Required data entry seemingly against GDPR

Question

From https://security.stackexchange.com/questions/186327/why-do-some-gdpr-emails-require-me-to-opt-out-and-some-to-opt-in :

As a consequence the "G29", the group of national data protection authorities in the EU, affirmed that if a user has no real choice, feels constrained, or will face negative consequences for refusing consent, then the consent given is not valid. The G29 therefore affirmed that GDPR guarantees that giving consent to processing personal data cannot be the counterpart of providing services.

Spanish law demands that anyone providing hospitality enter personal data into a database on every guest within 24 hours. Seems like we would have to start asking guests to sign a stupid consent form, and not let them stay if they don't. But that would violate what's quoted above. If we let them stay and don't enter their data, https://www.vacaciones-espana.es/rentalbuzz/policia-explica-el-proceso-de-identificacion-de-viajeros-en-vft says we are subject to huge penalties. If we enter their data without their consent, we AND the Guardia Civil are violating the law.

At least that's my untrained interpretation. What am I missing?

Answer 1

Consent for processing someone's personal data is only one of the possible requirements to process that person's personal data.

The options listed in Art. 6.1 are (text in Spanish, with links to other languages):

a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

b. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

c. processing is necessary for compliance with a legal obligation to which the controller is subject;

d. processing is necessary in order to protect the vital interests of the data subject or of another natural person;

e. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Obviously, your case meets the criteria for c.¹

So, you do not need consent from your hosts, and your hosts do not have to sign any consent and they cannot refuse to provide their data if they want to reside at your dwelling.

The moment you ask your hosts any data to which you do not have a legitimate interest, you need the consent. And you cannot refuse hospitality to your hosts if they do not want to provide that piece of data.

Anyway, maybe it would be a good idea to print a leaflet explaining why you require their data in case they have any doubts.

---

¹ For the Guardia Civil, it would be c. and maybe a few more cases.