New law gathering personal information from travellers in Spain, starting Feb. 2023

[Juanma]

Hi every one. Have you, as a pilgrim checking-in into an albergue/hostel/hotel in Spain ever felt it weird that you were asked to fill in a form with some basic personal information, and/or have been asked to sign on the screen of a mobile device (phone, tablet...) after the Reception staff had scanned your passport or ID with that same device?

This is due to the Spanish law having required, until now, that all travellers staying in any kind of lodging in Spain, have their basic data collected and then, over the night, this information sent to the Police or Guardia Civil.

Right now a new law has been approved, starting February 2023, for which A LOT MORE INFORMATION will have to be collected from the travellers, making the whole process a lot slower for both the hospitalero and the pilgrim, and a lot more intruding into the pilgrim's personal space.

From the traveller's point of view the data that will now have to be collected probably goes against their right to privacy and/or personal data protection rights; and for the albergue staff it means an unacceptable extra time/effort/investment in gathering the whole information, also making the possible other pilgrims waiting to check-in have to wait longer. And by the way, the information gathered must be kept by the establishment for 3 years!

You can read a little more in depth about the topic (in Spanish) in the website that some albergues and hotels have created to manage our complaint: https://sites.google.com/view/pau-plataforma-alojamientos-un/pau.

A campaign has been started to gather signatures to request the cancellation/modification of this new law. You can read about it and, if you feel like it, maybe sign in: https://www.change.org/p/control-de-viajeros-intolerable?signed=true

(Not sure if it will take signatures from non-Spanish or non-European citizens)

For those of you not familiar with Spanish, I'm sure you can translate the content of those pages using google translate or a similar site/app.

Thanks for reading!

 

[J Willhaus]

Hi every one. Have you, as a pilgrim checking-in into an albergue/hostel/hotel in Spain ever felt it weird that you were asked to fill in a form with some basic personal information, and/or have been asked to sign on the screen of a mobile device (phone, tablet...) after the Reception staff had scanned your passport or ID with that same device?

This is due to the Spanish law having required, until now, that all travellers staying in any kind of lodging in Spain, have their basic data collected and then, over the night, this information sent to the Police or Guardia Civil.

Right now a new law has been approved, starting February 2023, for which A LOT MORE INFORMATION will have to be collected from the travellers, making the whole process a lot slower for both the hospitalero and the pilgrim, and a lot more intruding into the pilgrim's personal space.

From the traveller's point of view the data that will now have to be collected probably goes against their right to privacy and/or personal data protection rights; and for the albergue staff it means an unacceptable extra time/effort/investment in gathering the whole information, also making the possible other pilgrims waiting to check-in have to wait longer. And by the way, the information gathered must be kept by the establishment for 3 years!

You can read a little more in depth about the topic (in Spanish) in the website that some albergues and hotels have created to manage our complaint: https://sites.google.com/view/pau-plataforma-alojamientos-un/pau.

A campaign has been started to gather signatures to request the cancellation/modification of this new law. You can read about it and, if you feel like it, maybe sign in: https://www.change.org/p/control-de-viajeros-intolerable?signed=true

(Not sure if it will take signatures from non-Spanish or non-European citizens)

For those of you not familiar with Spanish, I'm sure you can translate the content of those pages using google translate or a similar site/app.

Thanks for reading!

Thank you for posting. As hospitaleros, we probably need to develop a multi lingual document explaining any changes and perhaps a list of the necessary information and sources. I will contact American Pilgrims to make sure this gets in their training for this year as my husband will be on that training team. Hope it can be repealed, but if not we will be prepared.

 

[K_Lynn]

Um...so after clicking though to the Spanish government site, it appears that home address is now required along with passport details. How is that different than what hotels require in other countries? I'm used to having to provide a passport or government issued identification along with contact details when checking into a hotel, how is this different, more burdensome, or cause for alarm?
Link to Spanish government site, traveler data required is about halfway down https://www.boe.es/diario_boe/txt.php?id=BOE-A-2021-17461

 

[Tincatinker]

A Godgle translated extract for anyone who enjoys that sort of thing:

3. Traveler data [to be collected]

a) name.

b) First surname.

c) Second last name.

d) Sex.

e) Identity document number.

f) Support number of the document.

g) Type of document (DNI, passport, TIE).

h) Nationality.

i) Date of birth.

j) Place of habitual residence.

- Full address.

- Location.

- Country.

k) Fixed telephone.

l) Mobile phone.

i) Email.

n) Number of travelers.

o) Relationship of kinship between the travelers (in the event that one is a minor).

I make that around 13 data sets and not much different to what has been collected by varied establishments over many years. Even the sweet sisters in Carrion were diligently copying my passport number into their ledger back in 2012. They didn't ask my sex but I'll assume they were able to make a shrewd guess. They were presumably also able to count me and conclude that there was one of me.

The cynic in me might think that much of the targeting of this regulation, and the consequent fuss, centres around AirBnB providers and their disinclination to visibility. Hoteliers will have scooped most of this from Berking.con and the ilk. I'll concede that it'll be another bit of tedium for the poor sod hospitalera/o who'll have to fill in the database though the cheerful monk at Sobrado tapped us each into his laptop with barely a hesitation in the flow of his chatter.

I also think there's a potential breach of at least two bits of European data protection legislation. Specifically over data retention and storage but as the regulation has been couched as a "National Insecurity" measure data protection is overridden

 

[J Willhaus]

Normally now at donativo albergues in the ledger there is a column for the name, DNI/passport number, nationality (or state of origin if from Spain), and gender. Usually we don't ask for an email, phone number, or address. I know at some albergues that charge a specified amount for services that the hospitalero has to enter data into a computer to upload to the GC, but at donativos they just come by and can inspect the ledger at any time. Also during Covid they could come in and inspect to make sure you were following the Covid guidelines and levy a fine if you were not. I am sure at locations where credit cards are accepted there may be even more data collected associated with that process.

Yes in the US there is more data collected to rent a hotel room, but that is usually all transmitted through my electronic account and all they want to see is my driver's license to verify my identify. I notice that car rental agencies are also included in this law and I would think more data would be collected for a car rental as most people would use a credit card?

 

[Camino Chrissy]

In Italy on the Via Francigena last October every guest house and lodging property we had booked ahead prior and stayed at simply took a photograph of our passports; a big change from pre-covid years when everything was handwritten off the passports.
I don't see additional information as more invasive than other things we do in life, such as applying for a credit card.
OTOH, I don't see why it is now necessary to provide more details for an overnight stay in lodgings in Spain.

 

[Tincatinker]

I did note a reference to “non-professional” providers. Didn’t read it. Presumably someone has. Though my experience of the regulatory process suggests that it’s quite possible no-one with any understanding of the hospitality trade let alone hospitality on Camino ever saw a draft

 

[Juanma]

Um...so after clicking though to the Spanish government site, it appears that home address is now required along with passport details. How is that different than what hotels require in other countries? I'm used to having to provide a passport or government issued identification along with contact details when checking into a hotel, how is this different, more burdensome, or cause for alarm?
Link to Spanish government site, traveler data required is about halfway down https://www.boe.es/diario_boe/txt.php?id=BOE-A-2021-17461

Maybe you haven't quite read all the required information to be collected; I copy and paste:

3. Datos de los viajeros:
a) Nombre.
b) Primer apellido.
c) Segundo apellido.
d) Sexo.
e) Numero de documento de identidad.
f) Número de soporte del documento.
g) Tipo de documento (DNI, pasaporte, TIE).
h) Nacionalidad.
i) Fecha de nacimiento.
j) Lugar de residencia habitual.
– Dirección completa.
– Localidad.
– País.
k) Teléfono fijo.
l) Teléfono móvil.
m) Correo electrónico.
n) Número de viajeros.
o) Relación de parentesco entre los viajeros (en el caso de que alguno sea menor de edad).

4. Datos de la transacción:
a) Datos del contrato.
– Número de referencia.
– Fecha.
– Firmas.
b) Datos de la ejecución del contrato.
– Fecha y hora de entrada.
– Fecha y hora de salida.
c) Datos del inmueble.
– Dirección completa.
– Número de habitaciones.
– Conexión a Internet (si/no).
d) Datos del pago.
– Tipo (efectivo, tarjeta de crédito, plataforma de pago, transferencia...).
– Identificación del medio de pago: tipo de tarjeta y número, IBAN cuenta bancaria, solución de pago por móvil, otros.
– Titular del medio de pago
– Fecha de caducidad de la tarjeta.
– Fecha del pago.

Based on this: in addition to what was already being collected until now, we will from now on also have to add: full address, phone number (home and mobile), email address, number of persons in the group (if such) and relationship among them should anyone be under 18yo, data of the contractual relationship between the establishment and the traveller, time of check-in and check-out, type of payment done and, if electronic, then the details of the card or bank account must be taken and provided to the authorities.

We hospitaleros are no police men, it is not our duty to collect all this information from our pilgrims, and certainly do not have the time to do it. Let alone the fact that some of the information is just impossible to gather, such as the check-out time. It may be not that much of a deal for hotels, where customers may stay for more than one night and where most of them book online or weeks in advance, but for an albergue with 99.9999% of people staying only for one night and many of them just showing up at the door with no previous booking whatsoever, and especially in the highest of the peak season, it means a lot of additional time to be invested per pilgrim, on the expense of a longer waiting time for the next, tired pilgrims waiting behind, and for our other duties of the every day in the albergue.

 

[Flatlander]

Have you, as a pilgrim checking-in into an albergue/hostel/hotel in Spain ever felt it weird that you were asked to fill in a form with some basic personal information,

No.
Such information is common in many different countries

A LOT MORE INFORMATION will have to be collected from the travellers

If you want to drum up some support it would be helpful to list just what that extra information is rather than just using bigger, bold letters. It seems what's new is a home address and the travellers' relationship if a minor is involved? A home address is a PITA but I can understand fully wanting to identify child/adult relationships.

From the traveller's point of view the data that will now have to be collected probably goes against their right to privacy and/or personal data protection rights

Again, if you'd like support it would be helpful to point out how my privacy is being violated.

If this is in violation of EU GDPR laws it should be a relatively simple matter for the organisations that represent those affected to lodge a complaint in the EU courts?

the information gathered must be kept by the establishment for 3 years!

Now that is interesting!

Following your link to the organisation of small businesses (not a terribly clear site) I pulled this from an article.....

Además, se exigen datos financieros como tipo de pago (efectivo, tarjeta de crédito, plataforma de pago, transferencia...), tipo de tarjeta y número, IBAN cuenta bancaria, solución de pago por móvil, titular del medio de pago, fecha de caducidad de la tarjeta y fecha del pago. Se incrementa también en el epígrafe de datos del contrato el número de referencia, fecha y firmas.

And that is worrying. It seems to be suggesting that my IBAN (bank account number) will be stored (along with all my other information) for three years at every place I stay in? That does sound draconian and more than a little risky.

My understanding is that when I pay with a card currently the business is simply facilitating a transaction between my bank and theirs - they have no real useful information with which to carry out fraud. (Unless anyone is using the old "slide and paper" readers.) Now my name, address, IBAN, card number, date of expiry will all be held by the business?

(Side note. How does that work for non Europeans?)

If that is correct then that message is what you should be bellowing from all the rooftops you can find.
Not only is the customer at far greater risk of fraud but any business is at risk of data theft, physical or online.

However, I am not Spanish and have no right to lecture anyone in Spain on their laws, nor to induce them to change them.
I can mitigate the most harmful effects of this expanded law by simply paying cash for accommodation.
It seems to me that the big hospitality players and the banks should be the ones pointing out the flaws in this plan. And the EU.

By the way, the information is remitted to the Police daily and they do act upon it. I met a poor Dutchman over the summer who was about to be raided for the fourth time by the Police because he happened to share the same name and approximate age as a wanted Belgian criminal!

 

[K_Lynn]

Yes I read that and as I said it is no more onerous than required in other hotels. The only key difference I see between prior data collection and now is a home address, a phone number, and an email address.
Everywhere I stayed in 2021 copied my passport and requested a phone number.

I'm sorry you feel this will make your life more difficult.

 

[Molly Cassidy]

Yes, I've been asked for all of this information when staying in various types of accommodation.

 

[dick bird]

What Juanma is saying is absolutely correct, this will make the registering process a lot more time-consuming and onerous. Previously, the hospi could copy the relevant info from the ID document (or page 1 of the credencial) into an A4 ledger book whilst chatting to the new arrival. Now we need to record full contact details (unverifiable) as well: home postal address, email and phone numbers for every pilgrim. This will take long enough when hospi and pilgrim speak the same language, let alone when there is a language barrier - if you don't believe me, try dictating that information to a friend and timing it.

For the hospi, I can only suggest we ask incoming pilgrims to write this information themselves on a separate piece of paper while we write down the other details in the old way. We can keep the pieces of paper in a special box and leave the authorities to sort them out if they want. Some establishments may start producing forms for incomers to fill in.

As for the financial details, the law only requires details of the method actually used to pay (e.g. card number), information which hotels would have anyway.

Incidentally, in no albergue I have worked in have the police ever asked to see this information, though they probably do a visual check once a year or so and we certainly did not have to supply the information daily to the police. I suspect they only need to look when they are trying to trace a missing or wanted person.

 

[J Willhaus]

I have been at an albergue when the GC came by to check the register. Also another hospitalero told my husband that at Gaucelmo in Rabanal she had to load data into the computer each day and upload to the police. I don't think pilgrims quite realize the additional burden this may create as they also don't think about who might be watching their shipped bags, how the toilet paper gets into the bathroom, how the food for breakfast or supper gets into the albergue, how the bathroom gets cleaned daily, etc. There are a lot of things that as a pilgrim, you don't really think about unless you are a hospitalero. As a pilgrim you are just grateful for these things without considering how they happen.

 

[Flatlander]

For the hospi, I can only suggest we ask incoming pilgrims to write this information themselves on a separate piece of paper while we write down the other details in the old way.

That's standard procedure in some campsites that I have stayed at in Spain. I imagine it will become more common.

As for the financial details, the law only requires details of the method actually used to pay (e.g. card number), information which hotels would have anyway.

If that's all it is then there should be no problem but......

d) Datos del pago.

– Tipo (efectivo, tarjeta de crédito, plataforma de pago, transferencia...).

– Identificación del medio de pago: tipo de tarjeta y número, IBAN cuenta bancaria, solución de pago por móvil, otros.

– Titular del medio de pago

– Fecha de caducidad de la tarjeta.

– Fecha del pago.

Is taken from the link to the actual legislation.
That is far too much information to be seeking and to be storing.

 

[Pilgrim9]

Life is full of challenges, or growth opportunities, depending upon one's attitude.

It would be great if all of the invariant data items could be stored by the pilgrim (with the assistance of a retail IT service provider) into a hospitality-industry-standard QR code* which could then be scanned-in by the receptionist at all of the lodging places.

For lodging places without computers, pre-populating all of the data items on a hospitality-industry-standard paper form*, making lots of photocopies of the form, carrying them around, and handing a dated and signed photocopy to the receptionist could help speed up the check-in process. I did that in India to facilitate the purchase of train tickets, which is a similarly tedious and data-collection-intensive process.

* My guess is that some notional Spanish national association of lodging places will take the lead on this.

Edit: Alternatively one could carry around a set of approximately 37 self-inking rubber stamps, one rubber stamp per personal data item - and an attache case to carry them ;-).

 

[JabbaPapa]

Full address.

Fixed telephone.

Mobile phone.

Email.

These are particularly intrusive.

A private business requesting such information for private purposes is one thing, but the State demanding them and clearly attaching them to a Digital ID is another.

Last time that Spain instated new rules for hotel stays, the Camino was harmed, and IIRC some Albergues were forced to close because of them.

I don't think this would have immediate effects in the same way, but if at some point it involves travel restrictions upon certain people, it could harm pilgrims and Albergues quite significantly.

 

[dbier]

Hm. The storage worries me, as I strongly suspect that most private establishments do not have sufficiently strong cybersecurity to protect my info for 3 years...nor the ability to truly wipe the data afterwards.

Also...I don't have a fixed phone number. More and more people these days don't. Therein lies a bit of a quandary...

 

[nycwalking]

What Juanma is saying is absolutely correct, this will make the registering process a lot more time-consuming and onerous. Previously, the hospi could copy the relevant info from the ID document (or page 1 of the credencial) into an A4 ledger book whilst chatting to the new arrival. Now we need to record full contact details (unverifiable) as well: home postal address, email and phone numbers for every pilgrim. This will take long enough when hospi and pilgrim speak the same language, let alone when there is a language barrier - if you don't believe me, try dictating that information to a friend and timing it.

For the hospi, I can only suggest we ask incoming pilgrims to write this information themselves on a separate piece of paper while we write down the other details in the old way. We can keep the pieces of paper in a special box and leave the authorities to sort them out if they want. Some establishments may start producing forms for incomers to fill in.

As for the financial details, the law only requires details of the method actually used to pay (e.g. card number), information which hotels would have anyway.

Incidentally, in no albergue I have worked in have the police ever asked to see this information, though they probably do a visual check once a year or so and we certainly did not have to supply the information daily to the police. I suspect they only need to look when they are trying to trace a missing or wanted person.

I have twice volunteered as a hospi: 2002 and 2004.

Not once did police ask to see ledger.

If I were volunteering now, I would have question and answer forms in several languages for pilgrims to complete.

That would quicken check-in time and help with possible language barriers.

 

[RJM]

Not sure what the purpose of that would be?
A legitimate, legal passport/government ID gives all that is needed. The addresses, emails and telephone numbers are pointless and easily lied about with no way of verifying. Especially with foreigners. My guess is some out of touch government bureaucrat came up with that idea.

 

[dick bird]

I have twice volunteered as a hospi: 2002 and 2004.

Not once did police ask to see ledger.

If I were volunteering now, I would have question and answer forms in several languages for pilgrims to complete.

That would quicken check-in time and help with possible language barriers.

Pre-printed forms are probably the way to go. Pilgrims could fill them in as they wait if there is a queue to register. How the local authorities would deal with stacks of unsorted forms is not our problem.

 

[Kanga]

I shall put all that information onto the front page of my credential. A quick mobile phone photograph would then surely be sufficient for record keeping purposes.

I frequently scan stuff using my mobile phone camera.

 

[trecile]

Pre-printed forms are probably the way to go. Pilgrims could fill them in as they wait if there is a queue to register. How the local authorities would deal with stacks of unsorted forms is not our problem.

Or, I suppose that the hospitaleros could copy that information into a book after the pilgrims have registered.

 

[jjev]

We have exactly the same system, but not every hotel follows the guidelines.
It is possible to leave half of the fields blank during checkin, however receptionist may insist that you fill in every field.
Usually nobody cares.
Some hotels are getting fined because of that. Believe me, its not their choice.

pure bureaucracy.

 

[Marbe2]

After 9-11 in the USA (at the time living two miles from the epicenter) security changed almost instantly. We could no longer go to a hospital or hotel without showing our drivers license. Our Traffic patterns on bridges changed causing massive delays. And as you all know flying security changed forever. Every new transaction involving travel seemed to have new layers of security. We all adjusted for safety’s sake.

Recently letter bombs may have been mailed in Spain by suspected terrorists.

https://www.nytimes.com/2023/01/22/us/politics/russia-spain-letter-bombs.html

I am not saying this recent act is the reason why more information is being requested. But given the current situation and bad actors there does appear to be is a war going on in eastern europe … So can we take a moment to consider why Spain might want to know more about who is on the move.

In addition, I tend to stay at the same hotels/ albergues along the camino. Where I stay, they have data going back a number of years. If your worried about your credit card data, which I do understand, get a new card when you return home.

 

[Kathor1]

I am not saying this recent act is the reason why more information is being requested

Indeed, this incident described in a recent New Times article is not the reason for Royal Decret 933/2021. Note the year in the title: the law was published on October 2021; the obligation to communicate data of guests in hotels and similar to the authorities is in effect since 2 January 2023 - see quote below. It is just that we here on the forum hear about it only now.

The text does, however, give two reasons: At present, the most serious attacks on public security are being carried out by both terrorist activity and organised crime, both of which have a markedly transnational character.

El presente real decreto entrará en vigor a los seis meses de su publicación en el «Boletín Oficial del Estado». No obstante, las previsiones relativas a las obligaciones de comunicación producirán efectos a partir del 2 de enero de 2023.

Dado en Madrid, el 26 de octubre de 2021.

 

[Juanma]

No.
Such information is common in many different countries

My understanding is that when I pay with a card currently the business is simply facilitating a transaction between my bank and theirs - they have no real useful information with which to carry out fraud. (Unless anyone is using the old "slide and paper" readers.) Now my name, address, IBAN, card number, date of expiry will all be held by the business?

By the way, the information is remitted to the Police daily and they do act upon it. I met a poor Dutchman over the summer who was about to be raided for the fourth time by the Police because he happened to share the same name and approximate age as a wanted Belgian criminal!

I started my message asking if you found it weird that blablabla because, as a hospi, I get shocked pilgrims every day asking why we collect all this info, and why in some other places they had stayed at it hadn't been done and here I was asking for it. It certainly must be done in every place a traveller stays for a night but I guess not all albergues take it as seriously, and thus the shock and the not understanding of the situation for some pilgrims...

About the payment with card: if a pilgrim wants to pay with card in my albergue, I do not get to keep the card's details: I simply charge from the card with my device and that's it. I never get hold of any of the card's info such as its number, holder's name or expiry date. Now with this new regulation, I will have to collect those details!

And yes, every one can be sure that the info is sent to the police (or Guardia Civil) every day, usually over night. Until a few years ago it was a bit more tedious to do all this paperwork (it was done mannually) and then it could take some days until the hospi could take all the papers to a police station personally or fax them over; but since a few years ago we have apps that can be installed on a mobile device and they just scan the info from an ID or passport through the device's camera, and then the pilgrim just has to sign on the screen; then the app sends the data overnight.

Yes I read that and as I said it is no more onerous than required in other hotels. The only key difference I see between prior data collection and now is a home address, a phone number, and an email address.
Everywhere I stayed in 2021 copied my passport and requested a phone number.

I'm sorry you feel this will make your life more difficult.

It is more than just the home address, phone number and email address: it's also the credit card's info, the composition of a group and the relationship between them if there are people under 18yo, the check-in and check-out times...

If you were asked for a phone number when checkin-in into an albergue in 2021, I honestly do not know why that might have been (commercial collection of personal data?); we have never requested such info from any pilgrim in my albergue, and it is not necessary at all (fromt he point of view of the data collecting regulation that was on in 2021).

For the hospi, I can only suggest we ask incoming pilgrims to write this information themselves on a separate piece of paper while we write down the other details in the old way. We can keep the pieces of paper in a special box and leave the authorities to sort them out if they want. Some establishments may start producing forms for incomers to fill in.

As for the financial details, the law only requires details of the method actually used to pay (e.g. card number), information which hotels would have anyway.

Handing papers to the pilgrims to fill in may be a solution to make the process faster, but it doesn't solve the problem completely: we (as hospis) have no way of knowing if the info they write there is correct or not; as I said, we are no police men and that is not our duty to do.

No, the law requires not only to collect the card's number, but also the name of the holder and the expiry date. If the payment has been done through bank transfer, then the bank account's IBAN. We (hotels, albergues...) do not always have that information, and now we would have to collect it.

Hm. The storage worries me, as I strongly suspect that most private establishments do not have sufficiently strong cybersecurity to protect my info for 3 years...nor the ability to truly wipe the data afterwards.

Also...I don't have a fixed phone number. More and more people these days don't. Therein lies a bit of a quandary...

Speaking for my own albergue, we do have the cybersecurity to keep that info secure. It's no big deal these days and most hosting providers offer security solutions as well, not expensive at all. Then, should there be a leak for whatever reason, we have insurance that would cover what ever harm may have been produced.

About the fixed phone number, I guess it would not be such a big deal to leave that field blank, or just write again the mobile phone number. As you say, a lot of people today don't have a fixed phone.

Not once did police ask to see ledger.

As I said before, nowadays the info is sent automatically by the app over night; until some years ago you had to send it yourself through fax or email, or take the paper forms personally to your relevant police / GC headquarters; in some cases hospis took long to do this and then the authorities could come and ask to see the documents and give you a warning to do your duty daily; should you continue not to do it punctually, then could fine you.

 

[Flatlander]

@Juanma
I think you will find that you receive more support if you focus on the impact for the traveller and not yourself. This is a forum for all things Camino related - very few members are in your shoes, but many, many are in walking shoes going place to place.

As an example, dismissing the situation where the security is breached because you have insurance to cover that does not inspire me - who is potentially defrauded, without the use of banking and facing into stress and expense to get back in control - with a warm and fuzzy feeling.

From my inexpert position I cannot see how this law is compatible with EU data storage and processing laws.

 

[Juanma]

@Juanma
I think you will find that you receive more support if you focus on the impact for the traveller and not yourself. This is a forum for all things Camino related - very few members are in your shoes, but many, many are in walking shoes going place to place.

As an example, dismissing the situation where the security is breached because you have insurance to cover that does not inspire me - who is potentially defrauded, without the use of banking and facing into stress and expense to get back in control - with a warm and fuzzy feeling.

From my inexpert position I cannot see how this law is compatible with EU data storage and processing laws.

You are right probably. But I am not asking for support here; just informing pilgrims about the changes that are about to come into the Camino this year, and maybe just exercising my "right to kick" if that's how you say it in English...

And yes, many of us think that this law goes against the EU laws, and it's one of the reasons for which we are fighting it.

 

[Kathor1]

Thank you so much for your recent post with lots of explanations and information, @Juanma.

I was going to respond to one of @Flatlander's post to say that I share and agree to much of what he wrote earlier when in the meantime I saw your post which contains information and answers for some of the questions I had in this context.

Suffice it to say for the time being that I am quite concerned about the private data protection issues in this context and I, too, am questioning the need for collecting and pulling together and storing such a range of personal data in one place - or even more than one place, namely in government databases as well as in hotels and albergues. And I don't know what worries me more: the government storage or the hotel / albergue storage.

I understand of course that the extra work and extra time that this requires and creates for owners is also an issue.

 

[wayfarer]

It is what it is, it's all down then to whether you want to travel to Spain or not give private information.

 

[MikeJS]

I will just continue to give the wrong info as I have always done. No way will I ever tell a stranger where Iive when I am clearly away from home.

 

[Kathor1]

I started my message asking if you found it weird that blablabla because, as a hospi, I get shocked pilgrims every day asking why we collect all this info, and why in some other places they had stayed at it hadn't been done and here I was asking for it. It certainly must be done in every place a traveller stays for a night

Since you asked, and just as personal / general information:

I would not, and did not, bat an eyelid when asked at reception in a hotel or albergue in Spain to show my passport or national ID card, and when I see that the data in my ID document are checked against data in their computer or entered into it.

I'm used to this from travelling in a number of EU countries and (earlier) in the UK. I even remember that decades ago I had to scribble address, date of birth, nationality, name etc on a paper form when checking into a UK hotel (as a non-British citizen).

Along the Frances I stayed only in private albergues, casa rurales, pensiones and hotels but not in municipal, parochial or donativo albergues. So I don't know what the habits of this last category are and whether they are subject to exactly the same regulations as others. I note that posters report in this thread that, when they were hospitaleros, the Guardia Civil came to check the albergue's paper records of the pilgrims who stayed there which surprises me a little because, as you say and as I read online, places where travellers stay in Spain must submit such records within 24 hours to police.

I take note of the fact that you use an app on your mobile phone camera to read data from ID cards that are then transmitted to a computer. I was a bit amused when I read about the paper-based systems that are being developed or suggested in this thread . Scanning apps can read the text of passports and ID cards, there are also inexpensive card readers for this purpose - I was given one free of charge by the town administration when I obtained my most recent ID card - and some EU ID cards (not all) even contain the holder's address, certainly the German one does, and I think the French and Spanish ones, too. Is this correct for Spanish DNI cards, do they contain the address?

As to compliance with EU law about data protection which is of course also the law in Spain: The regular way to use would be starting a court case at a Spanish court who could, if they are uncertain about interpretation, submit the case for a decision to the European Court in Luxembourg. This is usually a long drawn out process that can take years. So it is a very good idea to raise awareness now and to lobby for change by bringing this issue to a wider public attention including the European Commission, as has already been attempted by a Spanish association and as I've read in recent news. I hope this will put pressure on the Spanish government to voluntarily change these new regulations.

Good luck and success!

 

[J Willhaus]

I have never worked at an albergue where there was a computer and some did not even have a telephone so paper/pen or pencil is the only option to record data in some locations. These are simple locations that don't take reservations so no need for additional technology. Certainly private albergues, hotels, or some large facilities like Roncesvalles which are not donativo and take reservations may have the capacity to integrate the additional data collection more easily.

 

[Kathor1]

I have never worked at an albergue where there was a computer and some did not even have a telephone so paper/pen or pencil is the only option to record data in some locations. These are simple locations that don't take reservations so no need for additional technology.

Well ... Would you know whether they don't have to submit their records to the national police / Guardia Civil because they don't have a computer or do they not have a computer because they don't want one and don't need one and benefit from some kind of exemption and merely have to keep written records at the albergue?

 

[LTfit]

I shall put all that information onto the front page of my credential. A quick mobile phone photograph would then surely be sufficient for record keeping purposes.

I frequently scan stuff using my mobile phone camera.

Juanma also mentions bank account information or credit card details. I personally wouldn't want that information on my credential nor give it to someone at an albergue who has to keep the info on file for three years. Guaranteed it's not under lock and key.

 

[Brian&Deb J.]

Hi every one. Have you, as a pilgrim checking-in into an albergue/hostel/hotel in Spain ever felt it weird that you were asked to fill in a form with some basic personal information, and/or have been asked to sign on the screen of a mobile device (phone, tablet...) after the Reception staff had scanned your passport or ID with that same device?

This is due to the Spanish law having required, until now, that all travellers staying in any kind of lodging in Spain, have their basic data collected and then, over the night, this information sent to the Police or Guardia Civil.

Right now a new law has been approved, starting February 2023, for which A LOT MORE INFORMATION will have to be collected from the travellers, making the whole process a lot slower for both the hospitalero and the pilgrim, and a lot more intruding into the pilgrim's personal space.

From the traveller's point of view the data that will now have to be collected probably goes against their right to privacy and/or personal data protection rights; and for the albergue staff it means an unacceptable extra time/effort/investment in gathering the whole information, also making the possible other pilgrims waiting to check-in have to wait longer. And by the way, the information gathered must be kept by the establishment for 3 years!

You can read a little more in depth about the topic (in Spanish) in the website that some albergues and hotels have created to manage our complaint: https://sites.google.com/view/pau-plataforma-alojamientos-un/pau.

A campaign has been started to gather signatures to request the cancellation/modification of this new law. You can read about it and, if you feel like it, maybe sign in: https://www.change.org/p/control-de-viajeros-intolerable?signed=true

(Not sure if it will take signatures from non-Spanish or non-European citizens)

For those of you not familiar with Spanish, I'm sure you can translate the content of those pages using google translate or a similar site/app.

Thanks for reading!

I've had a look and not impressed however it is what it is. I don't believe any number of signatures from foreign peregrinos would sway the Spanish government. My Camino reinforced the 'let it go' attitude that keeps my life simpler and happier. I'm walking again this year and these new rules won't impact my pleasure. Just my own outlook. Buen Camino

 

[wayfarer]

I will just continue to give the wrong info as I have always done. No way will I ever tell a stranger where Iive when I am clearly away from home.

No good Mike, we know where you live.

 

[drowdie]

Hi every one. Have you, as a pilgrim checking-in into an albergue/hostel/hotel in Spain ever felt it weird that you were asked to fill in a form with some basic personal information, and/or have been asked to sign on the screen of a mobile device (phone, tablet...) after the Reception staff had scanned your passport or ID with that same device?

This is due to the Spanish law having required, until now, that all travellers staying in any kind of lodging in Spain, have their basic data collected and then, over the night, this information sent to the Police or Guardia Civil.

Right now a new law has been approved, starting February 2023, for which A LOT MORE INFORMATION will have to be collected from the travellers, making the whole process a lot slower for both the hospitalero and the pilgrim, and a lot more intruding into the pilgrim's personal space.

From the traveller's point of view the data that will now have to be collected probably goes against their right to privacy and/or personal data protection rights; and for the albergue staff it means an unacceptable extra time/effort/investment in gathering the whole information, also making the possible other pilgrims waiting to check-in have to wait longer. And by the way, the information gathered must be kept by the establishment for 3 years!

You can read a little more in depth about the topic (in Spanish) in the website that some albergues and hotels have created to manage our complaint: https://sites.google.com/view/pau-plataforma-alojamientos-un/pau.

A campaign has been started to gather signatures to request the cancellation/modification of this new law. You can read about it and, if you feel like it, maybe sign in: https://www.change.org/p/control-de-viajeros-intolerable?signed=true

(Not sure if it will take signatures from non-Spanish or non-European citizens)

For those of you not familiar with Spanish, I'm sure you can translate the content of those pages using google translate or a similar site/app.

Thanks for reading!

 

[Steven Dwyer]

The data collection of credit card information is a problem for me. but if I am staying in a donativo or small albergue I would be paying cash so it’s not a problem in those places. where it becomes a problem is where I need to provide credit card information in order to make the reservation.

Last year I took a non-Camino trip to Europe and for a change had reserved all 37 of my hotels months in advance. I was quite pleased with myself when I got the last reservation booked and went to bed happy. In the morning I woke up to find that overnight my credit card number had been hacked and was being used in Europe, obviously one of the hotels had been compromised. I had to cancel all 37 reservations and rebook them.

On the second go round making the reservations, I used Hotels.com and had them charge my credit card immediately for payment which ensured that the hotels would not have my credit card information. Having anyone record the details of my credit card is a big red-flag for me, but in this instance is easily avoided.

 

[Delphinoula]

If in doubt pay cash.
Your data is out there already.

My Government ID has my home address. My home phone number… good luck to call me there when I am in Spain.
We have a central register, the police can access it if nesessary.

Thank you for letting us know the new requirements.
In the States the patriot act does it thing, in the UK cc TV everywhere, in France you can be retained by the police for almost a week before you see an judge. In Spain a judge leeds the criminal investigation, in Italy and Germany the police is college educated. So differences everywhere.

 

[Former member 92300]

j) Place of habitual residence.

- Full address.

k) Fixed telephone.

i) Email.

o) Relationship of kinship between the travelers (in the event that one is a minor).

Thanks! I was wondering and didn't have time to translate. For the most part - it is pretty basic information. I think the above would be the "annoying" questions for me. And really not for the reasons you might think.

Address - well if I am writing it myself it isn't problematic, but telling someone my address would be. Even in the US people struggle with how confusing my address is haha.
Fixed phone - well - hopefully they either let you skip that or write the mobile number for both - as fixed phones are less and less common (at least - in the US)
email - again - if I am writing it - no problem. Verbally relaying - problem.

The only "what the heck" question for me is "relationship of the travelers - is that ONLY when one is a minor? OK, I get that. But if it is in other circumstances, that is no ones business!

Anyhow - this could be tedious - but the quick fix is to just give a paper to the traveler to fill out and hand back in. Hosts could start the process by handing out the paper to people who walk through the door - and once complete - then register the person and send them to their room. Maybe brining a rubber stamp with all of this information would save me some time haha. Or maybe the can create a credential that has us list all this information so the hosts could simply snap a photo and move along. After all - how many hosts snapped photos of our passports?

But don't get me started about data collection in general - I hate that people all over the world are recording my information and photos of my photo identification. But I digress......

 

[J Willhaus]

Well ... Would you know whether they don't have to submit their records to the national police / Guardia Civil because they don't have a computer or do they not have a computer because they don't want one and don't need one and benefit from some kind of exemption and merely have to keep written records at the albergue?

I don't have official knowledge of the law, but perhaps @Rebekah Scott will reply as she organizes volunteers for FICS, one of the organizations that operates some of the albergues that are not private. My husband said that when he worked in 2021 during COVID he also had to collect phone and email information for possible contact tracing, but we did not have to do that last summer and did not do it before COVID. I do know there was a computer in the office at Zamora when we were there in 2017, but it was broken and looked to be quite old with a CRT monitor.

 

[David Tallan]

What Juanma is saying is absolutely correct, this will make the registering process a lot more time-consuming and onerous. Previously, the hospi could copy the relevant info from the ID document (or page 1 of the credencial) into an A4 ledger book whilst chatting to the new arrival. Now we need to record full contact details (unverifiable) as well: home postal address, email and phone numbers for every pilgrim. This will take long enough when hospi and pilgrim speak the same language, let alone when there is a language barrier - if you don't believe me, try dictating that information to a friend and timing it.

For the hospi, I can only suggest we ask incoming pilgrims to write this information themselves on a separate piece of paper while we write down the other details in the old way. We can keep the pieces of paper in a special box and leave the authorities to sort them out if they want. Some establishments may start producing forms for incomers to fill in.

As for the financial details, the law only requires details of the method actually used to pay (e.g. card number), information which hotels would have anyway.

Incidentally, in no albergue I have worked in have the police ever asked to see this information, though they probably do a visual check once a year or so and we certainly did not have to supply the information daily to the police. I suspect they only need to look when they are trying to trace a missing or wanted person.

You'll also want to provide a check out ledger for pilgrims to fill out, if check in and check out times are required, as indicated. I'm not sure how feasible it will be to enforce the recording of check out times in such a ledger.

 

[vernakeoho]

My thoughts parallel with several of you. I will note this information in English and Spanish on the front of my credenciale and also carry a piece of paper with the printed details to offer if that will save time checking in. Communication on these types of subjects is good for everyone.

 

[David Tallan]

@Juanma
I think you will find that you receive more support if you focus on the impact for the traveller and not yourself. This is a forum for all things Camino related - very few members are in your shoes, but many, many are in walking shoes going place to place.

That's true, but things affecting albergues and hospitaleros/as are very definitely Camino-related. A number of the forum members have served or regularly serve as hospitaleros/as, and many that don't are grateful to those who volunteer in this capacity and are quite ready to support things that would make things easier, or at least, prevent increasing difficulties for them.

 

[Vacajoe]

You are all welcome to use my home address on these forms:
123 Main St
Anytown, OH 98765
(800) 888-8888

Pretty sure no one in Spain is going to stop by that address to verify you live there. As for me, it’s been my residence for 30 years of traveling and having to fill out inane forms.

 

[Kathor1]

As to taking photographs of passports and ID cards which volunteer hospitaleros would apparently be happy to do ... I don't know the actual data protection situation in Spain but I know that a hotel in Mallorca was fined €30.000 last year because they recorded and kept a guest's passport photo and then used it for a digital file during the guest's stay at the hotel: the staff used the guest's photo that was displayed on their tablets for identification purposes whenever the guest ordered something in the bar or restaurant and similar purposes. The guest, a national of another EU country, introduced a reclamation with the Data Protection Agency of his own country who transmitted it to the Spanish Data Protection Agency which led to the fine.

I know that at least in Germany hotels are not allowed to make a photocopy or take a photo of a passport page of a guest without his or her knowledge and explicit permission.

This is different from using a scanning app that reads the legally required data for registration purposes.

If some staff or volunteer would want to take a photo of my passport or ID card, perhaps even with their own private mobile phone, "to save time now and make things easier and to enter the data into the obligatory guest register at a later time" and if I were in the mood, I would question their competence and refuse to let them do so. And I am not joking.

 

[Marbe2]

I have had hotels in the past year, request this information over the internet indcatingthat it willmake check in faster. I don’t send it, however, I wait till I register in person.

 

[Camino Chrissy]

Last October in Italy on the Via Francigena, every guesthouse property we stayed at (pre-booked through booking.com) took a snapshot of our passports with a cell phone. I thought it was a great idea as it saved them so much time.
I had no idea that I should be potentially wary of the method they were using to check us in.

 

[Texas Walker]

Scammers are going to have a ball.

 

[Molly Cassidy]

Address - well if I am writing it myself it isn't problematic, but telling someone my address would be. Even in the US people struggle with how confusing my address is haha.
Fixed phone - well - hopefully they either let you skip that or write the mobile number for both - as fixed phones are less and less common (at least - in the US)
email - again - if I am writing it - no problem. Verbally relaying - problem.

It really doesn't matter what address you use, they won't check. Loads of people including me don't have a landline, so can't imagine that would be an issue.
Email, again, they're not going to check.

 

[henrythedog]

I carry a long-expired photo card driving licence with a long-ago address as ‘ID’ if I think there’s any possibility of it not being returned to me immediately. It’s a useful deposit for audio guides in museums and so-on.

I’ve long given the information cited above when booking or checking into hotels (although not always correctly) and really see no particular need for the clients to be unduly concerned. I do appreciate that it might require more record-keeping from hospitaleros.

 

[SabsP]

If some staff or volunteer would want to take a photo of my passport or ID card, perhaps even with their own private mobile phone, "to save time now and make things easier and to enter the data into the obligatory guest register at a later time" and if I were in the mood, I would question their competence and refuse to let them do so. And I am not joking.

And absolutely right that you are not joking!
No way that anyone can make a pic of my ID with a cellphone.
They can write it down or nada.
If they keep insisting then I will find another place.
I am one of the people at work responsible for GDPR and it always surprises me how naive people can be in current society about their info and privacy.

 

[Molly Cassidy]

And absolutely right that you are not joking!
No way that anyone can make a pic of my ID with a cellphone.
They can write it down or nada.
If they keep insisting then I will find another place.
I am one of the people at work responsible for GDPR and it always surprises me how naive people can be in current society about their info and privacy.

Lots of places take a photocopy. It seems to be standard practice in many countries.

 

[tpmchugh]

Am I missing something. I haven't walked since 2018 but I dont recall ever having to do anything other than show my passport and get my credencial stamped. Only place I had a problem was in Bibao where they did not initially accept my passport card as a passport. Because my fellow Irish people in front had a passport book, the girl could not get her head around me being different. Not doubting the changes but doubting the implementation of past protocols

 

[Kathor1]

Lots of places take a photocopy. It seems to be standard practice in many countries.

Frankly, I don't care in the context of this thread what may or may be standard practice in many countries. If it is not allowed under the laws of an EU country - we are talking GDPR and assorted national law here - to make a photocopy or take a photo of my ID card or passport then it's not allowed and I won't agree to it. As I said, I am not sure about Spain. I am certain about Germany. I checked France and tried to find reliable websites. It appears that it is not allowed according to CNIL:

Question: Un hôtelier peut-il faire une copie de ma pièce d'identité ?​

Answer: Non.​

​

I also feel that volunteer hospitaleros should not go by what they read on social media but ought to be properly informed about their duties by those who are the proprietors of their albergue which, as far as I understand it, are parishes and municipalities in Spain.

 

[Molly Cassidy]

Frankly, I don't care in the context of this thread what may or may be standard practice in many countries. If it is not allowed under the laws of an EU country - we are talking GDPR and assorted national law here - to make a photocopy or take a photo of my ID card or passport then it's not allowed and I won't agree to it. As I said, I am not sure about Spain. I am certain about Germany. I checked France and tried to find reliable websites. It appears that it is not allowed according to CNIL:

Question: Un hôtelier peut-il faire une copie de ma pièce d'identité ?​

Answer: Non.​

​

I also feel that volunteer hospitaleros should not go by what they read on social media but ought to be properly informed about their duties by those who are the proprietors of their albergue which, as far as I understand it, are parishes and municipalities in Spain.

In Spain almost every hotel does it. It's also happened to me in Bulgaria.

In Greece they take the details of your documents but don't usually copy them.
In France I don't think I've even been asked for my documents.

 

[Richard Smith]

k) Fixed telephone.

Mine hasn't worked for years, just mobile now.

 

[dick bird]

I also feel that volunteer hospitaleros should not go by what they read on social media but ought to be properly informed about their duties by those who are the proprietors of their albergue which, as far as I understand it, are parishes and municipalities in Spain.

They certainly ought, unfortunately they very often are not. One reason the issue has been flagged on the forum is so that future hospis are forewarned. It remains to be seen what actual impact the change will have. I suspect we will know in the next few weeks. Mainly it will affect albergues and hotels rather than pilgrims, though having said that, quite a few members of the forum work as hospis. But at least we now know about the change.

 

[Kathor1]

I think it is worth pointing out that it is not even super clear whether those albergues that typically make use of volunteer hospitaleros are even affected or only those pilgrim albergues that are registered as albergues turisticos. The ministry of the interior who are the boss of the police forces mentions commercial establishments and analogos but what’s analog in this context (see below).

I would certainly wait before I’d rush to design multilingual information leaflets and print registration forms for pilgrims. A silver lining is the fact that volunteer albergues don’t take credit cards so their hospitaleros will be kept away from manually copying and storing my credit card details for three years … I must say that, for the first time, I am considering getting a separate credit card for travelling to Spain that I terminate after my return home …

En todo caso, se incluyen las siguientes actividades:
Las llevadas a cabo por establecimientos comerciales abiertos al público integrados en este sector conforme a la normativa dictada por la administración competente. Se incluyen dentro de este concepto los hoteles, hostales, pensiones, casas de huéspedes, establecimientos de turismo rural o análogos.

 

[LTfit]

This is all conjecture

I think it is worth pointing out that it is not even super clear whether those albergues that typically make use of volunteer hospitaleros are even affected or only those pilgrim albergues that are registered as albergues turisticos. The ministry of the interior who are the boss of the police forces mentions commercial establishments and analogos but what’s analog in this context (see below).

I would certainly wait before I’d rush to design multilingual information leaflets and print registration forms for pilgrims. A silver lining is the fact that volunteer albergues don’t take credit cards so their hospitaleros will be kept away from manually copying and storing my credit card details for three years … I must say that, for the first time, I am considering getting a separate credit card for travelling to Spain that I terminate after my return home …

This is exactly what I was about to post. Rules and regulations for donativos (virtually none) are not the same as for albergue turisticos, I know first-hand as I had one during the Corona period and have volunteered many times in donativos.

Albergue turisticos are strictly regulated and controlled. Government officials visit these establishments 1 or 2x a year to check a number of things (won't go into here).

Volunteers will be informed by HOSVOL or FICS if requirements change. I wouldn't jump to any conclusions.

 

[Molly Cassidy]

I must say that, for the first time, I am considering getting a separate credit card for travelling to Spain that I terminate after my return home …

Of course the way to avoid your credit card details being stored is simply to pay cash everywhere.

 

[Kathor1]

Of course the way to avoid your credit card details being stored is simply to pay cash everywhere.

It’s not about storage of details as such in this thread. It’s about the (potential / presumed) collecting and storing of so many personal details in the same place, namely in the same database on an IT system and, in particular and possibly, in a book that is lying around and accessible to many different people from many different places and backgrounds over the course of 3 years in some of the Camino albergues.

As pointed out in post #26 about what is changing:

About the payment with card: if a pilgrim wants to pay with card in my albergue, I do not get to keep the card's details: I simply charge from the card with my device and that's it. I never get hold of any of the card's info such as its number, holder's name or expiry date. Now with this new regulation, I will have to collect those details!​

 

[Marbe2]

:

Of course the way to avoid your credit card details being stored is simply to pay cash everywhere

In the USA, one-simply can ask for a new card and it arrives in a few days.

So if you are worried about creditcard data improperly being recorded on paper, simply replace it when you return home. You can also set up your CC so that the company notifies you whenever a purchase is made on the card. So you would be aware if someone used your CC info while walking.

I don’t see the need to carry much cash!

 

[John Pearce]

Well it looks like cash is the answer to not having to leave your banking detail all over Spain. As far as data protection, what data protection? Sounds like identity theft will become much easier in Spain In the future. The authorities have always been the Achilles heal of having good times in Spain. Keep smiling pilgrim it only takes 10 - 15 mins a day, plus waiting time In the line.

 

[John Pearce]

Quote. I must say that, for the first time, I am considering getting a separate credit card for travelling to Spain that I terminate after my return home …

What a good idea!!!

 

[Kathor1]

This article (link below), written in the summer of 2022, asks how it was possible that the Spanish government went ahead with their new regulation, despite unfavourable advice from the European Commission. I can’t find a source for this and I guess that it might have been nothing formal, just an informal opinion by some official. The article provides no real answer to this question. I do hope that this gets challenged in the courts, or at least with the Data Protection agencies, once more travellers and tourists learn about it and are confronted with it. Fingers crossed.

Si infringe el derecho comunitario habrá que derogarlo: la Comisión Europea emitió un informe desfavorable del Real Decreto 933/2021 - GEBTA

En un reciente articulo de opinión publicado en Hosteltur bajo el título El Real Decreto 933, un torpedo a la línea de flotación del turismo aprovechaba para

gebta.es

 

[Molly Cassidy]

It’s not about storage of details as such in this thread. It’s about the (potential / presumed) collecting and storing of so many personal details in the same place, namely in the same database on an IT system and, in particular and possibly, in a book that is lying around and accessible to many different people from many different places and backgrounds over the course of 3 years in some of the Camino albergues.

As pointed out in post #26 about what is changing:

About the payment with card: if a pilgrim wants to pay with card in my albergue, I do not get to keep the card's details: I simply charge from the card with my device and that's it. I never get hold of any of the card's info such as its number, holder's name or expiry date. Now with this new regulation, I will have to collect those details!​

Yes, but if you pay cash, you don't have to provide any of it!

 

[Molly Cassidy]

:

In the USA, one-simply can ask for a new card and it arrives in a few days.

So if you are worried about creditcard data improperly being recorded on paper, simply replace it when you return home. You can also set up your CC so that the company notifies you whenever a purchase is made on the card. So you would be aware if someone used your CC info while walking.

I don’t see the need to carry much cash!

It's not just about the card details. They want your account number (along with your address and all your contact details) and that means they can apply for other services and set up a debit on your account.

 

[Kathor1]

@Juanma, it’s time for me to admit that I clicked only now on the two links that you provided in your first post . In my defense though: I did try to inform myself about the issue before I posted. I am usually reluctant to sign petitions that concern things that are “far away”, in places where I don’t live, in countries where I am not a voter. But it does concern us, at least those of us who are EU consumers who have rights and can make claims for protection that go beyond our national border. So, just let me repeat these links as to not lose sight of what it’s about:

https://sites.google.com/view/pau-plataforma-alojamientos-un/pau
https://www.change.org/p/control-de-viajeros-intolerable?signed=true

 

[Marbe2]

It's not just about the card details. They want your account number (along with your address and all your contact details) and that means they can apply for other services and set up a debit on your account.

I make reservations through booking.com. While the establishments do ask
for my passport and credit card (of course) and sometimes a zip code but not an address, (I have never been asked for address). Anyone using a CC anywhere should monitor there accounts! If you feel Cash is better and a safer(?) way to travel on a Camino… then that is best for you, of course.

I don’t mean in anyway to minimize your concern about data, and have already signed the petition on change.org

 

[Molly Cassidy]

I make reservations through booking.com. While the establishments do ask
for my passport and credit card (of course) and sometimes a zip code but not an address, (I have never been asked for address). Anyone using a CC anywhere should monitor there accounts! If you feel Cash is better and a safer(?) way to travel on a Camino… then that is best for you, of course.

I don’t mean in anyway to minimize your concern about data, and have already signed the petition on change.org

Usually with booking.com I am asked for an address. Often I am asked to provide my address again at check-in. The new legislation says they will ask not only for your address and contact details but also your bank account number.

 

[Marbe2]

When one sets up an account on booking you put in your address and telephone number. The mobile number can serve as a second security check when you sign in. They send you a security code as a second sign In feature.
I have had a booking account for more than15 years and never had a problem with them. You can also pay them directly so you don’t have to show your credit card at the accommodation just your ID.

 

[Molly Cassidy]

I have had an account with Booking for a long time, too. I'm not sure what your point is.
Are you saying you have never been asked for your address when you checked into a hotel? Or been asked for ID or a credit card?

 

[Flatlander]

The mobile number can serve as a second security check when you sign in

Just FYI that can cause all kinds of problems if you ever lose your phone. Been there, done that and it's not fun

You can also pay them directly so you don’t have to show your credit card at the accommodation just your ID.

Only if the establishment allows it. Not every establishment does.
With some you can pay via Booking.
With some they use the card as a "holder" for the reservation but you pay the establishment directly
With some you pay directly.

 

[David Tallan]

Am I missing something. I haven't walked since 2018 but I dont recall ever having to do anything other than show my passport and get my credencial stamped. Only place I had a problem was in Bibao where they did not initially accept my passport card as a passport. Because my fellow Irish people in front had a passport book, the girl could not get her head around me being different. Not doubting the changes but doubting the implementation of past protocols

What you're missing is the post that started this discussion that says that the rules are changing and more information will need to be collected by people providing accommodations including, among other things: fixed and mobile phone numbers, email address, home address, number of people in the party and the relationship between them (if any are minors), check in and check out dates and times, and potentially credit card information. The concern is that this will be more time and effort for hospitaleros/as and for pilgrims, as well as opening up privacy issues.

What you experienced before may not be what you experience on your next Camino if/when these rules come into effect and are enforced.

 

[Marbe2]

Just FYI that can cause all kinds of problems if you ever lose your phone. Been there, done that and it's not fun

Only if the establishment allows it. Not every establishment does.
With some you can pay via Booking.
With some they use the card as a "holder" for the reservation but you pay the establishment directly
With some you pay directly.

Many many establishments, though not all, allow booking to collect, especially since Covid-19. But there are some that don’t.

We have back-up systems should we misplace our IPhones , both paper and IPad 4.
Here is what a private establishment is asking for online to make registration easier.
I donot send any info ahead.

Below is what one accommodation is asking me for for April 2023.

 

[pjacobi]

I've been traveling to Europe for many years. Most hotels ask for a Passport at check-in and copy your name, address and Passport number. I thought this was standard European practice. Perhaps the only thing that may have changed is the information is enter on-line.


-Paul

 

[wynrich]

At larger hotels, we usually use Apple Pay via my husband's iPhone. Our understanding is that this generates a different credit card number every time, not the card we use to pay Apple ultimately. The same would probably be true for Samsung Pay, Google Pay, etc. Would this be a solution for not having to give a credit card number?

 

[henrythedog]

If and when it comes to pass I rather suspect that the whole ‘financial details’ section will actually be ‘means of payment’

It is inconceivable that on booking a room with a credit card, or paying in cash, I would also be asked for my bank details - but if one thinks back to the ‘paying by cheque’ days, we all handed over on a regular basis a document with our full bank details, a signature and a sample of our handwriting.

The sun still came up in the morning and the Queen (QEPD) stayed on the throne.

Perhaps we might return the pitchforks and burning torches to store for a while?

 

[peregrina2000]

I know there are a lot of people who don’t like to pay attention to what may seem like tiresome details. But if you have paid even a little bit of attention to @Juanma’s posts, and some of the more helpful responses, you will see that what is being proposed is a big change from what is currently asked for. To echo @David Tallan, this has nothing to do with what you have had to give in the past, no matter how many times you have been to Europe.

An article in the Pontevedra press, which documents a formal complaint against these new regulations by the hospitality industry of the area, details the changes.

Current regulations require 9 bits of information. Number of passport or identity document, date of issue, name, last name, sex, birthday, nationality and day you enter the establishment.

The new proposal requires 31 pieces of information. Name, first last name, second last name, sex, identity document number, number of “soporte del documento” (not sure what that is), type of document, nationality, birthdate, residence, complete address, town, country, phone number (both land liine and mobile), email address, number of travelers, relationship among travelers if one is underage, date and hour of entry, date and hour of departure.

The most concerning new requirements, in the view of the hospitality industry, have to do with the financial data being asked for— type of payment (cash, CC, bank transfer), type of CC and CC number, IBAN number of the bank account, mobile transfer (I’m guessing this refers to Venmo, Zelle,etc, name on the account used, expiration date of CC, date of payment.

Los hoteleros alertan del lastre que supone el nuevo sistema de registro de los clientes

El check-in pasa de incluir nueve datos a más de 30, entre ellos, la relación entre los usuarios

www.diariodepontevedra.es

Even if you are from the “who cares, I don’t have any privacy left anyway” segment of society, I would think that none of us would support the proposed requirement that the establishment write down our credit card number and keep it in their own files for three years!

 

[Rebekah Scott]

And pilgrims who travel with the minimum, carry their own bags and and stay at no-reservations cash-donativo places don't have this problem.
Maybe they were onto something.

 

[Molly Cassidy]

We did?! I never had to do that when paying with a check (cheque) to make purchases years ago in the US unless I was applying for a mortgage, or for some folks, a car loan.

Yes, I don't know about the US but in the UK cheques are printed with your account number and sort code.

 

[Kathor1]

We did?! I never had to do that when paying with a check (cheque) to make purchases years ago in the US unless I was applying for a mortgage, or for some folks, a car loan.

You did not but I and many others did when we travelled to and stayed in a foreign country like Spain. Until 2002 when the Eurocheque system was abolished - a sad day at the time -, I paid for purchases in shops by check plus ec-card in Spain, France, UK, Benelux, Germany, Italy, and other European countries that belonged to the system. BTW, it had nothing to do with the EU or the euro. See https://en.wikipedia.org/wiki/Eurocheque. Up to then I never used a credit card in Spain or elsewhere in countries in Europe or in the Mediterranean region. The only reason why I had a credit card: I got one for a trip to the USA in 1990 or so.

But all this was over twenty years ago and it is irrelevant for a trip to Spain in 2023.

 

[Camino Chrissy]

Yes, I don't know about the US but in the UK cheques are printed with your account number and sort code.

Yes, it is the same here. Our checks have our acct.# and our handwritten signature in them.
I have deleted my post you referred to as I misunderstood @henrythedog. I thought he was saying we used to provide a monthly checking account statement, but it was not what he was saying...the written word is not always clear to one's ears.

 

[Telboyo]

if you have paid using a cc the number expiry date etc will already be recorded by the payment system.
I know there are a lot of people who don’t like to pay attention to what may seem like tiresome details. But if you have paid even a little bit of attention to @Juanma’s posts, and some of the more helpful responses, you will see that what is being proposed is a big change from what is currently asked for. To echo @David Tallan, this has nothing to do with what you have had to give in the past, no matter how many times you have been to Europe.

An article in the Pontevedra press, which documents a formal complaint against these new regulations by the hospitality industry of the area, details the changes.

Current regulations require 9 bits of information. Number of passport or identity document, date of issue, name, last name, sex, birthday, nationality and day you enter the establishment.

The new proposal requires 31 pieces of information. Name, first last name, second last name, sex, identity document number, number of “soporte del documento” (not sure what that is), type of document, nationality, birthdate, residence, complete address, town, country, phone number (both land liine and mobile), email address, number of travelers, relationship among travelers if one is underage, date and hour of entry, date and hour of departure.

The most concerning new requirements, in the view of the hospitality industry, have to do with the financial data being asked for— type of payment (cash, CC, bank transfer), type of CC and CC number, IBAN number of the bank account, mobile transfer (I’m guessing this refers to Venmo, Zelle,etc, name on the account used, expiration date of CC, date of payment.

Los hoteleros alertan del lastre que supone el nuevo sistema de registro de los clientes

El check-in pasa de incluir nueve datos a más de 30, entre ellos, la relación entre los usuarios

www.diariodepontevedra.es

Even if you are from the “who cares, I don’t have any privacy left anyway” segment of society, I would think that none of us would support the proposed requirement that the establishment write down our credit card number and keep it in their own files for three years!

 

[Juanma]

It is inconceivable that on booking a room with a credit card, or paying in cash, I would also be asked for my bank details - but if one thinks back to the ‘paying by cheque’ days, we all handed over on a regular basis a document with our full bank details, a signature and a sample of our handwriting.

No, if you're paying in cash, then the albergue/hotel would have to write "type of payment: cash", and no details of your credit card or bank account would be required at all; however, I'm not sure about the situation when you book online providing a credit card but then decide to pay cash once in the establishment. I guess since the actual payment has been done in cash, no financial data would be collected either, even if you did book online providing a credit card.

 

[Camino Chrissy]

No, if you're paying in cash, then the albergue/hotel would have to write "type of payment: cash", and no details of your credit card or bank account would be required at all; however, I'm not sure about the situation when you book online providing a credit card but then decide to pay cash once in the establishment. I guess since the actual payment has been done in cash, no financial data would be collected either, even if you did book online providing a credit card.

@peregrina2000 mentioned 31 pieces of information is to be collected. Even if a person pays in cash wouldn't there still be approx. 25 additional pieces of information they will be collecting?

 

[Molly Cassidy]

@peregrina2000 mentioned 31 pieces of information is to be collected. Even if a person pays in cash wouldn't there still be approx. 25 additional pieces of information they will be collecting?

Many categories will not be applicable to every traveller (not everyone has a landline phone, email address, mobile phone). You will be asked for your address, but there will be no way for anyone to verify it, so you can write what you like. Some only apply to groups (no of persons and relationship). These may be important for child-protection. Your arrival and departure time etc. are things that will no doubt be recorded by the hospitalero/a in accordance with policy, rather than actually tracking the movements of individuals.

 

[henrythedog]

I know there are a lot of people who don’t like to pay attention to what may seem like tiresome details. But if you have paid even a little bit of attention to @Juanma’s posts, and some of the more helpful responses, you will see that what is being proposed is a big change from what is currently asked for. To echo @David Tallan, this has nothing to do with what you have had to give in the past, no matter how many times you have been to Europe.

An article in the Pontevedra press, which documents a formal complaint against these new regulations by the hospitality industry of the area, details the changes.

Current regulations require 9 bits of information. Number of passport or identity document, date of issue, name, last name, sex, birthday, nationality and day you enter the establishment.

The new proposal requires 31 pieces of information. Name, first last name, second last name, sex, identity document number, number of “soporte del documento” (not sure what that is), type of document, nationality, birthdate, residence, complete address, town, country, phone number (both land liine and mobile), email address, number of travelers, relationship among travelers if one is underage, date and hour of entry, date and hour of departure.

The most concerning new requirements, in the view of the hospitality industry, have to do with the financial data being asked for— type of payment (cash, CC, bank transfer), type of CC and CC number, IBAN number of the bank account, mobile transfer (I’m guessing this refers to Venmo, Zelle,etc, name on the account used, expiration date of CC, date of payment.

Los hoteleros alertan del lastre que supone el nuevo sistema de registro de los clientes

El check-in pasa de incluir nueve datos a más de 30, entre ellos, la relación entre los usuarios

www.diariodepontevedra.es

Even if you are from the “who cares, I don’t have any privacy left anyway” segment of society, I would think that none of us would support the proposed requirement that the establishment write down our credit card number and keep it in their own files for three years!

Aw c’mon, let’s not pretend.

If current name = 2 data fields and future name = 3 data fields, are we going to die in a ditch for that?

wrt the financial information I remain to be convinced that there will be any requirement to record other than the means of payment for the service provided. In the case of a credit card, I have precisely no idea of the duration for which my details are currently recorded and no control over that, so a gallic shrug is the best I can muster.

There is nothing on the extended list - other than relationship to a minor - which I fail to recognise from countless hotel check-ins

 

[Molly Cassidy]

Aw c’mon, let’s not pretend.

If current name = 2 data fields and future name = 3 data fields, are we going to die in a ditch for that?

wrt the financial information I remain to be convinced that there will be any requirement to record other than the means of payment for the service provided. In the case of a credit card, I have precisely no idea of the duration for which my details are currently recorded and no control over that, so a gallic shrug is the best I can muster.

There is nothing on the extended list - other than relationship to a minor - which I fail to recognise from countless hotel check-ins

Quite! It's all fairly standard stuff.

 

[Sidknee]

It’s interesting reading the legislation and the underlying reason for the introduction of this change.

“At the present time, the greatest attacks on citizen security are carried out by both terrorist activity and organized crime, in both cases with a markedly transnational nature. In both cases, the logistics of accommodation and the acquisition or use of motor vehicles are particularly relevant in the modus operandi of criminals, the contracting of which is carried out today by countless means, including telematics, which provides greater privacy in those transactions.”

Working in the financial crime environment (which goes beyond financial transactions), most of this information is collected, collated and reported on (to regulators) with every transaction processed through a Bank. In Australia AUSTRAC is the said regulator.

Of all the things that would concern me is the need to retain the information for extended periods and the secure storage of that information. Particularly transactional fraud (at the low end) through to identity theft (at the top end) and/or unlawful tracking. I’d need to better understand the retention requirements and compliance regime.

This can be an onerous and in some instances impossible impost on small business and charities. That said, that shouldn’t be a reason for not collecting the information. Once reported maybe the opportunity is there to delete the information at the initiation level. But that’s jumping to solution’s when I don’t fully understand the process.

sadly we live in a world where these measures are necessary to protect us from the less than salubrious members of society.

 

[henrythedog]

It’s interesting reading the legislation and the underlying reason for the introduction of this change.

“At the present time, the greatest attacks on citizen security are carried out by both terrorist activity and organized crime, in both cases with a markedly transnational nature. In both cases, the logistics of accommodation and the acquisition or use of motor vehicles are particularly relevant in the modus operandi of criminals, the contracting of which is carried out today by countless means, including telematics, which provides greater privacy in those transactions.”

Working in the financial crime environment (which goes beyond financial transactions), most of this information is collected, collated and reported on (to regulators) with every transaction processed through a Bank. In Australia AUSTRAC is the said regulator.

Of all the things that would concern me is the need to retain the information for extended periods and the secure storage of that information. Particularly transactional fraud (at the low end) through to identity theft (at the top end) and/or unlawful tracking. I’d need to better understand the retention requirements and compliance regime.

This can be an onerous and in some instances impossible impost on small business and charities. That said, that shouldn’t be a reason for not collecting the information. Once reported maybe the opportunity is there to delete the information at the initiation level. But that’s jumping to solution’s when I don’t fully understand the process.

sadly we live in a world where these measures are necessary to protect us from the less than salubrious members of society.

We will all sleep more soundly in our beds because the bureaucratic machine will, when it gets around to it (and probably not outside working hours nor on public holidays) protect us from those potential assailants who are unexpectedly honest in providing accurate information when checking in to accommodation?

Probably not.

Churchill’s view was: “We sleep soundly in our beds because rough men stand ready in the night to visit violence on those who would do us harm.”

I was, in my youth, briefly one of those ‘rough men’, but I wasn’t particularly good at it. Mrs HtD on the other hand …

I can argue both sides of this (I was an economist - it’s what we do); but my considered opinion is:

1. It’s not a huge intrusion into my privacy as virtually all that information (and more - CCTV anyone?) is typically collected in any case
2. It’s a total waste of time. And the vanishingly small number of cases in which it might eventually prove useful don’t justify the effort. (Ask an insurer what value they put on a human life; they do it all the time)
3. For the voluntary sector it’s an unwelcome PiTA. For the commercial sector, they’ll just deal with it.

 

[Kathor1]

FWIW, although Real Decreto 933/2021 is applicable now and the government websites where the data must be transmitted to are apparently operational, the Ministry of the Interior has announced an implementation phase ending on 2 June 2023 during which no fines will be issued and owners and managers in the hospitality sector are given time to adapt their IT systems and/or registry books to the new legal requirements. So while many travellers will no doubt continue to sleep soundly, quite a few other travellers may well wake up if they have not yet done so and learn about this undesirable and intrusive change during the next four months ....

 

[Marbe2]

I know there are a lot of people who don’t like to pay attention to what may seem like tiresome details. But if you have paid even a little bit of attention to @Juanma’s posts, and some of the more helpful responses, you will see that what is being proposed is a big change from what is currently asked for. To echo @David Tallan, this has nothing to do with what you have had to give in the past, no matter how many times you have been to Europe.

An article in the Pontevedra press, which documents a formal complaint against these new regulations by the hospitality industry of the area, details the changes.

Current regulations require 9 bits of information. Number of passport or identity document, date of issue, name, last name, sex, birthday, nationality and day you enter the establishment.

The new proposal requires 31 pieces of information. Name, first last name, second last name, sex, identity document number, number of “soporte del documento” (not sure what that is), type of document, nationality, birthdate, residence, complete address, town, country, phone number (both land liine and mobile), email address, number of travelers, relationship among travelers if one is underage, date and hour of entry, date and hour of departure.

The most concerning new requirements, in the view of the hospitality industry, have to do with the financial data being asked for— type of payment (cash, CC, bank transfer), type of CC and CC number, IBAN number of the bank account, mobile transfer (I’m guessing this refers to Venmo, Zelle,etc, name on the account used, expiration date of CC, date of payment.

Los hoteleros alertan del lastre que supone el nuevo sistema de registro de los clientes

El check-in pasa de incluir nueve datos a más de 30, entre ellos, la relación entre los usuarios

www.diariodepontevedra.es

Even if you are from the “who cares, I don’t have any privacy left anyway” segment of society, I would think that none of us would support the proposed requirement that the establishment write down our credit card number and keep it in their own files for three years!

So currently, I don’t think we in the USA andCanada use IBAN. Therefore we can leave that blank. Nor do some of us use mobile transfer,or have home lines. My point is there will be lots of blanks. Foreign address won’t be easy to check. When I return from my camino I obtain a new Credit card number. So I am not so sure about the concern about addresses. If you think you can’t be found online…think again. It is best to continually monitor your security and finances.

What concerns me more,honestly, is the pressure and burden this puts on volunteers. That is why I signed the petition on Change.org.

 

[henrythedog]

So currently, I don’t think we in the USA andCanada use IBAN.

You do (or at least you would do if you wanted to have someone make a direct payment to you from outside the US)

It’s simply an ‘International Bank Account Number’: it puts your domestic account details into an internationally recognised format.

But to your broader point. Exactly - lots of blanks.

 

[Kathor1]

So currently, I don’t think we in the USA andCanada use IBAN.

The legal text of Real Decreto 933/2021 says: Identificación del medio de pago: tipo de tarjeta y número, IBAN cuenta bancaria, solución de pago por móvil, otros.

If you make a bank transfer from the USA to Spain it will be recorded under the heading "otros" and by using the format that your bank account number has. This will rarely concern travellers from the USA because as we know they don't pay for their accommodation in Spain by bank transfer because of the comparatively high additional costs. Which, as we also know, are zero for domestic bank transfers within Spain and international bank transfers within the EU+/SEPA area where everyone's bank account number is in the IBAN format.

 

[henrythedog]

No, if you're paying in cash, then the albergue/hotel would have to write "type of payment: cash", and no details of your credit card or bank account would be required at all; however, I'm not sure about the situation when you book online providing a credit card but then decide to pay cash once in the establishment. I guess since the actual payment has been done in cash, no financial data would be collected either, even if you did book online providing a credit card.

Thank you. You’re doing a great job of explaining the situation very clearly.

 

[WGroleau]

A Godgle translated extract for anyone who enjoys that sort of thing:

3. Traveler data [to be collected]

[details deleted]

The cynic in me might think that much of the targeting of this regulation, and the consequent fuss, centres around AirBnB providers and their disinclination to visibility. Hoteliers will have scooped most of this from Berking.con and the ilk. I'll concede that it'll be another bit of tedium for the poor sod hospitalera/o who'll have to fill in the database though the cheerful monk at Sobrado tapped us each into his laptop with barely a hesitation in the flow of his chatter.

I also think there's a potential breach of at least two bits of European data protection legislation. Specifically over data retention and storage but as the regulation has been couched as a "National Insecurity" measure data protection is overridden

For many years, Spain has required ALL abergues, hostels, hotels, AirBNB, and any other short-term rentals to submit some of that information to a database maintained by the Guardia Civil. When GDPR was passed, the way it was being done became illegal (in my non-lawyer's opinion) because they didn't bother to tell us (I was a hospitalero when GDPR became law) about the need to tell the pilgrim why we asked for it and to have them sign a document saying they understand the reason and agree to it. If they are increasing the scope of that database and still not informing hosts of such requirements, then it may indeed become a trigger for lawsuits. On the other hand, GDPR does have some exemptions. I am not sure whether a pilgrim's albergue is exempt.

I always thought it ironic that after six cops showed up threatening the staff loudly for not collecting the data (years ago when they didn't know about it), they would occasionally call on the phone to ask whether some person reported missing had stayed with us. "Hello? We don't remember the names of all the twenty-plus pilgrims that stop here every nigh! Look her up in your database!" (Actually, we did file the written lists as also required.)

 

[Canche]

Hi every one. Have you, as a pilgrim checking-in into an albergue/hostel/hotel in Spain ever felt it weird that you were asked to fill in a form with some basic personal information, and/or have been asked to sign on the screen of a mobile device (phone, tablet...) after the Reception staff had scanned your passport or ID with that same device?

This is due to the Spanish law having required, until now, that all travellers staying in any kind of lodging in Spain, have their basic data collected and then, over the night, this information sent to the Police or Guardia Civil.

Right now a new law has been approved, starting February 2023, for which A LOT MORE INFORMATION will have to be collected from the travellers, making the whole process a lot slower for both the hospitalero and the pilgrim, and a lot more intruding into the pilgrim's personal space.

From the traveller's point of view the data that will now have to be collected probably goes against their right to privacy and/or personal data protection rights; and for the albergue staff it means an unacceptable extra time/effort/investment in gathering the whole information, also making the possible other pilgrims waiting to check-in have to wait longer. And by the way, the information gathered must be kept by the establishment for 3 years!

You can read a little more in depth about the topic (in Spanish) in the website that some albergues and hotels have created to manage our complaint: https://sites.google.com/view/pau-plataforma-alojamientos-un/pau.

A campaign has been started to gather signatures to request the cancellation/modification of this new law. You can read about it and, if you feel like it, maybe sign in: https://www.change.org/p/control-de-viajeros-intolerable?signed=true

(Not sure if it will take signatures from non-Spanish or non-European citizens)

For those of you not familiar with Spanish, I'm sure you can translate the content of those pages using google translate or a similar site/app.

Thanks for reading!

Not good