Accommodation and vehicle rental platforms will share customer data with police: Spanish update | Hogan Lovells
The Spanish government has approved a royal decree by which people or companies that offer accommodation and / or car rental services (without driver) will have to share a very large list of personal data with the Spanish authorities responsible for the application (the police).
The obligation to Royal Decree 933/2021 is not new to regulated hotels and car rental services, as they already have reporting obligations for security reasons in Spain. The objective of this royal decree is to adapt the reporting obligations to the new online platforms that have appeared with the growth of e-commerce companies.
Who is affected by this royal decree?
Regarding hosting services, the royal decree covers services, whether offered by a company or not, which provide overnight accommodation in exchange for an economic consideration, in particular:
- Electronic commerce platforms that act as intermediaries between hosting services and consumers by electronic means (eg Internet) insofar as they provide said services in Spain.
- Accommodation activities open to the public and regulated by the corresponding sectoral laws, such as hotels, rural houses, hostels, etc.
- Camping and motorhome facilities.
- Tourism operators who act as intermediaries between accommodation companies and consumers.
Regarding car rental services, it concerns companies that offer cars without driver, for a predetermined period in exchange for an economic consideration. This definition encompasses traditional car rental companies, as well as e-commerce platforms that serve as intermediaries between car rental services and consumers through electronic means (e.g. the Internet) to the extent that they provide these services. in Spain.
When will this royal decree be applicable?
The royal decree will be applicable in six months. However, the data communication obligations to the competent authorities will apply from January 2, 2023.
How will the reporting obligations work in practice?
Companies falling within the scope of the Royal Decree will have to have an electronic register in order to comply with the new obligations. Before starting the activity, the company will have to communicate the details of the commercial data in order to “register” in the platform.
Regarding customer data, he will have to complete a very detailed form and keep customer data for three years. These data must be communicated via an electronic platform to the competent authorities.
What data should be reported?
Data to be shared includes, for example:
- Traveler’s data: (i) name; (ii) last name; (iii) second surname; (iv) gender; (v) identification number; (vi) document support number; (vii) type of document (national identity card, passport, foreign identity card); (viii) nationality; (ix) date of birth; (x) place of usual residence, including full address, region (locality) and country; (xi) place of temporary residence, including name of establishment, full address, region (locality) and country; (xii) landline telephone number; (xiii) mobile phone number; (xiv) email address; (xv) number of travelers; and (xvi) family relationship between travelers (in the case where a person is a minor).
- Transaction data: (i) contract data, including reference number, date and signatures; (ii) contract performance data, including date and time of entry and exit; (iii) property data including full address, number of rooms and internet connection (yes / no); and (iv) payment data, in particular the type (cash, credit card, etc.), identification of the means of payment (type of card and number, etc.), the holder of the means of payment, the date card expiration date, payment date, amounts paid and transaction / authorization identification.
Is there a possibility to challenge the Royal Decree?
Yes, royal decrees can generally be challenged, within 2 months from the date of promulgation, if they do not comply with “superior” laws, including organic laws and the Spanish Constitution. Of course, each specific situation must be carefully considered.