Ahh so that's what they mean at the reception when they take photo of my ID and say "it's for the police". So that any police anywhere can freely download it at any time!
Turns out the local policemen asked verbally to make photocopies, just in case... The hotel is more afraid of the local police than of it's clients, so they just do it.
Since I was the only client who ever asked about it, and gaslighting me wasn't going to work ("everybody does it! what do you have to hide?"), they just gave me the copy to destroy.
Other places copy IDs because they're lazy and don't want to compile the required form on the spot. Not to mention ID photocopies floating around the reception desk in plain sight...
In Italy occasionally they find mafia members hiding for years in... their home regions or even villages. They absolutely keep it "just in case" and I would trust their local police /s.
Says... this perpetrator?
Usually on plain "I don't consent on making copy, write down the data you need" they become more pushy and even aggressive.
The first step should be to show them the Privacy Authority press release[1] - "No to preservation of guest ID copies".
You should be prepared to be refused check-in if they're stubborn and feel like you "cause problems". The protection you have is that public service (hotel) is forbidden to refuse service by law[2][3], fine is €516 up to €3098. If it happens you should call police to verbalise and apply the fine. Refusal by police (Rifiuto di atti d'ufficio) is criminal offence and punishable with imprisonment 6mo - 2yr [4].
You should present ID to allow identification. The host must insert, by law at most 24hrs after check-in [5], client data into police portal, like name, DOB, nationality etc.
Everything else is extra and by GDPR you should be informed of any data processing, basis of processing, duration of processing, and your rights.
You can write Garante della Privacy to signal violations of GDPR if you feel it's warranted. I know they're happy to investigate and apply big fines to larger companies, not sure about how they handle smaller companies, like hotels.
1 - https://www.garanteprivacy.it/home/docweb/-/docweb-display/d...
2 -
4 - Italian penal code Art. 328 Refusal of office acts https://www.brocardi.it/codice-penale/libro-secondo/titolo-i...
5- Art. 109 TULPS - Identification of guests https://www.brocardi.it/testo-unico-pubblica-sicurezza/titol...
> Everything else is extra and by GDPR you should be informed of any data processing, basis of processing, duration of processing, and your rights.
It's basically common sense yet they still insist they have to copy the document "for the police". Almost as if they are specifically sourcing these copies for someone.
[3] - analysis by a police association of the Refusal of Service https://accademiapolizialocale.wordpress.com/wp-content/uplo...