Brussels Launches Proceedings Against Spain's Passenger Data Collection: What Should Hungarian Travelers Watch For?

The European Commission launched an infringement procedure against Spain on June 4, 2026, regarding the rules for collecting data from tourists and travelers. The decision does not mean that data requests at Spanish accommodations or car rental agencies will immediately cease, but it is an important signal: according to Brussels, the current system may be too broad and disproportionate in several points. Hungarian travelers should therefore be more conscious of what data is requested from them at a hotel, apartment, online platform, or when renting a car.

Spain remains one of Europe's strongest summer destinations, and for Hungarian travelers, city visits to Barcelona, cultural programs in Madrid, Mallorca, Costa del Sol, Valencia, Alicante, and Andalusian road trips are particularly attractive. That is why it is not just a legal detail what data must be provided during a booking or upon arrival. If a country obliges a wide range of tourism service providers to collect, transmit, and store data for years, it can affect the guest experience, the speed of check-in, the car rental process, and the trust of travelers.

The essence of the current case is that, according to the European Commission, Spain expects accommodation providers, online platforms, and car rental companies to collect, store, and transmit personal data, which are managed in a central government database accessible to law enforcement authorities. According to the Commission's position, the system does not fully comply with the EU's data protection directive for law enforcement purposes, particularly because the requested data categories may be too broad and the purposes of access are not sufficiently narrowly defined.

What Exactly Happened?

The European Commission announced in its June infringement package that it is sending a formal letter of notice to Spain. This is the first stage of the EU procedure: the member state has the opportunity to respond, explain its position, and indicate how it intends to correct the identified problems. According to the Commission's communication, Spain has two months to react and address the objections. If the response is not satisfactory, the next step could be a reasoned opinion, and later the case could even go before the Court of Justice of the European Union.

The Commission's objections center around several points. The first is the scope of the collected data. Brussels believes that the categories of personal data are too broad and may include payment data and GPS data. The second problem is that, according to the Commission, access by law enforcement authorities is not tied to sufficiently concrete and expressed purposes. The third objection is the data retention period: Spanish authorities would keep the data in the system for three years, which the Commission considers disproportionate.

It is important to distinguish between the political debate, sector complaints, and the legal situation. The regulation has not come into focus now because of the disputed practice of a single hotel or car rental agency, but because the EU executive body is examining the national system itself. This is essential for Hungarian travelers as well: the question is not just about how much data a receptionist asks for, but on what legal basis, for what purpose, for how long, and with what authority access is granted to this data.

Why Does This Affect Tourists?

In Spain, it has long been customary for travelers to prove their identity during accommodation check-in. This in itself is not unusual in Europe. In many countries, passports or ID cards are requested, and the accommodation provider transmits certain data to the authorities. The debate now is not whether any data can be requested, but to what extent the Spanish system extends data collection to various actors in the tourism chain, and whether the requested data is proportionate to the stated interest of public safety and crime prevention.

In practice, this can manifest in several situations. A hotel or apartment may request more data during booking confirmation or upon arrival. At an online accommodation platform, a guest may encounter the need to provide more information than in other countries. In a car rental, not only the usual check of the driver's license, credit card, and passport may be relevant, but also what data is recorded, where it is transmitted, and what information the customer receives about this.

From the perspective of Hungarian travelers, the most important conclusion is that there is no need to panic before a trip to Spain, but it is worth being prepared. The EU debate surrounding the rules does not cancel existing Spanish reporting obligations, and it does not mean that accommodations or car rental agencies will operate differently overnight. However, if a provider requests an unusually large amount of or sensitive-seeming data, the traveler is rightfully entitled to request clear information on what legislation the data processing is based on, what the data is used for, how long it is kept, and to whom it is transmitted.

What Should Someone Booking a Spanish Trip Now Do?

The most practical advice is not to leave the booking and data provision to the last moment. If someone is traveling to Barcelona, Madrid, Mallorca, Malaga, Alicante, or Valencia, especially during the peak season, the check-in systems of accommodations may already be more burdened. If advance provision of data is required, it is worth doing so through an official, secure interface, rather than via email, messaging apps, or suspicious external links.

• Always check that you provide data on the official site of the accommodation or car rental agency, or on the secure interface of the booking platform.
• If the requested information seems too much, ask for a brief data processing notice or a link to the provider's privacy policy.
• Do not send passport copies, credit card data, or further personal data to unknown email addresses or via unverified links.
• In car rentals, pay particular attention to whether the handling of payment and driver data is clearly explained.
• For group or family trips, expect that additional contact or kinship data may be requested for minors.

Alongside the data protection debate, classic travel planning aspects do not disappear. Those arriving at Barcelona Airport, Madrid Airport, or Palma de Mallorca Airport should still plan their airport transfers and accommodation check-ins in advance during the summer period. In Barcelona and Madrid, for example, it may be useful to review transfer and taxi options from Barcelona-El Prat Airport and Madrid-Barajas Airport transfers, as a slower check-in or late evening arrival can easily rearrange the first day's schedule.

Why Is This Important for the Tourism Market?

Due to the size of Spanish tourism, the current case goes beyond the administrative rule of a single country. Spain is one of the key markets for European inbound tourism: if accommodation providers, travel agencies, online platforms, and car rental agencies face a greater administrative burden, it could have cost and operational impacts. Sector representatives have previously indicated that overly broad data collection can slow down processes, cause uncertainty for providers, and create compliance risks that particularly burden smaller businesses.

This does not necessarily appear immediately in prices, but it is important from the perspective of tourism competitiveness. A travel agency or accommodation provider can function well if its data processing obligations are precise, achievable, and do not contradict EU data protection principles. If the rule is too complex, the provider spends more time on administration, receives more questions from customers, and assumes greater responsibility for data whose management they cannot necessarily control simply.

Car rental is a separate chapter. Many Hungarian travelers rent cars in Andalusia, Mallorca, Alicante, or Valencia because coastal holidays and exploring smaller settlements are more convenient this way. Those planning such a trip should check the data processing and payment terms before booking, especially if the vehicle is picked up at the airport. Useful preliminary information points could be, for example, an overview of car rental at Malaga Airport, car rental at Alicante Airport, or car rental at Valencia Airport.

Will Something Change Immediately?

In the short term, the most likely answer: not radically. The launch of an infringement procedure does not equal a court judgment, and it does not automatically suspend Spanish rules. Spain must now respond to the Commission's objections, and it is conceivable that it will try to resolve the case through legislative amendments, clarifications, or implementation changes. It is also possible that the debate will drag on if Brussels does not find the response satisfactory.

For travelers, the best approach is therefore common sense caution. It is not worth canceling a Spanish trip because of this, as tourism services continue to operate. However, it is worth allowing more time for check-in, keeping booking confirmations, using official communication channels, and ensuring that data requests do not mix with phishing attempts. In high-traffic summer destinations such as Barcelona, Madrid, Mallorca, and Costa del Sol, this is particularly important because multiple actors in the booking chain may come into contact with the traveler.

There are also practical implications for airport hotels. If someone arrives late in the evening or continues their journey with an early flight the next day, it is advisable to coordinate in advance what data the accommodation requests, whether there is online check-in, and what documents must be presented upon arrival. Those planning an airport overnight stay in Madrid, Barcelona, or Malaga can find information in advance about hotels around Madrid-Barajas Airport, hotels near Barcelona El Prat Airport, or hotels next to Malaga-Costa del Sol Airport.

What Should Be Watched For in the Coming Weeks?

The next important deadline is the two-month response period. This means that for a significant part of the summer peak season, accommodation and car rental administration will likely continue within the current framework. However, the Commission's decision may put pressure on Spanish authorities to refine the system, reduce the scope of requested data, or more narrowly define the purposes for which authorities can access the data.

As a Hungarian traveler, three things are primarily worth watching. First: whether the data request process sent by the accommodation or car rental agency changes. Second: whether the provider gives an understandable data processing notice in Hungarian, English, or Spanish. Third: whether official Spanish or EU information appears regarding changes in obligations. Until such a change occurs, the safest path is the use of official interfaces and the avoidance of excessive, uncertain, or unverifiable data requests.

Summary

The case of Spanish passenger data collection is important because it simultaneously affects public safety, data protection, and the daily operation of tourism. The European Commission's current step is not a restriction against travelers, but an examination of whether the Spanish system complies with EU proportionality and data protection principles. For Hungarian tourists, this means that Spanish trips can still be planned, but it is worth being cautious when providing data, especially during accommodation booking, online check-in, and car rental.

For those heading to Spain in the summer of 2026, the best strategy is simple: book with a reliable provider, use an official data request interface, use official communication channels, ask about unusual data requests, and allow enough time for arrival administration. The legal debate has not yet concluded, but it already indicates that in European tourism, data protection is not a background theme, but one of the basic conditions for safe and trust-based travel.

Sources: European Commission June infringement package, information from the European Commission's representation in Spain, ETOA summary, El País tourism sector report, and the Commission's response to a previous written question from the European Parliament.