[LOGO]
# Baden-Württemberg
THE COMMISSIONER FOR DATA PROTECTION AND FREEDOM OF INFORMATION
LfDI Baden-Württemberg · P.O. Box 10 29 32 · D-70025 Stuttgart
File No. R 1257/35
Complaint of , R 1257/35
Dear Madam or Sir,
Having examined the facts of the case we get back to you regarding the complaint under the above-mentioned Ref. no.
### I. The course of the procedure
The Baden-Wuerttemberg DPA (hereinafter: BW DPA) launched an investigation based on the complaint of (hereinafter: the Complainant) pursuant to Article 57(1)(f) of the General Data Protection Regulation (hereinafter: GDPR).
In July 2019, the Complainant lodged a complaint with the Data Protection Authority of DE/Hesse, in which he presented that he had been traveling with a tour group and that the first hotel in Riga ( ) did not ask for an individual entry in a registration form, but this had to be entered with all personal data (including date of birth and passport number) in a collective form. This allowed all travelers to see the data of all the other guests. The tour guide said that this was common practice. However, such registration forms were not used for the other overnight stays.
The DPA DE/Hesse submitted the complaint to our DPA (DE/BW), after the Latvian DPA stated that the controller as per Article 4(7) GDPR regarding such processing would not be the hotel group ( ), but the tour agency, being the distributor of the tourist declaration list. The tour agency is DE/BW.
1
On 5 November 2020, the DE/BW DPA initiated a procedure to establish the lead supervisory authority in accordance with Article 56 of the GDPR (IMI no. 161583), as the Latvian DPA was assumed to be in fact the lead supervisory authority. This was according to the statements of the tour agency from 24 July 2020 that the hotels are in charge of the tourist lists themselves, in particular to meet local legal requirements of the hotel [for details we refer to the response letter from [redacted] in IMI]. The Latvian DPA however refused to handle the case as LSA, following the contrary statements of [redacted] that the tour agency is the controller.
After some discussions on that matter, the DE/BW DPA agreed to handle the case as LSA and created a case register in IMI (no. 179802).
In IC 398883, our intended draft decision has been shared with the CSAs to collect their views on it, before submitting it formally.
As we did not receive any comments in the IC from the CSAs, we presented the draft decision to the CSAs as per Article 60(3) GDPR (IMI no. 430639). This procedure has been closed without a reasoned and relevant objection or other comments from the CSAs.
## II. Facts of the case
The complainant states that during a vacation with a tour group, in the first hotel in Riga ([redacted]), he was asked to enter his personal data, such as date of birth and passport number, in a list on a registration form. The hotel did not ask for an individual entry in a registration form, but this had to be entered with all personal data (including date of birth and passport number) in a collective list. This allowed all subsequent travellers to see the data of all the other guests. The tour guide said that this was common practice. However, such registration forms were not used for the other overnight stays.
On 17 June 2020, the DE/BW DPA contacted [redacted] in order to ask them for a response to the facts the complainant presented. [redacted] replied to our DPA not to have an oversight and influence on the data processing in this context, as employees of the hotel would carry out the data processing independently.
In addition, [redacted] stated to our DPA that they have completely ceased its activities as a tour agency as of October 31, 2020.
## III. The findings of the Authority
Considering [redacted] to be the controller in regards to the relevant data processing, as their influence on the purposes and means of the processing (Art. 4(7) GDPR) can not be ruled out, the
2
DE/BW DPA reiterates that data must be stored in such a way that unauthorized persons - including other guests - cannot access the data of the individual registered guests. The completed paper forms, for example, must therefore not be left lying around openly on the counter and should be kept securely locked away at the end of the working day. It must also be prevented that other guests see the data of the pre-registered persons from the group.
Making the data of pre-registered persons from the tourist group available and visible to the subsequent guests by using a collective registration list **constitutes a violation** of the important principle of integrity and confidentiality as defined in Art. 5 GDPR. According to Art. 5(1)(f) GDPR, personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (Art. 32 GDPR). According to Art. 5(2) GDPR, the controller shall be responsible for, and be able to demonstrate compliance with, the conditions set out in Art. 5(1).
Therefore, travel agencies have to use themselves and/or to instruct their respective travel partners, e.g. hotels, to use individual forms or even electronic recording to make sure that the data processing takes place in line with Art. 5(1)(f) GDPR.
#### IV. Legal consequences
The DE/BW DPA establishes that [REDACTED] **breached Article 5(1)(f) in conjunction with Art. 32 GDPR as well as Art. 5(2) GDPR.**
Hence, the DE/BW DPA issues a **reprimand** to the company for the abovementioned infringements of the GDPR, based on **Article 58(2)(b) GDPR.**
The DE/BW DPA will also reiterate to the company again the fact that data processing relating to travel guests must be carried out in a way that respects the integrity and confidentiality of the guests' data and that the controller must implement measures and processes to comply with that provision, as stated above.
Due to the constellation that [REDACTED] has assured to the DE/BW DPA that it has ceased to operate as a tour agency as of October 31, 2020, the DE/BW DPA desists from making use of further corrective powers and hereby close the procedure. The DE/BW DPA also informed the complainant about these facts and did not receive an objection or other response to that from him.
3
## V. Information on legal remedies
An appeal against this decision may be filed in writing, electronically or for recording with the Administrative Court of Stuttgart, Augustenstraße 5, 70178 Stuttgart, within one month of notification pursuant to Article 78 of the General Data Protection Regulation in conjunction with Section 20(1) and (3) of the Federal Data Protection Act.
4