Background to the complaint

1. In January 2023, the complainant, a Spanish business federation, submitted an infringement complaint to the European Commission concerning the Spanish Royal Decree 933/2021 establishing the obligations for documentary record-keeping and the provision of information by natural or legal persons engaged in accommodation and motor vehicle rental activities (‘Royal Decree’)[1]. In particular, the complainant raised concerns about its conformity with Directive (EU) 2016/680 (Law Enforcement Directive, LED)[2], and the related Court of Justice of the European Union (CJEU) case-law, as well as with Directive 2000/31/EC (e-Commerce Directive).[3] The complainant argued that the Royal Decree creates a generalised, excessive and insufficiently justified system of customer’s personal data collection and transmission and restricts the free movement of information society services. The Commission registered the infringement complaint under reference number CHAP(2023)00133, subsequently replaced by CPLT(2023)00133.

2. In June 2023, the Commission replied to the complainant’s correspondence, informing the complainant that its assessment was ongoing. Following this, the complainant did not receive any update on the state of play of its complaint, despite sending reminders to the Commission.

3. In February 2025, dissatisfied with the situation, the complainant turned to the Ombudsman.

The inquiry

4. The Ombudsman opened an inquiry into the Commission’s failure to keep the complainant updated on the state of play of the infringement complaint.

5. In the course of the inquiry, the Ombudsman received a copy of the reply of the Commission to the complaint. The Ombudsman however considered that the Commission’s reply did not fully and adequately address the request for a reply and sent a second request for a reply, asking the Commission to provide the complainant with more detailed information on the status of the infringement complaint.

6. The Ombudsman received a copy of the Commission’s second reply, and subsequently, the comments of the complainant in response to that reply. The Ombudsman considered that the Commission provided detailed explanations regarding the first aspect of the complaint (the conformity of the Royal Decree with the Law Enforcement Directive). However, it did not provide the complainant with clear and meaningful information regarding the second aspect of the infringement complaint (the conformity of the Royal Decree with the e-Commerce Directive, which the Commission was assessing also in light of the Digital Services Act[4]).

7. In that context, the Ombudsman decided to pursue the inquiry to better understand the status of the infringement complaint, in particular as regards the second aspect of the complaint. The Ombudsman inquiry team inspected the Commission’s file on the case and subsequently, in April 2026, met with representatives of the Commission. The Ombudsman also received the complainant’s comments on the inspection and meeting reports.

8. Subsequently, the Commission informed the complainant of having issued a ‘letter of formal notice’[5] relevant to their complaint, in June 2026, due to Spain’s failure to comply with the Law Enforcement Directive.[6] It also informed the complainant of new developments regarding the second aspect of the infringement complaint. The Commission informed the Ombudsman that the letter of formal notice concerns only the first aspect of the complaint, while the assessment of the second aspect remains ongoing.

9. The Ombudsman’s decision takes into account all the information and the arguments that she received in the course of the inquiry.

Arguments presented to the Ombudsman

10. The complainant claimed that, more than one year after the registration of its infringement complaint, the Commission had failed to provide information on the status of the infringement complaint and to reply to its correspondence. The complainant argued that the lack of response was detrimental for the Spanish tourism sector.

11. The Commission explained that it had been assessing the complaint in relation to the allegations that the Royal Decree was not in conformity with (i) the Law Enforcement Directive and (ii) the e-Commerce Directive, also in light of the Digital Services Act.

12. As regards the first aspect, the Commission explained that the issue was complex and that the final date by when the Royal Decree would be fully applicable was confirmed only very late in the procedure, as it became fully applicable only in December 2024. Since then, the Commission engaged in an active dialogue with Spanish authorities, including through three meetings with them between February and March 2025.

13. The Commission explained that, in those meetings, it became apparent that the exact scope of certain obligations was not completely defined in the Royal Decree and would be further specified in a Ministerial Order, which the Spanish authorities were revising.

14. As regards the second aspect of the complaint, the Commission said that it was not yet in a position to draw conclusions on the existence of a breach of EU law. The Commission explained that it had decided to wait for the Ministerial Order to be adopted before deciding on this aspect. Moreover, the Commission also referred to preliminary ruling proceedings that were then pending before the Court of Justice on the interpretation of the coordinated field of the e-Commerce Directive and the limits on restrictions on the freedom to provide information system services.[7]

15. The Commission noted that it had held discussions with the Spanish authorities focused on the overall implementation of the Digital Services Act framework, not specifically in relation to the infringement complaint at issue, and that it did not hold records of those discussions.

16. During the inquiry, on 5 May 2026, the Commission held a meeting with the representatives of the Spanish authorities to discuss concerns relating to the e-Commerce Directive and the Spanish Royal Decree. Moreover, the Commission stated that following the adoption, in June 2026, of the Court’s judgement the Commission was waiting for,[8] it was in contact with the Spanish authorities, and committed to informing the complainant of any developments.

17. As regards communication with the complainant, the Commission said it regretted that it had not informed it more regularly of the status of the infringement complaint. It also expressed its willingness, in general, to keep complainants informed of their cases. The Commission however noted that, in this case, it had provided updates on its assessment by, for example, replying to parliamentary questions on the matter, which were submitted by Members of the European Parliament between 2023 and 2026.

18. The complainant in its comments stated that they remained dissatisfied with the lack of clarity of the Commission’s replies, as some aspects of the handling of the complaint remained unclear. The complainant also emphasised that it is important that the Commission properly records infringement-related documents and exchanges.

The Ombudsman's assessment

19. The Commission enjoys wide discretion when dealing with infringement complaints.[9] The Ombudsman’s role in this area thus concerns the administrative and procedural handling of infringement complaints by the Commission, including the time taken and reasons given for any delays.

20. In its Communication ‘EU law: Better results through better application’[10], the Commission has set out an indicative time limit of one year from the registration of an infringement complaint to decide whether to issue a letter of formal notice to the Member State concerned or to close the case. Where this time limit is exceeded, the Commission has committed to inform complainants in writing. The Ombudsman has accepted that the Communication does not lay down an absolute requirement for the Commission to take a decision within one year. However, when the one-year time limit is exceeded, the principles of good administration require the Commission to provide specific and valid reasons for the time needed to deal with the case.[11] Otherwise, this may constitute maladministration.[12]

As regards how the Commission handled the infringement complaint

21. The Ombudsman’s inquiry showed that, after the infringement complaint was registered, there was more than one year where no activity appeared to take place, that is, where the Commission was not in contact with the Spanish authorities. However, once the Royal Decree became fully applicable in December 2024, the Commission was active on the case and regularly exchanged with the Spanish authorities, particularly regarding the data protection aspect of the infringement complaint.

22. The Ombudsman notes that, on 4 June 2026, the Commission sent a letter of formal notice to Spain regarding the conformity of the Royal Decree with the Law Enforcement Directive, calling on Spain to ensure compliance with EU data protection rules on the data collection of travellers.[13] In light of the above, the Ombudsman considers that the Commission has made significant progress on this aspect.

23. Regarding the second aspect of the infringement complaint (the conformity of the Royal Decree with the e-Commerce Directive), the Commission’s inspection file shows that, once the Royal Decree entered into application, the Commission assessed also this aspect of the complaint. The Ombudsman considers that the Commission provided reasonable explanations to justify the time taken before deciding on its next steps, specifically, that it was awaiting relevant preliminary references then pending before the CJEU, and the adoption of the implementing Ministerial Order.

24. The fact that the Commission is actively dealing with the matter is further supported by the fact that, in the course of this inquiry, the Commission held a meeting with the representatives of the Spanish authorities to discuss concerns relating to the e-Commerce Directive and the Spanish Royal Decree.

25. Now that the Court has adopted the judgement the Commission was waiting for, the Ombudsman trusts that the Commission will be in a position to take a decision on whether to initiate infringement proceedings on this aspect of the complaint in the near future.

26. In view of the above, the Ombudsman considers that the Commission has, since December 2024, acted progressively and reasonably on the matter.

27. As regards the complainant’s concerns about the Commission’s document management, the Ombudsman notes that, as a matter of good administration, EU institutions should keep adequate records of administrative procedures. In this case, the Ombudsman considers that the Commission’s infringement file contained sufficient information on the steps taken by the Commission regarding this case.

28. In light of the above, no further inquiries into this aspect of the case are justified.

As regards the Commission’s failure to keep the complainant updated on the state of play of the infringement complaint

29. The Ombudsman finds it regrettable that it took approximately two years for the Commission to inform the complainant about the state of play of its infringement complaint, and that its first two replies to the Ombudsman’s requests for a reply were not sufficiently informative.

30. However, in the course of the meeting with the Ombudsman inquiry team, the Commission representatives have provided detailed explanations concerning the time taken to handle the infringement complaint and its status.

31. The Ombudsman welcomes the Commission’s commitment to keeping complainants informed on the status of their infringement complaints. The Ombudsman also welcomes the Commission’s willingness to keep the complainant in this case informed about the developments as regards the second aspect of its complaint and trusts that the Commission will do so.

32. The Ombudsman notes, however, that the Commission’s replies to parliamentary questions from Members of the European Parliament cannot be considered as sufficient to keep complainants informed about their infringement complaints. Those replies are provided in a different procedural context, external to the framework for handling infringement complaints.

33. In light of the above, no further inquiries into this aspect of the case are justified either.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

As the Commission has taken action on the case and has now provided reasonable explanations for the time it took to deal with the infringement complaint, no further inquiries are justified.

The complainant and the Commission will be informed of this decision.

Teresa Anjinho
European Ombudsman

Strasbourg, 02/10/2026

 

[1] Available at: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2021-17461

[2] Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016L0680-20160504

[3]  Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce), available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02000L0031-20240217

[4] Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act), available at: https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng

[5] The letter of formal notice is the first formal step in an infringement procedure, to which the Member State concerned must send a detailed reply, normally within two months. More details on EU infringement procedures can be found on the Commission’s website: https://commission.europa.eu/law/application-eu-law/implementing-eu-law/infringement-procedure_en.

[6] INFR(2026)4005.

[7] Joined Cases C-188/24 WebGroup Czech Republic and NKL Associates and C-190/24 Coyote System.

[8] Judgement of the Court of 16 June 2026, WebGroup Czech Republic and others, Joined Cases C‑188/24 and C‑190/24, available at: https://infocuria.curia.europa.eu/tabs/jurisprudence?publishedId=C-188%2F24&searchTerm=C%252D188%252F24

[9] Judgment of the Court of 14 February 1989, Starfruit v Commission, case 247/87, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:61987CJ0247

[10] https://commission.europa.eu/publications/communication-commission-eu-law-better-results-through-better-application_en

[11] See case 2029/2022/EIS, para 18, available at: https://www.ombudsman.europa.eu/en/decision/en/179452; as well as case 425/2017/ANA, para 28, available at: https://www.ombudsman.europa.eu/en/decision/en/90387

[12] Case 2029/2022/EIS, para 17, quoted above; as well as case 369/2018/JAP, para 19, available at: https://www.ombudsman.europa.eu/en/decision/en/119020

[13] https://ec.europa.eu/commission/presscorner/detail/en/inf_26_1084