The European Commission has launched a formal letter of formal notice procedure against Spain due to rules regarding the collection of tourist data. This decision does not mean that accommodations and car rental companies in Spain will stop requesting data from today, but it is an important signal: Brussels believes it must be examined whether the system, which can request various types of personal, payment, and location-based information from guests and bookers, is proportionate. Therefore, Hungarian travelers should still expect more thorough administration in the summer of 2026, while it is advisable to be more conscious of what data they provide, where, and through which channel.
What exactly happened?
One of the most important European tourism regulation news of recent days is that on June 4, 2026, the European Commission sent a letter of formal notice to Spain regarding the passenger data collection system known as Royal Decree 933/2021. The move was confirmed and welcomed by several European tourism organizations, including HOTREC and ECTAA. At the center of the dispute is whether the Spanish regulation imposes data collection and data transfer obligations on accommodations, tourism intermediaries, online platforms, and vehicle rental companies that, according to Brussels, may conflict with EU data protection principles.
The Commission's concerns do not question the principle of guest registration itself. Many European countries have some form of reporting or guest registration system, especially for public safety and immigration reasons. The question is rather about what wide data fields the Spanish system requests, how long the information is kept, who can access it, and whether it is sufficiently clear for what exact purpose the data is processed.
Why does this affect tourists?
The Spanish regulation has come into the tourism spotlight because it does not only affect businesses operating in the background. Guests often encounter requests for detailed data from the provider during booking, online check-in, at reception, or at the car rental desk. These may include identification data, contact details, information related to the stay and booking, and in some cases, payment or transactional data.
According to a recent legal summary by DLA Piper, the Commission is examining the system from the perspective of the Law Enforcement Directive, the EU directive on data processing for law enforcement purposes. Among the objections is that the scope of collected data may be too broad, official access may not necessarily be sufficiently purpose-bound, and the proportionality of the three-year retention period is also questioned. This is important for tourists because data protection is not an abstract Brussels debate: in practice, it is about how much information must be provided during a holiday or city visit, who manages it, and what risk a possible faulty data management or leak could represent.
What does this mean for a Hungarian traveler now?
The most important practical conclusion: the initiation of the procedure does not in itself suspend the Spanish rules. Those traveling to Madrid, Barcelona, Andalusia, Alicante, or Mallorca in the coming weeks can still expect the accommodation or car rental company to request data citing local regulations. The European Commission's procedure is the start of a process, not an immediate change in legislation.
Therefore, Hungarian tourists do not need to argue at every reception. It is much more useful to prepare in advance: check what data the accommodation or lessor requests, use official booking channels, and avoid links or messages that do not come from the provider's known site or reliable platform. If an accommodation requests suspiciously many data points that are obviously not related to the booking, it is worth asking in writing for the data processing notice, especially if the request arrives via email or messaging app.
Where will the impact be felt most by travelers?
Spain is one of the strongest summer and city visit destinations for Hungarian travelers. The impact is particularly felt in bookings where multiple providers request data: for example, flight tickets, apartments, car rental, transfer, and local programs appear together in the itinerary. In the case of Madrid and Barcelona, city hotels and apartments, and in coastal regions, holiday homes, family accommodations, and car rental companies may come to the fore.
Those arriving by plane can start practical planning at the route level. For Madrid, it is worth reviewing the Madrid-Barajas Airport information, for Barcelona, the Barcelona-El Prat Airport page, and for a South Spanish holiday, the Málaga Airport and the Alicante Airport can be important starting points. For those traveling to the Balearic Islands, checking accommodations and transport options around the Palma de Mallorca Airport can be particularly useful.
What is the essence of the dispute from the perspective of tourism businesses?
Tourism organizations do not claim that registration for public safety purposes is inherently unacceptable. Their main argument is rather that the system imposes too great an administrative burden on accommodations, travel agencies, platforms, and car rental companies, while the scope of requested data and the retention period are, in their view, too broad. A HOTREC statement emphasized that fighting terrorism and organized crime is a legitimate goal, but it must be necessary, proportionate, and legally clear.
This is also a competitiveness issue for businesses. A small apartment operator, family guesthouse, or local car rental company has different resources than a large hotel chain or international platform. If the system is complex, smaller providers are more likely to make mistakes, can process check-ins more slowly, and spend more time on administration. On the guest side, this can mean longer check-ins, more preliminary online forms, and greater uncertainty.
Special attention is recommended for car rentals
The Spanish regulation does not only apply to accommodations, but also to driverless motor vehicle rentals. This is essential for Hungarian tourists because many holidays in Spain take the form of road trips: in Andalusia, Costa Blanca, Mallorca, or the Canary Islands, airport car rental is often the central element of the entire trip. The payment and location-based data mentioned in the Commission's concerns can become particularly sensitive in this sector.
It is worth reviewing the rental terms, the data processing notice, and the channel through which the provider requests data in advance. For Madrid, a preliminary overview of Madrid airport car rental, for Barcelona, Barcelona-El Prat airport car rental, and in the Costa del Sol region, Málaga airport car rental can help the traveler not encounter the terms for the first time at the desk. In Mallorca and Alicante, this is especially important during the peak season, when queues, late evening arrivals, and stock shortages already increase the pressure.
What should someone booking Spanish accommodation do now?
The safest approach when booking accommodation is for the guest not only to look at the price and cancellation terms, but also at what preliminary registration the accommodation requests. Official or well-known booking interfaces usually provide more detailed information, but the guest should still ensure that the address of the data-requesting page, the name of the accommodation, and the booking ID are consistent.
If the destination is Madrid, it may be useful to look at accommodations around Madrid-Barajas Airport in advance, while for a trip to Catalonia, an overview of accommodations around Barcelona Airport can provide a reference point. For coastal trips, hotels near Málaga Airport, accommodations around Alicante Airport, and hotels near Palma de Mallorca Airport can be practical starting points. For these, not only the price matters: late check-in, reception opening hours, and the method of preliminary online registration can also affect the smoothness of arrival.
Can the rules change soon?
The EU infringement procedure consists of several steps. After the letter of formal notice, Spain has the opportunity to respond, argue, propose modifications, or provide clarifications. If the Commission is not satisfied with the response, the procedure can proceed, but this typically does not happen overnight. Therefore, the most likely scenario for the summer season is that travelers will encounter the current system while the EU legal dispute continues in the background.
Despite this, the news is an important turning point. The Spanish passenger data register has been a controversial topic in tourism for months, but the European Commission's official move raises the case to a new level. If the Spanish government modifies the rules, it could result in simpler data requests, more precise purpose-binding, or shorter retention periods in the future. However, the Hungarian traveler should not rely on this for trips departing soon.
Practical tips before departure
- After booking, check through which official channel the accommodation or car rental company requests data.
- Do not send passport, credit card, or personal data to unverified email links or suspicious forms received in messaging apps.
- Briefly read the data processing notice, especially if the provider requests more detailed data than usual.
- For late evening arrivals, complete the online check-in in time, but only on a reliable interface.
- For car rentals, check in advance what data is requested from the booker and other drivers.
- Keep booking confirmations, as these help identify the provider and the contractual terms in a disputed situation.
Why is this important beyond the summer season?
Spain's data collection case fits into a broader European trend. Travel is becoming increasingly digital: online check-in, digital keys, preliminary guest identification, biometric border processes, platform-based accommodation booking, and automated car rental are shaping the market. These often make the trip more convenient, but meanwhile move more data between more players. The current Brussels move is therefore not just about Spain, but also about where the line is drawn between security, effective control, and the protection of privacy.
For Hungarian travelers, the best approach is calm but conscious preparation. Spain remains an attractive, easily accessible destination offering a variety of travel experiences. The current procedure is not a reason to cancel trips, but a good reminder that the administrative part of a holiday now requires as much planning as the flight ticket, accommodation, or airport transfer. In Madrid, for example, pre-selecting Madrid-Barajas airport transfer, in Barcelona, Barcelona airport transfer, and in Málaga, Málaga airport transfer can reduce the rush after arrival.
Summary
The European Commission's procedure against Spain is an important signal for the future of tourism data management. The current Spanish rules have not ceased for summer travelers, so detailed data requests should still be expected at accommodations and car rental companies. The change is that Brussels is now officially investigating whether the system is proportionate and meets EU data protection requirements. Hungarian travelers should book through authentic channels, handle data-requesting links cautiously, and clarify the terms of accommodation, transfer, and car rental before departure. This way, the trip to Spain remains well-plannable, while the traveler more consciously protects their own data.