Just two weeks before the entry into force of the last extension of Royal Decree 933/2021 of October 26in which it is necessary to request data from subsectors of the tourism sector, AEHN, Navarrese Hospitality and Tourism Associationin collaboration with the Spanish Confederation of Hotel and Tourist Accommodation (CEHAT) and the rest of the employers’ associations express their opposition to the said regulation because of the chaos that its implementation would produce due to the impossibility of complying with the regulations.
This Royal Decree stresses that there would be a subsequent development by ministerial decree of the data to be provided by each of the tourism sub-sectors (accommodation, car rental, travel agencies, intermediation platforms, campsites, tourist apartments, etc.).
However, hoteliers report that as of today, This legislative development does not existSo there is widespread confusion about what information would be required and how to send it.
The hotel sector, which has always collaborated with state security forces and agencies, was surprised to have to provide unofficial data and which do not appear on any of the documents carried by travelers (identity card and passport) such as the means of payment, credit card numbers, mobile phone number, real address, etc.
As CEHAT, AEHN and the rest of the Spanish associations have been pointing out for months, this makes it impossible to send them automatically, force registration and sending manually and the consequent increase in errors and disproportionate work for those who have to send them.
Faced with this situation, all the associations in the sector have agreed for the first time on the problems that a legislation that they describe as very deficient and impossible to apply.
AEHN and CEHATand the rest of the national associations that represent more than 16,000 establishments with a total of 1,800,000 places distributed throughout Spain, express their main concerns in this regard:
Incompatibility with European Union regulations: The European Commission and the CJEU, in judgment C-817/19, indicated that the measures for the mass processing of personal data provided for by the Royal Decree violate Community regulations on data protection and privacy.
The collection and storage of data, as proposed, does not comply with the principles of proportionality and minimization, which could generate sanctions, legal proceedings and greater legal uncertainty for the obligated subjects. Furthermore, the Royal Decree involves significant interference with the privacy rights of tourists and users without providing clear guarantees, limiting the mass collection of data to specific and justified cases.
Legal uncertainty and inability to comply: The Royal Decree lacks precision and clarity to avoid legal loopholes, which are a source of legal uncertainty. Similarly, the regulation, the Royal Decree, ignores the operational complexities of the companies concerned, which face difficulties in collecting the required data before providing services, which exposes them to significant sanctions due to the inability to comply with these obligations, with consequent operational consequences. and reputational repercussions.
Competitive disadvantage on the national and European market: The obligations imposed by the Royal Decree place Spanish companies, or those operating in Spain, at a clear disadvantage compared to competitors from other EU countries that do not have similar regulations.
European businesses and organisations, such as travel agencies, marketing platforms, conference organisers, hotels, tourist apartments and tour operators, among others, have already expressed their doubts on compliance with this regulation in European bodies, justifying its request, under several aspects, including the difficulties it implies for sending travelers to Spain.
Lack of technological adequacy: Currently, the technological infrastructure necessary to comply with the registration and communication obligations is not fully operational, which leads to legal uncertainty, the inability to comply adds the probability of operational and reputational risks for the obligated subjects.
The lack of technological preparation has already been highlighted by the Spanish Data Protection Agency (AEPD) and the European Commission, reinforcing our assertion that the regulations do not sufficiently take into account either the operational reality of the tourism sector or the regulations in force in international source markets. At the same time, the distribution of security responsibilities in Spain generates the implementation of different tools in different regions of the country, which will pose an additional difficulty for tourism companies with operational work centres in several territories of the country.
A disproportionate administrative burdenIn addition to the difficulties mentioned above, it seems relevant to point out that the new registration and identification requirements represent an excessive administrative burden, especially for small and medium-sized enterprises (SMEs), which constitute the heart of the tourism sector (95% of companies). The implementation of these requirements increases operating costs and management complexity, which many companies cannot afford, facing, in addition to the operational and reputational risks exposed, serious economic sanctions in the event of non-compliance.
Faced with the lack of response to the issues raised by the AEHN together with the rest of the employers’ associations, the president of the CEHAT, on behalf of and representing all the associative entities, addressed the Ministries of Tourism and the Interior, as well as the General Directorate of Police and Civil Guard, demanding the review and adjustment of the Royal Decree to guarantee proportionality and minimization of data, as well as a long period of technological adaptation and adaptation of the operating systems of the companies.
