Tourism Big Brother: Industry Warns of Privacy Risks in Spain’s New Traveler Data Rules

Spain’s new regulations mandating extensive data collection from travelers are raising alarms across the tourism industry, with calls to delay their implementation over privacy concerns.

Royal Decree 933/2021, set to take effect on December 2, 2024, requires travel agencies, accommodations, and car rental firms to report sensitive traveler details to the Ministry of the Interior. This includes over 40 data points for accommodation bookings and more than 60 for car rentals, covering personal information such as phone numbers, payment methods, and family relationships. The decree applies to both EU and non-EU travelers and has sparked significant backlash from the travel industry and privacy advocates.

Dubbed the “Tourism Big Brother”, the regulation aims to enhance security by equipping Spanish law enforcement with comprehensive traveler data. However, travel industry leaders argue the measures violate data protection laws and risk exposing travelers to cyberattacks and data misuse.

The European Travel Agents’ and Tour Operators’ Association (ECTAA) and Spain’s Corporate Association of Specialized Travel Agencies (ACAVE) have expressed deep concerns. Representing over 80,000 European travel agents and 400 Spanish travel agencies respectively, both organizations have petitioned the Spanish government and the Spanish Data Protection Agency to clarify the regulation’s compliance with EU privacy laws. Despite these efforts, they have received no response.

“Travelers will be the main victims of the possible misuse of their sensitive data,” ECTAA and ACAVE representatives warned, noting that no other EU country has adopted similar measures.

Despite strong opposition, including majority votes in Spain’s Parliament and Senate to suspend and revise the decree, the Spanish government has upheld the December 2 implementation date. ECTAA and ACAVE are now urging greater public awareness of the potential impacts of these regulations on privacy and data protection.