1/8
Procedure No: PS/00173/2023
IMI Reference: A56ID 372395 - A60DD 522366 - Case Register 522365
FINAL DECISION
From the procedure handled by the Spanish Data Protection Agency and based on the
following
FACTS
FIRST: (hereinafter ‘the complainant’) lodged a complaint with the Urząd
Ochrony Danych Osobowych (hereinafter, ‘Polish data protection authority’) on 23 February
2022. The complaint is directed against Yudaya, S.L. with NIF B35137538 (hereinafter
‘Yudaya’). The grounds on which the complaint is based are as follows:
The complainant was a guest at the HD Acuario Lifestyle hotel (Calle General Vives, 82,
35007, Las Palmas de Gran Canaria, Las Palmas). He claims that on 2 January 2022 an
employee of this hotel made a copy of his identity card without providing him with the
information required by Article 13 GDPR.
On 10 of January of 2022, the complainant contacted the hotel to find out on what legal basis
his identity card was copied without complying with the GDPR information obligation. Having
already returned to Poland, they sent him a form providing incomplete data protection
information: the form indicates that the other additional information was on the back of the form
but did not receive the back of this form.
The complainant then sent an email to the hotel’s data protection officer, but, until the time of
filing the complaint, had not received a definitive reply, but only informed him that his case
was being analysed by the hotel’s legal department.
Relevant documentation provided by the complainant:
— Printing of an e-mail dated on 11 January 2022 sent by [email protected] to
an email address of the complainant. In this email, it was forwarded another email dated on
10 January 2022 indicating that there were problems in sending. The content of that email of
10 January 2022 appears as follows:
‘There is a document that all guests sign at arrival, unfortunately you checked-in when
reception was closed and it was the security team who welcomed you into the hotel.
As your check out day is today, please come to reception so you can sign yours and if
you'd like we can also send it to you by e-mail.’
- Document that the complainant received together with the aforementioned e-mail. This
document, named “Travel Entrance Form” contains the complainant’s data: Identity card
number, Type of document, Date of issue of the document, First surname, Second surname
(blank), Name, Sex, Date of birth, Country of nationality, Date of entry, address, postal code,
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeaepd.gob.es
2/8
town, country, e-mail and telephone, and, in it, the following is indicated in Spanish, English
and German:
Controller: “Yudaya S.L.”
Purpose: Management of reservations. Send you commercial communications.
Lawfulness: Execution of a Contract and by Consent of the data subject.
Rights: To access, rectify and delete the data, request the portability of the same, oppose
the processing and request the limitation of it.
Additional information, can be consulted on the back of this form
I also request your authorisation to offer you:
Send you commercial communications.
“Before signing the application, you should read the basic data protection information
presented on the back of this paper.”>>
— Printing of several emails sent by the complainant, between 11 January 2022 and 8
February 2022, to various email addresses (the pseudonyms of which are Aquarius, rgpd,
communication and ), which the complainant indicates that they are from the
hotel, in which he requests to be given the missing part of information on how his data has
been processed following the scanning of his identity card, and indicates that he is missing
the reverse of the form sent to him.
— Printing of an e-mail dated on 25 January 2022 sent by an address named ‘Aquarium
hdhotels’ to the complainant indicating that: Sorry for the delay, our legal department is
already working on it, they will contact you as soon as possible.
SECOND: On 24 February 2022, the Spanish Data Protection Agency (AEPD), received the
complaint through the ‘Internal Market Information System’ (hereinafter the IMI System),
governed by Regulation (EU) No 1024/2012 of the European Parliament and of the Council of
25 October 2012 (IMI Regulation), which aims to promote cross-border administrative
cooperation, mutual assistance between Member States and the exchange of information, and
was given the date of registration of entry on 25/02/2022. This complaint is forwarded to the
AEPD in accordance with Article 56 of Regulation (EU) 2016/679 of the European Parliament
and of the Council of 27/04/2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data (hereinafter GDPR), taking
into account its cross-border nature and that this Agency is competent to act as lead
supervisory authority, given that Yudaya has its registered office and main establishment in
Spain.
The data processing carried out affects data subjects in several Member States. According to
the information incorporated into the IMI System, in accordance with Article 60 of the GDPR,
it acts as ‘supervisory authority concerned’, in addition to the Polish Data Protection Authority,
the Authority of France. All of them under Article 4 (22) of the GDPR, given that data subjects
residing in the territory of these supervisory authorities are substantially affected or are likely
to be substantially affected by the processing subject of these proceedings.
THIRD: On 06/06/2022 the AEPD requested, through the IMI System, the Polish Data
Protection Authority to resubmit the information that had already been shared through the
transfer of the complaint referred to in the previous Fact.
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeaepd.gob.es
3/8
The Polish data protection authority complied with the request for voluntary assistance made
by this Agency through IMI on 07/06/2022.
FOURTH: On 6 June 2022, the privacy policy published by Yudaya was added to the file, which
has a copyright notice of 2020. Within this policy, in section 7. What ARE YOUR RIGHTS IN
DATA PROTECTION AND HOW CAN EXERCISE THEM?”, with regard to how to exercise
the rights as follows: ‘These rights may be exercised by sending a written communication, duly
signed, accompanied by a photocopy of the ID card, to Yudaya, S.L., with registered office for
this purpose at Carretera del Rincón, S/N, Centro Comercial Las Arenas, C.P.3010 de Las
Palmas de Gran Canaria, Las Palmas, Spain, or through the-mail: [email protected]»
FIFTH: The complaint lodged by the complainant was declared admissible on 7 June 2022.
SIXTH: The General Subdirectorate for Data Inspection proceeded to carry out preliminary
investigations to clarify the facts in question, in accordance with the tasks assigned to the
supervisory authorities in Article 57(1) and the powers conferred in Article 58(1) of the GDPR,
and in accordance with the provisions of Title VII, Chapter I, Section 2, of the Spanish Organic
Law 3/2018, of 5 of December, having knowledge of the following points:
OUTCOME OF THE INVESTIGATION
On 28 October 2022, a letter of reply to the request for information submitted on behalf of
Yudaya with entry numbers REGAGE22e00048547779, REGAGE22e00048548544,
REGAGE22e00048549403 and REGAGE22e00048550032 is received in the AEPD,
providing the following information:
1. In response to the request on the reverse of the form provided by the complainant, it is
stated that ‘we cannot prove the existence of the reverse of that document. It is due to a
technical failure in the printing of the agreement or contract between the parties (hereinafter
Kardex). What we can say is that despite the failure that we point out, this basic data
protection information is included in an informative poster in view at the Hotel Reception.
There is a photograph of the existence of this poster for an informational nature ...’ both on
the wall and at the reception desk, so that the Guest can read it at his entrance to the
establishment”, and provide a transcript of the poster, in which its informs about the person
responsible for the data processing, the contact details of the data protection officer, the
purpose of the processing, the lawfulness, the regulation that obliges them to transfer
information to the State Security Police, the retention period and how to exercise the rights
through the e-mail [email protected], and the possibility of submitting a complaint to the
AEPD. Transcription of information on the processing of CCTV data is also provided.
2. Photo of the hotel reception desk (as indicated in the letter) showing 3 pages in a visible
place with the above data protection information in the Spanish, English and German
languages.
3. Declaration that, with respect to the data processed: ‘We must specify that what the hotel
entity does is to extract from the identity card or passport, by means of character recognition
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeaepd.gob.es
4/8
(OCR), the data that is required automatically. Although in some hotels of the chain this
extraction process is carried out by hand. Specifically, and exclusively, the following
personal data are extracted: identification number, first and last name, date of birth, date of
expiration of the document, nationality and sex. Neither the physical document nor the
photograph of the guest is recorded. That is, the entity does not process this personal data.’
4. Regarding the fact that the lawfulness of the processing is the fulfillment of a legal obligation,
they claim the application of Spanish Organic Law 4/2015, of March 30, on the protection
of citizen security, which in its article 25.1 states: ‘Natural or legal persons who carry out
activities relevant to public security, such as accommodation, transport of persons,
commercial access to telephone or telematic services for public use through establishments
open to the public, shall be subject to the obligations of documentary registration and
information in the terms laid down in the applicable provisions’. And, in this case, Yudaya
argues that the provisions applicable in its case correspond to Order INT 1922/2003.
And they state that “the possibility of carrying out this processing by computer means is
even recognised in Ministerial Order INT 1922/2003 which regulates the processing activity
in particular, when it provides that ‘the aforementioned establishments may complete the
forms of input parts by manual procedures or by computerised procedure’. Thus, Yudaya
alleges the application of Order INT 1922/2003 of 3 July 2003 on books-registration and
entry parts of travellers into hospitality establishments and other similar establishments,
which, in its Second Device, provides:
‘1. Passenger entry parts forms shall conform to the model set out in the Annex and
shall be issued by the establishments referred to in this Order.
2. The aforementioned establishments may complete the entry parts forms by manual
procedures or by computerised procedures, but the traveller must sign that part
inexcusably.
3. Once the form has been completed and signed, it will remain in the establishment
for the purpose of making a book-registration, ordering correlatively and constituting
books or notebooks that will comprise a minimum of 100 sheets and a maximum of
500.
4. The register book of the establishment in question constituted in accordance with the
provisions of the previous paragraph, shall at all times be available to the members of
the Security Forces and Corps with competence in the matter, with the establishments
obliged to display it when they are required to do so.
5. Establishments must keep the records for a period of three years, starting from the
date of the last of the record sheets that make up them.
The lawfulness based on Spanish Organic Law 4/2015 and Order INT 1922/2003 also
appears in the photograph of the information posters at the hotel reception provided as an
annex to this letter, indicating as follows:
The lawfulness of the processing is respectively the management of the provision of
the contracted service, the fulfillment of the legal obligations of the Hotel, and the
consent of the data subjects to receive commercial communications and profiling about
their preferences and tastes.
No personal data will be transferred to third parties, except for compliance with the
hotel’s legal obligations. In accordance with Organic Law 4/2015, of March 30, on the
protection of citizen security and Order INT/1922/2003, of 3 July, on books-registration
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeaepd.gob.es
5/8
and entry parts of travellers in hospitality establishments and other similar
establishments, your data may be communicated to the State Security Forces and
Bodies. International data transfers are not planned»
And they indicate that the traveller’s data to be collected appear in the annex to Order INT
1922/2003, in which the following details of the traveller are established:
‘PASSENGER DATA
Identity card number:
Type of document: (1)
Date of issue of the document: (5)
First surname:
Second surname:
Name:
Sex: (2)
Date of birth: (3)
Country of nationality:(4)
Date of entry:(5)
___, ___ of ___ of 20__
Traveller’s signature»
5. With regard to the reasons for the incident described by the complainant, they state that “the
guest arrived at the times when the reception service is not provided, and the check in and
check-out is exceptionally attended by the security team of the establishment, who do not
have access to all computer systems, and that there is no English language”, it is also
indicated that there was a “technical failure in the Kadex software that prevents the complete
printing of the file”.
6. Regarding the possible transfers of the data, it is indicated that no processing is made other
than this indicated by Spanish Organic Law 4/2015 and Order INT 1922/2003, so that the
only possible recipients of the data are the State Security Police.
7. Indication that, the complainant “made on different dates, telephone contact and personal
contact with the reception staff of the Hotel, on at least three occasions, and on those
occasions was informed, in the terms we have explained above sore the processing of the
data”... “that is, for which it is necessary to take the data indicated in the Passport or Identity
Documents and thus make them available in the records books available to the State
Security Forces”. And affidavit with the appearance of signature and dated October 24,
2022, signed by , indicating that she is one of the employees of the hotel
who appears among the recipients of the emails of the complainant, in which she declares
under oath the following:
That I am an employee of the Hotel Acuario of the HD Hotels chain, currently performing
the duties of Head of Reception, although at the date of the incident my position was
that of receptionist.
That due to a problem in the Cardex (Hotel Registration Sheet) there was not available
at the time of the registration of the data subject of the second
layer of information on data protection, although, in February, from the reception of the
hotel a conversation with the client was kept informing him about the need to ratify the
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeaepd.gob.es
6/8
personal data necessary to fill in the record book that is presented in his case for the
State security forces.
8. Printing of e-mail dated 27 October 2022 sent by [email protected] to two e-mail
addresses ( and
) indicating that these are the communication
channel chosen by the complainant in which it is informed in the Spanish and English
languages that the processing carried out with his data is the one that has already been
indicated as a book-registration for the State Security Police, and provides the information
of the controller, contact details of the data protection officer, the purpose of the processing,
the purpose of the processing, the lawfulness of electronic data, the intercoming of the State
Security Police, and the information of the controller of the processing, contact data of the
data protection officer, the purpose of the processing, the non-execution of international
data transfers, how to exercise his data protection rights by mail or e-mail to
[email protected], and the possibility of filing a complaint with the AEPD (Spanish Data
Protection Agency).
CONCLUSIONS
1. The complainant holds that he was not informed about the processing performed when
scanning his ID card. Yudaya indicates that the scanning of the identity card is carried out
to automatically obtain data necessary for the fulfillment of a legal obligation established in
Spanish Organic Law 4/2015 and Order INT 1922/2003, whose purpose is to collect data
from travelers for a possible use by the State Security Police.
2. Yudaya provides a photo in which it is observed that, at the reception of the hotel, information
is visible, and in the Spanish, English and German languages, information on the
processing of personal data collection of travellers and video surveillance. The information
that applies with respect to the processing of passenger data collection is the information
of controller, the contact details of the data protection officer, the purpose of the processing,
the lawfulness, the regulation that obliges them to transfer information to the State Security
Police, the retention period and how to exercise the rights through the email
[email protected], and the possibility of submitting a complaint to the AEPD.
During these investigations, it was not possible to establish whether this information was
already exposed at the hotel reception between 2 and 10 January 2022, at which point the
complainant was staying at the hotel.
3. The information on the lawfulness and purpose of the processing is not the same as that
shown in the photograph of the hotel reception as it appears in the first layer information of
the form that was sent to the complainant in January 2022, which states that ‘Purpose:
Management of reservations. Send you commercial communications. Legitimation:
Performance of a Contract and by the Consent of the data subject.’
4. In the form sent to the complainant in January 2022, the second layer information is missing.
Yudaya indicates that this second layer information was not provided to the complainant in
due course because, upon the arrival of the complainant, reception staff were not working
and received by security personnel, in addition to the lack of second-layer information on
the form subsequently sent to him due to a problem in the computer system.
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeaepd.gob.es
7/8
5. In the form sent to the complainant in January 2022, in addition to the personal data required
to collect Order INT 1922/2003, the following data of the complainant appear: address,
postal code, town, e-mail and telephone.
6. In the e-mails provided by the complainant of dates between 11 January 2022 and 8
February 2022, there is no reply to the complainant’s exercise right of access. Yudaya
provides an affidavit from the receptionist of the hotel stating that, in February 2022, the
complainant was provided orally, with the information on the purpose for which his data
were collected (‘the need to process the personal data necessary to fill in the logbook that
is presented in your case for the security forces of the State’).
7. Yudaya provides an e-mail print sent to the complainant on 27 October 2022 in which the
following information is included: explanation of the reason why his data were collected,
information from the data controller, contact details of the data protection officer, purpose
of the processing, legal basis, the failure to carry out international data transfers, how to
exercise data protection rights by post or email to [email protected], and the possibility
of lodging a complaint with the AEPD.
SEVENTH: On 3 July 2023, the Director of the Spanish Data Protection Agency agreed to
initiate penalty proceedings against YUDAYA, S.L. (hereinafter, YUDAYA) in order to impose
an administrative fine of 10,000 euros (ten thousand euros) for the alleged infringement of
article 13 GDPR, and an administrative fine of 10,000 (ten thousand euros) for the alleged
infringement of article 15 GDPR.
EIGHTH: On 14 July 2023, YUDAYA paid both penalties, which implies the recognition of its
liability.
NINETH: The payment made entails the waiver of any action or remedy in administrative
means against the sanction, in relation to the facts referred to in the Agreement to initiate the
present proceedings.
LEGAL GROUNDS
I
Competence
In accordance with Article 58 (2) of Regulation (EU) 2016/679 of European Parliament and of
the Council of 27 April 2016 on the protection of natural persons with regard to the processing
of personal data and on free movement of these data (GDPR), and as set out in Articles 47,
48.1, 64.2, 68.1 and 68.2 of Organic Law 3/2018 of 5 December 1995 on the protection of
personal data and guarantee of digital rights (hereinafter LOPDGDD) is competent to adopt
this final decision the Director of the Spanish Data Protection Agency.
In addition, Article 63(2) of the LOPDGDD provides that: “The procedures handled by the
Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU)
2016/679, of this organic law, by the regulatory provisions dictated in their development and,
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeaepd.gob.es
8/8
insofar as they are not contradicted, alternatively, by the general rules on administrative
procedures”.
II
Termination of the penalty proceedings by voluntary payment
Article 85 of Spanish Law 39/2015 of 1 October 2015 on the Common Administrative
Procedure of Public Administrations (hereinafter LPACAP), under the heading ‘Termination in
penalty proceedings’, provides:
“(…)
2. Where the penalty is only pecuniary in nature or it is possible to impose a pecuniary and a
non-pecuniary penalty but the latter has been justified as inadmissible, the voluntary payment
by the presumed offender, at any time prior to the decision, shall entail the termination of the
proceedings, except as regards the replacement of the altered situation or the determination
of compensation for the damages caused by the commission of the infringement.
(…).”
According to the above, the Director of the Spanish Agency for Data Protection DECIDES:
FIRST: To declare the termination of the proceedings PS/00173/2023, in accordance with
Article 85.2 of the LPACAP.
SECOND: To notify this decision to YUDAYA, S.L.
In accordance with Article 50 of the Spanish LOPDGDD, this Decision shall be made public
once it has been notified to the interested parties.
Against this decision, which puts an end to the administrative procedure as required by Article
114(1)(c) of the Spanish Law 39/2015 of 1 October 2015 on the Common Administrative
Procedure of Public Administrations, interested parties may bring an administrative action
before the Administrative Chamber of the National High Court, in accordance with the
provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of
13 July, regulating the Dispute-Administrative Court, within two months of the day following the
notification of that act, as provided for in Article 46(1) of that Law.
937-240122
Mar España Martí
Director of the Spanish Data Protection Agency
C/Jorge Juan, 6 www.aepd.es
28001 — Madrid sedeaepd.gob.es