Brussels opens a case against Spain's guest registration

In this sector, headlines out of Europe get read as amnesties. A piece of news suggests the obligation has fallen away, and somebody stops filing guest reports. It happened with the NRUA registry, and it is happening again, this time with Brussels in the lead role.

On 4 June 2026 the European Commission opened an infringement procedure against Spain over its guest registration system. It did so by sending a letter of formal notice, case INFR(2026)4005, as part of its June infringements package¹. The target: the system created by Royal Decree 933/2021, the rule that obliges every Spanish lodging to report traveller data through SES.HOSPEDAJES, which the Commission says does not fit the EU’s police-data directive.

The European Commission’s three objections to Royal Decree 933/2021

The rule the Commission invokes is not the GDPR, which sets your own duties as a lodging when registering guests, but Directive (EU) 2016/680, which governs the processing of personal data for law enforcement purposes². The distinction sets the standard: guest registration feeds a police database, and it is that directive which fixes what purposes and what retention periods such a database may have. These are the three shortcomings the Commission attributes to it, in its own words:

“The Commission considers that the categories of personal data collected and stored are excessive, due to the variety of datasets, including payment and GPS data. In addition, access by law enforcement authorities is not limited to specific and explicit purposes, as required by the Directive. Spanish authorities also retain all collected data for three years, which the Commission considers disproportionate.”

Each of the three objections lands on a part of the decree you already apply.

The payment data sits in Annex I. The variety of datasets the Commission talks about is, on the lodging side, the “transaction data” block: alongside the contract and the stay, the annex asks for the payment³.

• Type: cash, credit card, payment platform, bank transfer.
• Identification of the means of payment: card type and number, bank account IBAN, mobile payment solution or others.
• Holder of the means of payment.
• Card expiry date.
• Date of payment.

That block does not stay in your own records: Article 6.3 includes it among the data you must transmit within 24 hours at most⁴. The lodging annex, on the other hand, has no GPS field at all³: the geolocation data the Commission mentions comes from the other activity the decree regulates, car rental.

Access is defined by Article 7. The decree does say who may process the data, and the problem, for Brussels, is how it says it:

“The data may be processed only by the State security forces and corps in the exercise of their respective powers in the field of crime prevention, detection and investigation assigned to them.”

“Crime prevention, detection and investigation” is an entire field of policing, not a specific purpose. The same article adds that the design of these files will give particular weight to the possibility of interconnecting them with other police databases⁵. The directive asks for specific and explicit purposes, and that is where the Commission does not find them.

The three years run from the guest’s departure, not from the moment you file the report:

“The data in the computerised register must be retained for a period of three years counted from the end of the service or contracted provision.”

For you that means the record of a stay ending in August 2026 cannot be deleted until August 2029. Anyone providing lodging on a non-professional basis falls outside this retention duty and carries only the reporting obligations⁶.

What a letter of formal notice is (and is not)

A letter of formal notice opens the procedure, it does not settle it. It does not annul Royal Decree 933/2021, does not suspend SES.HOSPEDAJES, and does not change the penalty regime by a single euro: it is the formal way Brussels says “we believe this breaches EU law; explain yourselves or fix it”. The June package itself says what comes next:

“The Commission is therefore sending a letter of formal notice to Spain, which now has two months to respond and address the shortcomings raised by the Commission. In the absence of a satisfactory response, the Commission may decide to issue a reasoned opinion.”

The usual route, if nobody gives way first:

That first deadline expired in early August 2026. The next visible move would be the reasoned opinion, and the Commission announces those decisions in the infringements package it publishes every month.

Many procedures close along the way, with the State adjusting the rule before trial; others sleep for years. The calendar belongs to Brussels and the Spanish government, and none of its dates depends on anything your property does.

What does not change today: your guest reports

The consolidated text of Royal Decree 933/2021 remains in force, unmodified and unsuspended⁷. In practice:

• You must still collect each guest’s data and report it through SES.HOSPEDAJES within 24 hours of the stay beginning⁴.
• The penalties under Royal Decree 933/2021 are untouched: Article 8 still classifies a missing report as a serious infraction and a late one as minor⁷, which under Organic Law 4/2015 means fines of 601 to 30,000 euros and of 100 to 600 euros respectively. For the serious infraction, Article 33.2 requires the fine at the minimum degree, 601 to 10,400 euros, and only recidivism declared by a final administrative decision within two years moves it to the medium degree; the fine is imposed by the Government Delegate in the autonomous community, under Article 32.1.c)⁸.
• Inspections have not stopped: this very summer the Balearics and Navarra stepped theirs up.
• The three-year retention duty still applies⁶, even though it is precisely one of the points Brussels questions.

Travel-agency associations FETAVE and UNAV met the Interior Ministry in late June and afterwards reported what they were told there:

“The ministerial order developing Royal Decree 933/2021 is on hold until the European procedure opened in relation to the rule is concluded.”

Interior has thus frozen the system’s expansion and left everything already in force intact. For your day-to-day the difference is zero: what stops is the order that was going to develop the decree, not the decree.

If this sounds like a rerun of the NRUA story, the plots differ: Spain’s Supreme Court annulled the short-term rental registry (Royal Decree 1312/2024, Housing Ministry) over an internal competence problem. The Brussels case targets guest registration (Royal Decree 933/2021, Interior Ministry) over data protection. Neither touched your guest reports; this one has not either, yet.

What the Spanish industry demands: repeal of Royal Decree 933/2021

The hotel confederation CEHAT reacted the next day demanding the immediate repeal of Royal Decree 933/2021 and a working group to design an alternative system¹⁰. For the confederation, the Commission’s decision was no surprise at all but “the chronicle of a warning foretold”. Its president, Jorge Marichal, accused the Interior Ministry of having broken the sector’s relationship of trust deliberately.

CEHAT has been warning since 2022 about what the system does to accommodation providers:

“It obliges tourist accommodation to become custodians of a vast volume of highly sensitive data such as credit cards, financial transactions and geolocation data, turning them into vulnerable targets for cyberattacks and security breaches.”

Its legal argument rests on the EU Court of Justice case law on air passengers’ PNR data: mass transfers of personal data to security authorities cannot be systematic or generalised, and must be confined to specific, justified cases¹⁰.

The complaint that opened the case was filed by the travel agencies. FETAVE announced on 12 January 2023 that it had lodged it with the European Commission over the decree’s presumed illegality under EU law¹¹. More than three years later, when the letter of formal notice arrived, ECTAA, HOTREC, ETOA and other European industry bodies welcomed the decision on 8 June¹².

Frequently asked questions

Do I still have to file traveller reports for my Spanish rental? Yes, you still have to file traveller reports for your Spanish rental: Royal Decree 933/2021 remains fully in force, penalties included. The European procedure suspends nothing.

Has Brussels annulled Spain’s guest registration? Brussels has not annulled Spain’s guest registration. It opened the first stage of an infringement procedure: a letter of formal notice giving Spain two months to respond. An annulment, if it ever came, would need years and an EU Court ruling, or a reform by the Spanish government itself.

Which EU rule does Spain allegedly breach? The EU rule Spain allegedly breaches is Directive (EU) 2016/680 on police data. Three objections: excessive data categories (payments and GPS included), insufficiently limited police access, and a disproportionate three-year retention.

Is this the same as the NRUA annulment? No, this is not the same as the NRUA annulment. The Supreme Court struck down the Housing Ministry’s rental registry over regional competences. This case questions the Interior Ministry’s guest registration over data protection. Different rules, ministries and procedures.

When will we know more? We will know more once the Commission decides its next step: Spain’s response window closed in early August 2026, and from there it can close the case, ask for more information, or escalate to a reasoned opinion.

What to do as an owner or manager

1. Keep filing guest reports as always. The sanction risk has not dropped, and a favourable outcome would take years to become enforceable change.
2. Distrust anyone telling you “it’s no longer required”. It happened after the NRUA annulment and it is happening again: imprecise headlines that end in very real penalty files.
3. The date still to watch is the reasoned opinion. Spain’s response deadline expired in early August 2026; if the Commission is not satisfied, the reasoned opinion will appear in one of its monthly infringements packages.
4. Collect only what the rule requires. The case is a reminder that this data is sensitive. Over-collecting (ID photocopies included) also exposes you to Spain’s data protection authority.

While the framework stands, the daily obligation is the same as ever: correct data, report filed on time, receipt kept. That routine is what RegistroViajero automates today, digital check-in and SES.HOSPEDAJES submission included; if the state system changes along the way, adapting the submission is our job, not yours.

This article is informational and is not legal advice. The infringement procedure is ongoing: check the cited official sources for the current status.