Spain

Accommodation provider (name redacted)

4,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-10-27.

Rank · Sector

#42

of 107 in Accommodation and Hospitality

Rank · Spain

#613

of 1,133

Rank · All fines

#2,096

of 3,267

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-10-27
Controller / Processor: Accommodation provider (name redacted)
Sector: Accommodation and Hospitality
Quoted Articles: Art. 5 (1) c) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Spanish DPA has imposed a fine of EUR 4,000 on an accommodation provider. Data subjects who had booked a stay with the controller via an online booking website were then asked, via email, to submit photos of the passports of all guests over the age of 16. The data subjects sent photos of the IDs with parts pixelated, offering to show the originals on site. However, the controller did not accept the pixelated IDs, stating that they were legally required to have the IDs on file. However, the AEPD found that the controller was not required to process the data subjects' complete passports and was therefore not justified in collecting guests' full passports. The authority found that there were multiple measures that could have been taken to comply with the minimisation principle while still fulfilling other legal requirements.

Open original source Links to the regulator's original publication or another source.