9

This is my first visit in the UK. I'm from UE.

A receptionist in a hostel I am staying took a picture of my passport (of the page with my picture and all my personal data).

I understand that the hostel is required by law to store my personal information (name, personal identification number, passport number). However, I am not sure how safe it is for them to keep a copy of my passport.

Here are my questions:

  1. How do I mitigate the security risk right now? I've already asked them to delete the picture of the employee's phone.
  2. Do they have the right to ask me for a picture of my passport? Wouldn't it have been enough if they entered all the necessary data into their system?
  3. How secure is it to let a hotel have a copy of my passport?
user2738748
  • 191
  • 1
  • 2
  • 4
    It is common in all Europe (and in other continents). Why do you think it is not secure? Nobody could use a copy to damage you. -- I'm much more worried about airline websites, which really leak data. – Giacomo Catenazzi Oct 10 '19 at 18:55
  • 5
    @GiacomoCatanazzi In Germany a Hotel can be fined up to 30.000 € for misuse of § 18 Abs. 2 Nr. 5a und 5b Passport law. A copy can only be made with explicit permission of holder and then only be used to copy any needed data afterwhich the copy must be destroyed. Without permission they must copy the data manually. A demand that a passport be 'deposited' can only be made by a governmental authority, since it is the property of the government that issued it. So your claim that it is common in Europe... is false. – Mark Johnson Oct 10 '19 at 20:07
  • 1
    There are many things to consider here. But was this picture stored on a PERSONAL mobile device? No way that's within legal rights. Many other things but as an example the Dutch passport shows your national ID number. That ID is not to be shared in this way (they will move it to the back side). In any case your passport is (very likely) property of the issuing country, it's not even YOUR property. So you're not allowed to give it to someone else, unless local laws tell you to do so. – Paul Palmpje Oct 10 '19 at 20:23
  • 2
    @MarkJohnson , that's the theory - in practice, people leave their passport with them over night, or at least for some time, because they don't want to wait while the guy writes down the required info. Of course, if you insist, they will follow the law, and you'll stand there and wait ten minutes, while they misspell your name and passport number five times. How often do you stay in hotels in Europe? – Aganju Oct 10 '19 at 21:00
  • @Aganju Different countries different laws. In Germany you fill out the registration form, which the hotel will copy over to their registration book and the form is sent on. Hotels are not permitted to retain the passport passport and can be fined. – Mark Johnson Oct 10 '19 at 21:12
  • 1
    Related: What harm can be done with a copy of one's passport? – Nate Eldredge Oct 10 '19 at 23:26

2 Answers2

10

I'm not qualified to answer point 1), but as far as I'm aware, the legal side of this is still the Immigration (Hotel Records) Order 1972 which requires lodgings keepers to record the names and nationalities of their adult (over 16) guests and for "aliens" (which for a couple more weeks means non-EU citizens)

Every such person who is an alien shall also—

(a)on arriving at the premises, inform the keeper of the premises of the number and place of issue of his passport, certificate of registration or other document establishing his identity and nationality; and (b)on or before his departure from the premises, inform the keeper of the premises of his next destination and, if it is known to him, his full address there.

As such they have no legal duty to copy your passport, but I suspect you also don't have a legal right to a bed there without going through the hostel's procedures. Similarly not that much on the average passport is usefully secret, given the number of places it gets taken during travel.

Having said all that, if you wanted to start a legal fight, the first point of reference is probably the GDPR, since they are probably not keeping your data strictly as they ought to.

Community
  • 1
origimbo
  • 2,940
  • 1
  • 12
  • 14
  • "They are probably not keeping your data strictly as they ought to." How do you know that? If OP wants to start an (expensive) legal fight, would need some proof of that accusation. The hotel may find it easier to just photograph the passport than laboriously copy the details by hand. If a business is storing electronic information, they are required to abide by the GDPR rules about electronic storage. – Weather Vane Oct 10 '19 at 19:04
  • I think passport copy is just to make thing quicker. GDPR do not apply for other law prescription. Hotels handle credit cards, so there is also a certified safe way to store information. -- In any case, in a hostel you may not find the more knowledgeable people (especially out of main office time). – Giacomo Catenazzi Oct 10 '19 at 19:05
  • If the hostel's procedure is illegal, then it cannot be a condition for a contract. The hostel could loose it license for continuous illegal behaviour. They are not above the law. – Mark Johnson Oct 10 '19 at 20:15
  • 1
    The person must inform the keeper of specific data listed which must be stored for 12 months. The person is not required to 'inform the keeper' of other data (such as date of birth) contained on a passport page. And certainly not on a employee phone. – Mark Johnson Oct 10 '19 at 20:27
  • Anyone should be qualified to answer point 1. That picture should not be on a personal phone. Read your passport. The passport is property of your country, you are only the bearer of this document. – Paul Palmpje Oct 10 '19 at 20:32
  • @MarkJohnson I've realised my first use of "right" above, was misleading if not outright wrong and have updated the language. I don't think copying the personal information page with the holders permission is illegal in the UK, but I don't think it's an obligation on the hotel either. – origimbo Oct 10 '19 at 21:22
  • In the UK they are probably required to retain a visitor's book with these entries and show upon demand. Section 5 and every record shall at all times be open to inspection by any constable or by any person authorised by the Secretary of State. – Mark Johnson Oct 10 '19 at 21:28
  • 2
    @WeatherVane IT professional here: A passport picture on a phone is not OK by GDPR standards. First it contains more data then needed (picture, personal id number, etc), second it is not secure. – Ivana Oct 21 '19 at 08:33
6

This happens very often unfortunately. It is easier for the hotel to process your information in this way and after all they are in the hospitality business, not the information security business.

  1. One thing you can do when they make a paper copy is ask to cross out the info they dont need like you personal id number, picture, height, etc and write the name of the recipient (hotel) all over the copy. The Dutch govenment has an app that does exactely this, for when companies ask a person for a copy of their document. Maybe something like this is also available to you. Then you could just send them a secure passport copy.
  2. They must have your data but they certainly do not have the right to take a picture of your passport and to handle it in such a insecure way by storing a copy on a personal device. At the very least they are not complying with GDPR because they took too much information and they are not handling it securely. However, when you need a place to sleep, you cannot postpone this until you win some expensive legal fight, so the can get away with it. This is also my own experience.
  3. I don't know if any cases of identity-theft have been traced back to copies of documents held by hotels but it is always a risk.

The Dutch privacy authority (my poor translation) states that in the Netherlands hotels and B&B's may not copy ID-documents but they are legally required to check your id and record your name and address, type of id, arrival and departure date. In other European countries there may be further requirements.

Ivana
  • 686
  • 6
  • 10