Hacker News Reader

Comment by kyoob | Hacker News Reader

Why do they even have that many passport numbers saved in any format? I get what a spy organization could do with that information. What does a hotel organization do with it?

View on HN

>I get what a spy organization could do with that information. What does a hotel organization do with it?...

Give it to the spy organization.

Not being snarky. That was meant as a serious comment. Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel?

At least within the EU, it is required that hotels record the passport numbers of people who stay with them for potential future law enforcement use. Most countries just require the data be kept on file at the hotel, but a few regularly collect it in some kind of central database.

And, especially with a big chain, I assume that any information they collect (especially if they're required to collect it) gets put in a centralized database rather than depending on a paper copy being properly filed in a file cabinet someplace.

Somewhat OT but I was in Europe last month on a business trip. There's a knock on the door one evening. Imagine my surprise in discovering it's someone from the hotel who has come up with a few edible goodies for my birthday. On the one hand, it was a nice gesture. On the other, I was a bit taken aback. Where did they get that info?

I didn't really want to ask but a friend of mine later reminded me that they probably got it off my passport. I suppose this might have just been an informal process at this particular hotel. But I wouldn't be shocked to learn it was put in the chain's database.

How does GDPR play into the requirement to store passport numbers?

It plays. The way these hotels are doing this maybe probably isn't GDPR compliant, but the same applies to vast amounts of other things.

Hard to share any very useful insights on this, it's just the state of most things.

Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like? Can hotels be fined if they’re found to not be GDPR compliant?

>Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like?

I'm not quite sure what you mean, but the answer is probably no.

>Can hotels be fined if they’re found to not be GDPR compliant?

Sure, but is anyone GDPR compliant yet? I'd imagine that all the DPAs in EU are extremely busy right now.

If there’s a legal requirement to store passport numbers you can store them. It’s one of the cases where you don’t need consent. You still have to store them in a safe fashion and the customer still retains most of the rights under GDPR (information about what you store and for which purpose, etc.)

All big chains will definitely keep track of your birthday if you're a member of their rewards program.

Do you have to provide it or do they get it from some other source? I'm pretty sure that I don't routinely give my birthday when I enroll in rewards programs.

Are you sure? I thought they would at least need a birthday to check on your age. They can't very well offer a contract to a minor.

Yes. I'm sure I can go online and make a hotel reservation in 5 minutes without providing my age or birthday. Now, I will usually have to provide a credit card number which typically would indicate I'm old enough to stay at a hotel. Although as noted elsewhere prepaid credit cards may be a work around. They may not let me check in if I show up and don't have an ID or my ID says I'm 14. But making the reservation would be straightforward.

It's a bit creepy but I'd assume they get it from your ID when you check in.

I don’t believe that’s a requirement in the UK or Finland (though my last hotel stays in each was via Booking.com and I guess it’s possible that was sent automatically from Booking.com records, I can’t remember what they asked me for when I signed up)

The main reason it's required in the EU is because it's so easy to cross land borders without leaving a trace.

In the UK, there's no need because it's an island, so passports can be more easily screened at the borders.

That implies it’s a Schengen Area rule?

This thread is full of the usual HN Europe-speculation. My speculation is that this isn't something the EU has legislated on, so it varies between countries.

In the UK, "The Immigration (Hotel Records) Order 1972" says:

> 4.—(1) Every person of or over the age of 16 years who stays at any premises to which this Order applies shall, on arriving at the premises, inform the keeper of the premises of his full name and nationality.

> (2) Every such person who is an alien shall also—

> (a)on arriving at the premises, inform the keeper of the premises of the number and place of issue of his passport, certificate of registration or other document establishing his identity and nationality; and

Thanks; that certainly explains why I’ve never noticed the passport requirement in UK hotels — being British.

I mean, most places I've stayed at take a photocopy of the passport, it's kept in case of any police enquiries.

> Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel?

Some countries (China and Russia spring to mind) require you to register your lodgings with the police, which the hotel do for you. It seems standard practice to hand over your passport at international hotels.

Israel sometimes has more nefarious reasons than tracking where foreign citizens are

https://www.gov.uk/foreign-travel-advice/israel/safety-and-s...

A Serious Organised Crime Agency investigation into the misuse of UK passports in the murder of Mahmud al-Mabhuh in Dubai in January 2010 found circumstantial evidence of Israeli involvement in the fraudulent use of British passports. This has raised the possibility that your passport details could be captured for improper uses while your passport is out of your control. The risk applies in particular to passports without biometric security features. Only hand your passport over to others (including Israeli officials) when absolutely necessary.

> Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel?

This is the case in most countries I've traveled to.

Passport numbers are the easiest and perhaps the only way for these hotels to uniquely identify and track their customers. A ton of jurisdictions also require hotels to store these.

So which hotels limit their storage to the legal requirements?

Do not stay in any hotels if you do not want your personal information collected and shared with various third parties.

Airbnb and similar tend to be vastly friendlier to privacy-conscious travelers, usually collecting less than legally required (they also do a very bad job of verifying what they do collect).

Well, with Airbnb, you're presumably registered on the site and have a credit card on file which is how you pay. In general (at least in the US), lower-end independent motels and the like will often be less rigorous about checking ID and will probably let you pay cash.

You can acquire a relatively anonymous prepaid card and use that to pay airbnb. Also, at least the last time I tried their ID verification thing didn't care about the name on the ID so you could just use any random ID from wikileaks to verify your account.

Yeah, in the US the hotel situation tends to be significantly better than in the EU.

Good point about prepaid cards. Like anything of this nature, a lot depends on who you're hiding from and why. It's one thing to thwart generic big corporation knowing where you've been and what you've bought. It's another to be hiding from someone who has some degree of access to your computer and financial accounts. It's still another to be actively hiding from individuals or entities with varying degrees of law enforcement authority and varying degrees of interest in tracking you down.

Privacy.com offers an easy way to spin up virtual cards. Keep in mind your bank (and cc processor, and/or the merchant) probably sells your transaction history, etc. to Google and other big data perverts.

These days European ones hopefully follow the GDPR at least.

> What does a hotel organization do with it?

It's a requirement for hotels to have passport numbers in many jurisdictions. Have you never used a hotel before?

Yes I have used a hotel before.

If you are in-country you can use an in-country ID instead--drivers license number most often.

I've never had a hotel ask for my passport when traveling in the US as an American for example. I'm sure they would take it if I offered, but my drivers license is considered sufficient.

It's a government requirement in many jurisdictions, including much of Asia and the EU.

Note that in the EU, at least, the data is not sent to the government authorities, but it must be available to them.

So do those jurisdictions provide passports for free (or very low cost) and/or make them easy to acquire?

In the US to get a passport isn't an arduous process, but it isn't easy nor cheap; when I got mine done (full thing - card and actual passport), I had to first get a passport photo taken and paid for (walgreens), then go to a local courthouse during a weekday (which I had to take off the time for), then pay a bunch of money (oh - and I had to give them my birth certificate and some other ID - which I got back when I received my passport weeks later) - then wait.

I think there were fingerprints involved too...

Anyhow - it wasn't an easy or cheap process, but I can understand why they make it that way. But for most people in the US, unless they travel internationally, they never obtain a passport, because of this process. It is only set up for people who can afford it (both in time and money).

So - if it is a requirement in other areas of the world, then receiving or obtaining a passport would have to be made easier for those who couldn't afford the time or money; time could be made by legislation making employers provide time for doing such a thing, and/or keeping courts or wherever to process the applications open on weekends or have later hours or something.

Of course - we are talking about "non-US" places, which seem to have far saner social policies under which this would fall...

At least in the EU/EEA, most countries have national ID cards, and you can travel with those instead.

Don't know about other EU countries but here everyone older than 15 years is required to have a passport or id card by law. The fee is ~1/4 of what it costs in US. You don't need to make a photo before as it can be taken during application. If you don't want to wait in queue it is possible to make an appointment by phone.

There's a lot of confused comments on this thread.

In my experience, hotels only need a passport or similar identification for non-citizens or non-residents — both would usually have a passport or equivalent to be in a foreign country.

(But to answer your question, for a first adult British passport one needs a digital photo, birth certificate, and a parent's passport number. Everything is done online[1].)

[1] https://www.gov.uk/apply-first-adult-passport

not defending, but plausible reasons:

form of identity.

concierge service to lookup status/book travel for guests.

Reply on news.ycombinator.com