The EU has challenged Spain's guest-data rules

The short answer, before anything else: the Commission has challenged aspects of the Spanish data regime. It has not cancelled SES.Hospedajes, and it has not given anyone permission to stop registering guests.

That distinction matters, because coverage of this has been loose. Spanish headlines along the lines of "Bruselas tumba el registro de viajeros" — Brussels strikes down the traveller register — circulated widely. It did nothing of the sort, and the Commission's own announcement says so if you read it: Spain is given two months to respond, and its existing requirements are described rather than suspended.

What actually happened

On 4 June 2026 the European Commission sent Spain a letter of formal notice, opening infringement case INFR(2026)4005.

A letter of formal notice is the first step of a long process. It is the Commission writing to a member state to say it believes EU law is being broken, and asking for an explanation. It is not a ruling, not a court judgment, and not a finding of any kind.

What the Commission is objecting to

Not the existence of a guest register. The Commission does not question that Spain may run one, nor its counter-terrorism and organised-crime purpose.

Its objection is that the regime does not comply with the Law Enforcement Directive — Directive (EU) 2016/680, which governs how police and criminal-justice authorities handle personal data.

In plain terms, three complaints:

1. Too much data — the categories collected are excessive, singling out payment data and GPS data.

2. Police access is not properly limited — not restricted to specific and explicit purposes. The concern is not only what is collected, but what can be done with it afterwards and on what grounds it can be reached.

3. Three years is too long — the retention period is considered disproportionate.

Not a GDPR case

Worth being precise about, because it is already being reported wrongly.

This is a Law Enforcement Directive case, not a GDPR one. The difference is not academic: the Directive governs processing by law-enforcement authorities, so the target is the Spanish state's database and who may reach into it — not the way you, as a host, handle your guests' details.

Your own data-protection duties are untouched by this and continue exactly as before.

Where the procedure has reached

Letter of formal notice   ← we are here (4 June 2026)
  ↓
Spain responds (two months)
  ↓
Commission assesses
  ↓
Possible reasoned opinion
  ↓
Possible referral to the Court of Justice
  ↓
Possible judgment

Spain's two months expired in early August 2026. Replies to a letter of formal notice are not published, so anyone telling you what Spain said is guessing.

The Commission's July 2026 infringement package contained no further step on Spain, so as things stand the case remains at the first stage. Procedures of this kind routinely take a year or more to move.

Even at the far end, a judgment of the Court of Justice under this procedure is declaratory. It does not strike down national law — the member state is then obliged to correct the breach itself.

So do you still have to register your guests?

Yes. Nothing has changed.

Do not confuse this with the rental registry ruling

Two separate things happened within weeks of each other in mid-2026, and they are being merged constantly:

One is an open question about data protection that changes nothing yet. The other actually cancelled a registry. See the NRA is gone, guest registration is not.

What we are watching

• Whether the Commission issues a reasoned opinion, the next formal step.
• Whether Spain amends the decree — the retention period and the payment-data fields being the obvious candidates.
• Whether the paused ministerial order reappears, and in what form.

This page carries a review date at the foot. If it has not moved in a while and you have seen news suggesting it should have, the free Facebook group is the fastest way to ask.