Does personal data processing in registration cards have to be based on the data subject's consent under Article 6(1)(a) GDPR?

ANSWER

The obligation to register guests using registration cards was abolished on 31 December 2012. However, if an entity — the data controller — still uses this form for security purposes, it should be noted that when collecting personal data of natural persons there are two legal bases that may apply in this regard.

The first legal basis is Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject's request prior to entering into a contract. A registration card is a document confirming the conclusion of a contract for the provision of hotel services. Basing personal data processing on this legal basis will therefore be correct.

The second legal basis is Article 6(1)(a) GDPR: the data subject's consent.

Regardless of the choice of legal basis, the data controller is obliged to fulfil the information obligation under Article 13 GDPR towards the data subject. It would therefore also be appropriate to include the privacy notice on the card or on a separate document handed to the natural person when completing the card, i.e. when collecting personal data.