Ahh so that's what they mean at the reception when they take photo of my ID and say "it's for the police". So that any police anywhere can freely download it at any time!
While visiting Italy I've had the hotel photocopy my ID. I've researched and the legal requirement for the hotel is to fill a form on the police website, nothing more. While doing the checkout I've pressed them on the reason for keeping the photocopy ("is it for identity theft? "), the duration they were going to keep the copy etc. Basic info they were bound to disclose because of GDPR _before_ the data processing, which of course never happened.
Turns out the local policemen asked verbally to make photocopies, just in case... The hotel is more afraid of the local police than of it's clients, so they just do it.
Since I was the only client who ever asked about it, and gaslighting me wasn't going to work ("everybody does it! what do you have to hide?"), they just gave me the copy to destroy.
Other places copy IDs because they're lazy and don't want to compile the required form on the spot. Not to mention ID photocopies floating around the reception desk in plain sight...
> Turns out the local policemen asked verbally to make photocopies, just in case... The hotel is more afraid of the local police than of it's clients, so they just do it.
In Italy occasionally they find mafia members hiding for years in... their home regions or even villages. They absolutely keep it "just in case" and I would trust their local police /s.
To be able to push back you should know the law requirements for hotels in that jurisdiction, so they can't gaslighting you with fake "it's for police" reasons.
I can talk about Italy because I've researched it.
The first step should be to show them the Privacy Authority press release[1] - "No to preservation of guest ID copies".
You should be prepared to be refused check-in if they're stubborn and feel like you "cause problems". The protection you have is that public service (hotel) is forbidden to refuse service by law[2][3], fine is €516 up to €3098.
If it happens you should call police to verbalise and apply the fine. Refusal by police (Rifiuto di atti d'ufficio) is criminal offence and punishable with imprisonment 6mo - 2yr [4].
You should present ID to allow identification. The host must insert, by law at most 24hrs after check-in [5], client data into police portal, like name, DOB, nationality etc.
Everything else is extra and by GDPR you should be informed of any data processing, basis of processing, duration of processing, and your rights.
You can write Garante della Privacy to signal violations of GDPR if you feel it's warranted. I know they're happy to investigate and apply big fines to larger companies, not sure about how they handle smaller companies, like hotels.
[2] - Art. 187 of Regulation of execution of TULPS (public security law) - Public service [hotel,restaurant,bar] owners may not, without a legitimate reason, refuse to provide the services of their business to anyone who requests them and pays the price.https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:regio.d...
> The host must insert, by law at check-in time and not later(!), client data into police portal, like name, DOB, nationality etc.
> Everything else is extra and by GDPR you should be informed of any data processing, basis of processing, duration of processing, and your rights.
It's basically common sense yet they still insist they have to copy the document "for the police". Almost as if they are specifically sourcing these copies for someone.
