misuse of their sensitive information.

Privacy and Legal Implications

Critics, including Ramon Estalella from the Spanish Confederation of Hotels and Tourist Accommodation, have likened the data collection to a “Big Brother” move. Questions have arisen regarding the regulations’ compliance with strict EU data protection laws. Despite these concerns, the Spanish Interior Ministry has defended the decree, stating it has been reviewed and approved by relevant authorities to ensure compliance with EU standards. The Ministry describes the new system as a modernization of existing protocols, transitioning from manual to electronic record-keeping.

Uncertain Future and Industry Impact

The Spanish Congress and Senate have shown resistance to the new rules, with legislative actions suggesting potential revisions. The uncertainty surrounding the regulations has left some travel companies, like ALG Vacations, adhering to their existing procedures, while others, such as the Globus family of brands, claim the data requirements are not significantly different from standard international travel practices. The ongoing confusion and lack of clarity have created a burden for the travel industry, with stakeholders like Jenkins emphasizing the need for certainty to effectively plan and add value for travelers.