european-union data-protection visa schengen
What is the legal basis for a Schengen country embassy to call the hotel to confirm the applicant&#39;s reservation?
<p>When applying for a Schengen visa, an applicant is typically required to provide a proof of accommodation. Often it's a screenshot from a hotel aggregator, or an email from a hotel (if booked directly), or a letter from a friend warranting an accommodation. It may contain some numbers which may be validated on the aggregator's website. In other cases, a call to the hotel or the friend may be required to confirm that the reservation is not fake.</p>
<p>What is the legal basis (if any) that permits the embassy (frequently located outside of the EU) to request information about a person's reservation from a hotel, and receive a response?</p>
<p>I suspect there would be some data protection laws which make it illegal for the hotel to disclose information about their guests' reservations to random third parties, like a curious bystander. I also suspect that embassies are legally able to make any requests to verify the information provided in the visa application. Hence, some kind of permission or exemption is probably granted to the embassy processing the visa application.</p>
<p>This question is generic, about any Schengen country or EU-wide regulations. For example, <a href="https://www.bmeia.gv.at/en/austrian-embassy-london/travelling-to-austria/entry-requirements-visa-and-immigration/schengen-visa-application-requirements/" rel="nofollow noreferrer">the Austrian visa application in London</a> links to a <a href="https://www.bmeia.gv.at/fileadmin/user_upload/Vertretungen/London/Dokumente/Data_Protection_Regulations_-_Visa_Applicants.pdf" rel="nofollow noreferrer">GDPR statement(?)</a> and <a href="https://www.bmeia.gv.at/fileadmin/user_upload/Vertretungen/London/Dokumente/Visa_C_Application_form.pdf" rel="nofollow noreferrer">the application form</a>. Both cover what happens with the information provided by the applicant (stored here, accessed by these parties and officials), but I don't see how any of them legally allow the hotel to disclose information to the embassy.</p>

<p><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02016R0679-20160504&amp;qid=1673847368835&amp;from=en" rel="nofollow noreferrer">GDPR</a> article 6(1) makes it legal if</p>
<blockquote>
<p>(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;</p>
</blockquote>
<p>An embassy is exercising official authority, and the fact that it is located outside the EU does not really matter; it is an agency of a member state. It <em>could</em> be more problematic if the embassy or consulate contracts a visa processing service, but there the details of the data processing agreements would matter. (I haven't taken the time to look if they are public.)</p>
