Hacker News Reader

Comment by sethhochberg | Hacker News Reader

At least within the EU, it is required that hotels record the passport numbers of people who stay with them for potential future law enforcement use. Most countries just require the data be kept on file at the hotel, but a few regularly collect it in some kind of central database.

View on HN

And, especially with a big chain, I assume that any information they collect (especially if they're required to collect it) gets put in a centralized database rather than depending on a paper copy being properly filed in a file cabinet someplace.

Somewhat OT but I was in Europe last month on a business trip. There's a knock on the door one evening. Imagine my surprise in discovering it's someone from the hotel who has come up with a few edible goodies for my birthday. On the one hand, it was a nice gesture. On the other, I was a bit taken aback. Where did they get that info?

I didn't really want to ask but a friend of mine later reminded me that they probably got it off my passport. I suppose this might have just been an informal process at this particular hotel. But I wouldn't be shocked to learn it was put in the chain's database.

How does GDPR play into the requirement to store passport numbers?

It plays. The way these hotels are doing this maybe probably isn't GDPR compliant, but the same applies to vast amounts of other things.

Hard to share any very useful insights on this, it's just the state of most things.

Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like? Can hotels be fined if they’re found to not be GDPR compliant?

>Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like?

I'm not quite sure what you mean, but the answer is probably no.

>Can hotels be fined if they’re found to not be GDPR compliant?

Sure, but is anyone GDPR compliant yet? I'd imagine that all the DPAs in EU are extremely busy right now.

If there’s a legal requirement to store passport numbers you can store them. It’s one of the cases where you don’t need consent. You still have to store them in a safe fashion and the customer still retains most of the rights under GDPR (information about what you store and for which purpose, etc.)

All big chains will definitely keep track of your birthday if you're a member of their rewards program.

Do you have to provide it or do they get it from some other source? I'm pretty sure that I don't routinely give my birthday when I enroll in rewards programs.

Are you sure? I thought they would at least need a birthday to check on your age. They can't very well offer a contract to a minor.

Yes. I'm sure I can go online and make a hotel reservation in 5 minutes without providing my age or birthday. Now, I will usually have to provide a credit card number which typically would indicate I'm old enough to stay at a hotel. Although as noted elsewhere prepaid credit cards may be a work around. They may not let me check in if I show up and don't have an ID or my ID says I'm 14. But making the reservation would be straightforward.

It's a bit creepy but I'd assume they get it from your ID when you check in.

I don’t believe that’s a requirement in the UK or Finland (though my last hotel stays in each was via Booking.com and I guess it’s possible that was sent automatically from Booking.com records, I can’t remember what they asked me for when I signed up)

The main reason it's required in the EU is because it's so easy to cross land borders without leaving a trace.

In the UK, there's no need because it's an island, so passports can be more easily screened at the borders.

That implies it’s a Schengen Area rule?

This thread is full of the usual HN Europe-speculation. My speculation is that this isn't something the EU has legislated on, so it varies between countries.

In the UK, "The Immigration (Hotel Records) Order 1972" says:

> 4.—(1) Every person of or over the age of 16 years who stays at any premises to which this Order applies shall, on arriving at the premises, inform the keeper of the premises of his full name and nationality.

> (2) Every such person who is an alien shall also—

> (a)on arriving at the premises, inform the keeper of the premises of the number and place of issue of his passport, certificate of registration or other document establishing his identity and nationality; and

Thanks; that certainly explains why I’ve never noticed the passport requirement in UK hotels — being British.

Reply on news.ycombinator.com