News

❌ No ID documents via WhatsApp or Email

When a rental company requests ID documents via WhatsApp — including that of a minor!

Source: PS 00175-2023
Spain, AEPD

After confirming a booking for an apartment, an individual received a message asking to send front and back photos of ID documents for all guests, via WhatsApp or email, as a condition for accessing the accommodation.

The customer refused, preferring to present the documents in person.
The host then denied access to the apartment.

🔐 A Spanish short-term rental company was fined €2,000 for requiring guests to send front/back photos of ID cards via WhatsApp or email before arrival, under threat of cancellation of their paid booking.

❌ Why is this problematic?

➡️ There is no legal obligation to send full copies of ID documents.
Only specific information (name, ID number, etc.) must be entered manually into a secure registry for submission to the Guardia Civil.

➡️ The GDPR prohibits excessive data collection.
Even for legitimate purposes, the means used must be proportionate and respect the data minimization principle (Article 5.1.c GDPR).

📎 Important:

An identity document contains unnecessary sensitive data for this purpose (photo, signature, parents’ names, issue number, etc.).
🛑 Sending such documents via messaging apps or email is neither secure nor justified in this context.

📣 Key takeaways:

✔️ Only collect the minimum necessary to fulfill legal obligations.
✔️ Clearly inform clients about the data being processed and the reasons why.
✔️ Never make a service conditional on excessive data collection.