Lithuanian State Data Protection Inspectorate Investigates the Implementation of Data Minimisation Principle by the Hotels

DPA has established that hotels were processing not only the obligatory personal data provided for them by the laws (such as name, surname, citizenship, place of their residence, etc.) but also the additional data such as telephone number and e-mail address for the provision of information for their guests regarding their reservation,  number and validity term of credit card for the security of payment, vehicle registration number for the provision of parking service. DPA in its findings announced that the processing of these additional to the obligatory personal data does not infringe the principle of data minimisation, as the collection and processing of certain additional personal data was reasoned by certain necessary purpose for which they were processed.

DPA has also announced that two hotels have not implemented the principle of data minimisation, as they were collecting and further processing the birth place of their guests and they could not justify the purpose for such processing.

Furthermore four hotels have violated their duty to maintain the records of processing activities foreseen for them in Art. 30 of GDPR.  DPA stated, that due to the fact that the main hotels activity is the provision of accommodation service and the provision of this service is not possible without processing of hotels guests personal data, it can be concluded, that the processing of hotels guests data is the regular hotels activity and therefore hotels are obligated to maintain the records of processing activities as stated in Art. 30 of GDPR.