A hotel reception, that space for welcoming guests and first impressions, has become a legal minefield. This has just been confirmed by a fine imposed on a four-star hotel in Girona for scanning a guest's passport and full ID during check-in: a €9.000 fine, reduced to €5.400 for voluntary payment and acknowledgment of responsibility.
The news, published by ConfiLegal, has resonated as a warning in the Maspalomas hotel ecosystem, where thousands of international guests present their documents upon arrival every day. What once seemed like a harmless routine—scanning their ID or passport or even photocopying it for "proof"—can now become a legal headache.
A new legal frontier in reception
The Spanish Data Protection Agency (AEPD) has made its interpretation clear: neither scanning nor copying DNI documents is permitted if it involves excessive data collection in relation to what is required by Royal Decree 933/2021, the regulation that governs the communication of data to law enforcement agencies.
According to the agency, the guest's face, the parents' names, or the supporting document number are irrelevant data that violate the General Data Protection Regulation (GDPR). The key is proportionality.
Furthermore, since June 17, the AEPD (Spanish Agency for Data Protection) issued a decisive information note: hotels may only collect the data expressly indicated in sections A.3, A.4, B.3, and B.4 of Annex I of Royal Decree 933/2021. And they must do so using a form, either in person or online. No systematic scanning or image files.
And now what are the hotels in southern Gran Canaria doing?
In Maspalomas, the problem is no small feat. Most establishments, especially those in the mid- and high-end segments, use PMS (Property Management Systems) tools integrated with automatic scanners that simplify data collection. This is the fastest way to handle a reception desk with 80 entries on a Saturday morning.
“This is a game changer,” confesses the operations manager of a hotel in St. Augustine. “We'll have to reconfigure systems, train staff, and review every welcome protocol.”
The fear isn't just the fine. It's the legal uncertainty. Because in the realm of check-in, the line between what's necessary, what's useful, and what's illegal is finer than it seems.
The guest as a subject of rights
The sanction has another interpretation: the guest, previously a passive figure in hotel procedures, now emerges as a party with the capacity to report improper practices. A complaint to the AEPD (Spanish Data Protection Agency) is enough to initiate a sanctioning process.
And in the digital age, where customers are more informed and empowered than ever, hotels are competing not only for stars but also for transparency.
Towards a new reception model?
Some experts point out that this resolution will force many establishments to rethink traditional check-in, migrating to 100% digital solutions with online forms prior to arrival. Others predict a boom in selective document reading systems, which extract only the fields authorized by the decree.
But the risk remains high: The use of automated technologies does not exempt you from liability. If the system collects more than permitted, the hotel is still subject to penalties.
A notice for Canarian hotels
The fine in Girona may seem distant, but its consequences are already being felt at the reception desks in Maspalomas, Playa del Inglés, and Meloneras. A simple scanner can cost thousands of euros, and that's something no loyalty program covers.
Tourism in the Canary Islands has survived volcanoes, pandemics, and tour operator bankruptcies. But now, perhaps for the first time, the greatest danger comes not from the skies or from abroad, but from the very heart of national law: the GDPR. And this time, the law doesn't rest during peak season.
