EU opens infringement procedure against Spain over traveller registration: what changes and what does not

In short

On 4 June 2026, as part of its monthly infringement package, the European Commission sent Spain a letter of formal notice — the first formal step of an infringement procedure — over the traveller-registration system of Royal Decree 933/2021 [case INFR(2026)4005]. Brussels considers the system incompatible with Directive (EU) 2016/680, the EU’s data-protection rules for the police sphere: it finds the categories of data collected excessive (including payment and GPS data), objects that police access to the database is not limited to specific and explicit purposes, and considers the blanket three-year retention of all data disproportionate.

What matters for a host or property manager is this: the case suspends nothing. RD 933/2021 remains fully in force, the traveller report is still mandatory within 24 hours of check-in, and the penalties under Organic Law 4/2015 still apply. What has opened is a process between the Commission and the Spanish Government that can take years and that, at most, will end in a reform of the rule — not its disappearance.

What exactly happened

An infringement procedure is the mechanism the European Commission uses to make a Member State correct a rule or practice it considers contrary to EU law. It starts with a letter of formal notice: a formal document in which the Commission details the irregularities it has detected and gives the State a deadline — here, two months — to respond and correct them.

That is what Spain received on 4 June 2026 over traveller registration. The RD 933/2021 system requires accommodation providers, platforms and car-rental companies to collect, retain and transmit travellers’ personal data to a centralised database accessible to police authorities, and the Commission considers that, as designed, it breaches Directive (EU) 2016/680 on data protection in the law-enforcement sphere.

What Brussels objects to in RD 933/2021

The letter of formal notice does not question the existence of a traveller registry — many European countries have one, backed by the Schengen Convention — but how Spain designed its own. The Commission’s specific objections are three:

• ✓Excessive data: the categories of personal data collected and stored go, in the Commission’s view, beyond what is necessary — it expressly cites the variety of datasets, including payment and GPS data.
• ✓Insufficiently limited police access: access by the authorities to the database is not limited to specific and explicit purposes, as Directive 2016/680 requires.
• ✓Disproportionate retention: keeping every piece of collected data for three years strikes the Commission as a disproportionate, generalised and indiscriminate retention period.

What does NOT change today: your obligation is intact

A letter of formal notice neither annuls nor suspends the national rule. Until Spain reforms it or a court strikes it down, RD 933/2021 applies exactly as it did before the case: you must report each guest’s data to SES Hospedajes (or to the Mossos d’Esquadra and the Ertzaintza in Catalonia and the Basque Country) within 24 hours of arrival, and keep the documentary register.

The penalties have not moved either: failing to report a stay can be a serious infringement (€601 to €30,000) and formal irregularities a minor one (€100 to €600), under Organic Law 4/2015. Stopping your filings “because Brussels opened a case against Spain” would be an expensive mistake: the case is a dispute between institutions, not an amnesty for the parties under the obligation.

What may happen next (and how long it may take)

Spain had two months from June 2026 to answer the letter of formal notice. From there, several scenarios are open: the Government reforms RD 933/2021 to align it with the Directive (fewer data categories, shorter retention, narrower police access), it convinces the Commission the current system is compliant, or the case moves to the next stage — a reasoned opinion — and, failing that, ends up before the Court of Justice of the EU.

Infringement procedures are measured in years, not weeks. For the sector, the most likely short-term outcome is not that the registry disappears, but that what is sent and how long it is kept get adjusted. When that happens we will cover it here and update our guides; in the meantime, day-to-day operations do not change.

Do not confuse it with the NRUA ruling

Two legal blows to two different rules coincided in 2026, and they are getting mixed up in many conversations. The Spanish Supreme Court annulled the Single Rental Registry (NRUA) and its Digital One-Stop Shop, created by RD 1312/2024: that was a market-oriented rental registry, and its annulment did remove an obligation (the NRUA number needed to advertise on platforms).

The Brussels case is something else: it concerns RD 933/2021 — the traveller report filed with SES Hospedajes — and, for now, removes no obligation at all. One rule fell by court ruling; the other is contested but in force. If you manage accommodations, today you have exactly the same traveller-registration obligations as before the case.

What to do as a host or property manager

The honest recommendation is boring: keep complying. Keep filing the report for every stay on time, keep the filing receipts, and keep your documentary register for the three years the current rule requires — the Commission questioning that period does not authorise you to shorten it on your own.

BookCheckin files each guest’s report with SES Hospedajes automatically within the 24-hour window, keeps the receipt of every submission, and stores the data encrypted only for the legally required period. If the reform of RD 933/2021 arrives and changes the fields or the deadlines, the adaptation happens in the platform — without you having to rebuild your workflow.