Scanning or photographing guests' identity documents is illegal: after reporting to the "Alloggiati Web" portal, the data must be immediately deleted. Here are the Authority's operational guidelines.
The Italian Data Protection Authority (Garante per la protezione dei dati personali) has sent an official notice to tourism and hospitality trade associations, highlighting an increasingly widespread—and non-compliant—practice among hotels, B&Bs, and guesthouses: keeping copies (photocopies or digital photos) of guests' identity documents.
Legal obligation vs. data protection
Topics index
Current legislation requires accommodation facility managers to identify their customers and transmit the data to public security authorities via the “Alloggiati Web” electronic portal.
However, the Guarantor clarifies a fundamental point: this obligation does not justify the retention of photocopies or scans of documents . Once the communication has been made, the data processing for this purpose is considered concluded.
Any copy taken (whether a paper photocopy or a photo taken with a smartphone) must be immediately destroyed or deleted.
The risks of uncontrolled digitalization
The Authority expressed particular concern about the trend, especially seen in businesses such as B&Bs and guest houses, of requiring documents to be sent via instant messaging applications such as WhatsApp.
This collection method exposes tourists to very serious risks, including:
Identity theft: Sensitive data becomes vulnerable if the device is lost or accessed unauthorizedly.
Data Breach: Prolonged and insecure storage of document images exponentially increases the attack surface for potential breaches.
What should hoteliers preserve, then?
If copies of documents are deleted, what remains in the facility's archives? The only document that facilities are required to retain is the receipt of the communication , automatically generated by the "Alloggiati Web" portal.
This certificate must be kept for five years, a period necessary to demonstrate compliance in the event of inspections.
Responsibility and Data Breach
The Guarantor reminds that owners of accommodation facilities are primarily responsible for data security. It is the management's duty to:
Adopt appropriate technical and organizational measures to protect the information processed.
Train the staff responsible for collection to ensure that procedures respect privacy from the first contact with the guest.
It is important to keep in mind that, in the event of a data breach , the organization is required to notify the Guarantor of the event within 72 hours and, in the most serious cases, to directly inform the interested parties.
With millions of tourists staying in Italy every year, the hospitality sector handles a huge amount of sensitive data.
The Guarantor's invitation is addressed directly to trade associations: the goal is to promote a culture of privacy that is not simply a bureaucratic requirement, but a sign of professionalism and respect for guests.
📌 It's time to review your property's check-in processes. Ensure your staff is informed and that images of documents aren't stored on company or personal devices. Data protection is an integral part of quality hospitality.
To learn more about the Authority's provisions, please consult the official press release available on the Privacy Guarantor's website.
Don't miss any updates on the regulations and latest trends in the hospitality sector, subscribe to the newsletter newsletter of Direzione Hotel and always stay one step ahead.
