Earlier quoted context omitted.
I had some random folks in hostel reception taking full photo with their private smartphone of my id document "for the police", despite I clearly said I do not consent to have a copy of my document taken. Spanish hosts are absolutely shady and sloppy privacy wise. EDIT. Spaniards don't take it personally. There is a war at the EU borders and there are waves of scams and various predatory behaviours, plus usual organi…
They were probably telling the truth. It’s pretty common to have to register hotel/hostel stays with the authorities, and it’s increasingly uncommon to own a flatbed scanner - so what did you expect them to do, pull out a DSLR?
It's like you're arguing banks should be absolved of using tls because it's just so tricky.
If your business requires you to handle PII I expect you to have the right equipment and processes to handle it.