Hacker News new | ask | show | jobs
by aand16 28 days ago
I can talk about Italy because I've researched it.

The first step should be to show them the Privacy Authority press release[1] - "No to preservation of guest ID copies".

You should be prepared to be refused check-in if they're stubborn and feel like you "cause problems". The protection you have is that public service (hotel) is forbidden to refuse service by law[2][3], fine is €516 up to €3098. If it happens you should call police to verbalise and apply the fine. Refusal by police (Rifiuto di atti d'ufficio) is criminal offence and punishable with imprisonment 6mo - 2yr [4].

You should present ID to allow identification. The host must insert, by law at most 24hrs after check-in [5], client data into police portal, like name, DOB, nationality etc.

Everything else is extra and by GDPR you should be informed of any data processing, basis of processing, duration of processing, and your rights.

You can write Garante della Privacy to signal violations of GDPR if you feel it's warranted. I know they're happy to investigate and apply big fines to larger companies, not sure about how they handle smaller companies, like hotels.

1 - https://www.garanteprivacy.it/home/docweb/-/docweb-display/d...

2 -

4 - Italian penal code Art. 328 Refusal of office acts https://www.brocardi.it/codice-penale/libro-secondo/titolo-i...

5- Art. 109 TULPS - Identification of guests https://www.brocardi.it/testo-unico-pubblica-sicurezza/titol...

2 comments

[2] - Art. 187 of Regulation of execution of TULPS (public security law) - Public service [hotel,restaurant,bar] owners may not, without a legitimate reason, refuse to provide the services of their business to anyone who requests them and pays the price. https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:regio.d...

[3] - analysis by a police association of the Refusal of Service https://accademiapolizialocale.wordpress.com/wp-content/uplo...

> The host must insert, by law at check-in time and not later(!), client data into police portal, like name, DOB, nationality etc.

> Everything else is extra and by GDPR you should be informed of any data processing, basis of processing, duration of processing, and your rights.

It's basically common sense yet they still insist they have to copy the document "for the police". Almost as if they are specifically sourcing these copies for someone.