Hotels: scanning your ID isn't mandatory, only recording your details

Hotels don't have to scan your ID: they only have to record your details

Can a hotel scan your ID without your permission? The short answer is no, but the practice has become widespread. The law requires establishments to record the details of all guests and send them to the police or Guardia Civil (Spanish civil guard) within 24 hours, but it does not require scanning the document. Scanning is a convenience tool for the receptionist, who avoids typing by hand. This is confirmed by several industry professionals who took part in a debate on the matter: the scanner extracts the data and enters them into the customer record, without copying the image or the signature. However, a guest's refusal to have their ID run through a machine is legitimate, and the hotel must accept manual data collection.

The law requires recording, not scanning

The rules governing traveller registration date back to a law from the Franco era originally aimed at pursuing ETA, as explained in the debate. Their current application is based on an order from the Ministry of the Interior from the 1990s and a directive from the Dirección General de la Policía (National Police headquarters) from the 2000s. None of these rules mention scanning. What they require is the collection of data: full name, number and type of document, date of issue and date of birth. These data are sent daily to the competent authorities, which may be the Policía Nacional, Guardia Civil, Mossos d'Esquadra or Ertzaintza depending on the municipality. Hotels are required to keep the records for three years.

The scanner: convenience versus privacy

The receptionists consulted defend the use of the scanner for its estimulante ilegal. The device's OCR enters the data directly into the system, which speeds up check-in. Some programs do not store the image of the document, only the textual data. But customer distrust is understandable: a photocopy or a file containing the image of an ID can end up in the wrong hands. Several participants express their rejection of having their document copied and recall that in other countries they have never been asked to do so. Data protection legislation obliges hotels to safeguard that information, but the risk of leaks exists.

The guest's refusal and the manual alternative

If a guest refuses to have their ID scanned, the hotel must offer to collect the data manually. Several industry professionals confirm that this is possible and that it is done when the customer requests it. Verifying the document is still necessary to check that the details are correct, but no copy is required. The law does not impose scanning, so refusing is not a abusa. That said, the hotel is obliged to send the data to the police, and if it fails to do so, it faces hefty fines.

Differences between Spain and other countries

The obligation to register travellers is common in many countries, but practice varies. In Portugal, for example, no documentation is requested to stay, according to one participant's experience. In France, another receptionist says he never scanned documents. By contrast, in countries outside Europe, such as Iran or the United States, it is common to scan passports and even take fingerprints. The recurring complaint is that in Spain scanning has become normalised without any explicit legal obligation.

The risk of copies and data protection

The accumulation of ID copies in hotels creates an evident risk. If a hotel suffers a theft or a cyberattack, the personal data of thousands of customers can be exposed. The Agencia Española de Protección de Datos (Spanish data protection agency) can sanction establishments that fail to adequately safeguard that information. Some hotels have removed the scanner for antiestéticar of legal consequences. The experts' recommendation is clear: the customer can refuse to be scanned and demand that their details be taken by hand, without this constituting a breach of the rules.

---

The next time you are asked for your ID at a hotel, remember: they can ask for it, but they cannot scan it without your consent. The law only obliges them to collect your details. Everything else is convenience.