Hotel publicly discloses a room number: erasure and remedies

When a hotel publishes a room number together with a guest’s name or stay period, this may involve processing personal data. The key question is whether the guest is identifiable in the specific context. Public reach makes the review of the legal basis and the necessary remedy particularly important.

This article concerns public disclosure by an accommodation business. It explains how a guest can request removal and how the business can review the publication, any consent and further copies in an orderly way. The room number must be assessed together with the name, period, photograph or other accompanying details.

A room number is initially an internal hotel reference. Combined with a guest’s name, stay period or visible booking information, it may reveal that a particular person stayed at the hotel. The context of the information determines the data protection assessment.

Posting the information on a website, social media or a review platform is a processing operation. The business discloses it to an undefined audience. Accurate information does not become publishable merely because it is correct.

A guest’s reasonable expectation during room allocation and the stay usually concerns the hotel and the service providers involved. Public disclosure therefore needs its own assessment. The internal purpose of organising the stay does not by itself explain publication on the internet.

Under Article 6 GDPR, processing is lawful only if at least one of the listed conditions applies. Depending on the facts, consent or a legitimate interest may be relevant to publication. The fact that a person is a hotel guest does not settle this question.

Contract performance is a suitable basis only where publication is necessary for the specific service. Using a room number for internal handling does not answer whether it may be placed in public view. For a legitimate interest, the hotel must weigh the purpose and necessity against the guest’s interests and fundamental rights.

Where publication relies on consent, Article 7 GDPR applies. The hotel must be able to demonstrate the consent. It must relate to the specific purpose and be given clearly enough for the guest to understand the public reach. General check-in information does not necessarily amount to that consent.

Article 17 GDPR lists several grounds for erasure. They include data that is no longer necessary, withdrawal of consent where no other legal basis exists and unlawful processing. A justified objection can also end further processing. The hotel must examine the specific ground and any countervailing reason.

If the room number was made public and an erasure duty applies, the controller must take reasonable measures in view of available technology. This can include informing other controllers about the request to erase links, copies or replications of the personal data.

The right to erasure is not unlimited. Article 17(3) GDPR includes freedom of expression and information, legal obligations and the establishment, exercise or defence of legal claims among the exceptions. A blanket promise is therefore as unreliable as a blanket refusal.

The guest should preserve the public page before it is removed. The record should include the complete URL, screenshot, visible details, date and time. The erasure request should identify the specific content and clearly ask for the public disclosure to stop.

The hotel should block or remove the public display without delay where no reliable legal basis is apparent. Documents needed for an internal review can be kept separately from the public display. The response should record receipt, the action taken and any remaining points in clear language.

If the information has already been republished, copies, search results and platforms should be recorded separately. Removing the original page does not automatically remove every copy. The parties should record which places were contacted and what happened.

For the guest, the booking confirmation, stay period, business name, room number and public source matter. Screenshots should show the complete visible context. For a platform publication, also preserve the profile, post, comments and the time of capture.

The hotel should document the source of the publication, its purpose, the legal basis used and any consent. Where consent is relied on, record how it was given and how it can be demonstrated. A general assumption that the guest expected publication is not a substitute for that record.

Both sides should keep the communication about removal in chronological order. This includes the erasure request, the hotel’s response, reports to platforms and notices about further copies. A clear timeline supports later assessment of erasure, objection and possible claims.

Receive new articles and legal information from the firm with BRANDaktuelle Rechtsnews. Subscribe to the newsletter.