The arrival of the holidays and the summer campaign once again bring to the table a classic debate that generates doubts among both users and those responsible for tourist accommodation: the management of the ID card or passport during check-in.
The Spanish Data Protection Agency (AEPD) has once again established a clear and forceful criterion that completely prohibits photocopying, scanning or photographing customers' identity documents. Although this position is nothing new and privacy agencies have been insisting on it for years, the persistence of certain practices in establishments has led the authority to consolidate exemplary resolutions and sanctions to protect citizens' rights.
The reason for this requirement is as simple as it is fundamental: the principle of data minimization. Citizen security regulations require hotels, apartments and campsites to collect a series of basic data to prepare the entry statement and the registration book, such as the name, surname, document number, date of birth or nationality. However, when an establishment photographs or scans the entire document, it is storing excessive information that it does not need for anything, such as the person's photograph, handwritten signature, parents' names or date of issue. This additional data increases the risk of identity theft or fraudulent use if the accommodation system suffers a security incident or leak.
To have a peaceful summer in terms of privacy, the business community and users must assume very clear guidelines. For professionals in the tourism sector, the best advice is to immediately review the reception protocols and the registration computer tool. Staff must be trained to use readers that extract only the text from the necessary fields or return to manual visual verification, eliminating the function of archiving the image of the ID. This way, serious sanctions that could spoil the season are avoided.
On the other hand, users should know that they have every right to refuse to have their document photocopied and can request that the data be recorded manually or through strict information reading. Privacy is not on vacation, and the balance between public safety and respect for our rights involves collecting only what is strictly necessary, avoiding unnecessary risks for both parties.
