Brussels opens a case against Spain over traveler registration: you still have to report to SES.Hospedajes
On 4 June 2026 the European Commission opened an infringement procedure against Spain, case INFR(2026)4005, targeting the traveler registration system of Royal Decree 933/2021: the same rule that obliges you to submit a traveler report to SES.Hospedajes every time a guest checks in. Brussels believes the system clashes with EU data-protection law.
Since then, headlines have done their thing: “Brussels strikes down Spain’s traveler registry”, “Spain freezes the rules”. And with them came the question thousands of owners and property managers are asking right now: do I still have to register travelers and submit the reports?
The short answer is yes. An EU infringement case does not suspend any national law. In this article you’ll see exactly what happened, where the procedure stands today, what may happen next and, above all, what it means (and does not mean) for your property.
What exactly happened: case INFR(2026)4005
As part of its June 2026 monthly package of decisions, the European Commission sent Spain a letter of formal notice, the first formal step of an infringement procedure. The case was registered as INFR(2026)4005 and takes direct aim at the traveler registration system created by Royal Decree 933/2021.
That system requires hotels, holiday rentals, campsites, travel agencies and car rental companies to collect dozens of data points on every customer and send them to a state database (SES.Hospedajes) that Spanish law enforcement can access.
One important nuance: the Commission is not invoking the GDPR but Directive (EU) 2016/680, the EU rule governing the processing of personal data for police and criminal-law purposes. In other words, the problem is not that you register your guests; it is how the Spanish state designed the collection, access and retention of that data.
Why Brussels is challenging the traveler registry
According to what has been published, the letter of formal notice raises three main objections:
1. Excessive data collection
RD 933/2021 demands categories of data that Brussels considers disproportionate for a public-security purpose: among them, payment data (card, IBAN, cardholder) and location data. The data-minimisation principle requires collecting only what is strictly necessary, and the mass, indiscriminate collection of data on every traveler, suspect or not, sits poorly with that principle.
2. Loosely defined police access
The centralised database is accessible to police authorities in a way that, in the Commission’s view, is not sufficiently constrained: who accesses it, for what purpose and under which controls.
3. Three-year retention
The decree requires the data to be kept (and requires you, as the accommodation operator, to keep your records) for three years. Brussels considers that period, applied across the board to millions of travelers, potentially disproportionate.
The key point: you still have to report to SES.Hospedajes
Yes, exactly as before the case was opened. This is the part many headlines leave out:
- An infringement procedure is a formal dialogue between the Commission and the member state. It does not annul, repeal or suspend national law. Only a Spanish legislative change or a court ruling can do that.
- RD 933/2021 has been fully in force since 2 December 2024: documentary registration of every traveler, submission of the report to SES.Hospedajes and retention of the records for 3 years.
- The penalty regime remains active. Failing to register and report can bring fines of up to 30,000 euros in serious cases.
- The only thing that has been paused is the draft ministerial order that the Interior Ministry was preparing (the one that worried travel agencies most): the ministry froze it until the case is resolved. That order never entered into force, so freezing it changes nothing for accommodations.
Where the procedure stands (August 2026)
Spain was given two months to reply to the letter of formal notice, a deadline expiring in early August 2026; in other words, we are at the decisive moment right now. At publication time, neither Spain’s reply nor any follow-up decision by the Commission has been made public.
This is how an infringement procedure unfolds, stage by stage:
| Stage | What it is | Status |
|---|---|---|
| 1. Letter of formal notice | The Commission sets out the breaches and asks for explanations | Sent on 4 June 2026 |
| 2. Member state reply | Spain responds within 2 months | Expires in early August 2026; nothing public yet |
| 3. Reasoned opinion | If unconvinced, the Commission formally demands changes | Has not happened (so far) |
| 4. Referral to the CJEU | If Spain does not comply, the case goes to the EU Court of Justice | Could take years |
At any stage the case can simply be closed: Spain only needs to convince the Commission or amend the rules to fix what is being challenged.
Don’t mix them up: three separate battles over Spanish lodging rules
Several disputes around Spain’s tourist-accommodation rules are open in 2026, and the press constantly blends them together. Keep them apart:
- This case (INFR(2026)4005) attacks the traveler report under RD 933/2021, on data-protection grounds. It is the one touching your day-to-day duty to report guests to SES.Hospedajes; and for now it does not change it.
- The TRIS complaint about RD 1312/2024 challenges the double registration burden on holiday rentals (regional registry plus state registry). It is about licences and registration numbers, not the traveler report.
- Supreme Court ruling STS 620/2026 annulled the NRUA, the single rental registry. It does not touch the traveler report either: read the full analysis in the Supreme Court annuls the NRUA.
Three battles, three different rules, three possible outcomes. As of today, none of them has suspended your obligation to register travelers.
What could happen next
Realistic scenarios, from most to least likely in the short term:
- Spain replies and negotiates: the government defends the system or proposes adjustments (fewer data points, shorter retention, tighter police access). This is the usual path: the vast majority of infringement cases are settled without ever reaching court.
- The Commission asks for more: if the reply falls short, a reasoned opinion will follow, with formal demands and a new deadline.
- The case reaches the CJEU: the slow route; think years, during which the rules keep applying unless Spain amends them.
- A reform of RD 933/2021: the most plausible medium-term outcome is an amended decree with trimmed data and deadlines. If that happens, the duty to register and report would most likely survive with a lighter form, not disappear.
Notice the pattern: in no reasonable scenario does traveler registration vanish overnight. What is at stake is how much data is collected and how it is safeguarded, not whether the obligation exists.
What you should do in the meantime
- Keep submitting your reports to SES.Hospedajes as usual, within the deadline. The obligation is intact and inspections have not stopped.
- Be wary of headlines: every milestone in the case will trigger a new wave of “you no longer need to register”. It already happened with the NRUA and ended in confusion (and very real exposure to fines).
- Take care of your guests’ data: the case is a timely reminder that you are holding sensitive data. Keep records encrypted, restrict access and retain nothing longer than required.
- Automate the process: if the report is generated and submitted automatically from the guest’s online check-in, whatever regulatory changes come next (more fields, fewer fields, new formats) get absorbed without reworking your operations.
- And if you run a holiday rental, make sure the rest of your registration duties are in order: here is how to check your tourist registration code.
Frequently asked questions
Does the Brussels case suspend traveler registration in Spain? No. A letter of formal notice opens a formal dialogue between the Commission and Spain; it does not annul or suspend RD 933/2021. The obligation to register travelers and submit reports to SES.Hospedajes remains fully in force.
Can I be fined while the procedure is ongoing? Yes. The penalty regime remains active and fines for non-compliance can reach 30,000 euros. There is no general moratorium on penalties for accommodations.
What did the Spanish Interior Ministry actually freeze? Only the draft ministerial order implementing RD 933/2021 that was being prepared, a text that mostly worried travel agencies. It never entered into force, so freezing it changes nothing about accommodations’ current obligations.
Is this the same as the Supreme Court annulling the NRUA? No. Ruling STS 620/2026 annulled the single rental registry (NRUA), which is a registry of properties. The Brussels case targets the traveler report, which is the submission of guest data. Different rules, different procedures.
What if the Commission ultimately wins the case? The most likely outcome would be a reform of RD 933/2021: fewer data points per traveler, shorter retention periods or tighter access controls. Some form of registration and reporting duty would almost certainly remain; it exists in most European countries.