Banking Law and Electronic Ticketing Regulation in Spain

Introduction

Electronic ticketing in Spain covers digital tickets used for air, rail, bus, metro, entertainment, sporting events and other services. Although an electronic ticket is primarily evidence of a transport or service contract, banking law becomes relevant because tickets are normally purchased through cards, mobile wallets, instant payments or online banking systems.

The applicable framework therefore combines Spanish contract law, consumer law, electronic-commerce regulation, payment-services law, data protection and sector-specific passenger-rights legislation. Electronic tickets have the same basic legal effect as paper tickets, provided that the issuer can prove the transaction, identify the contractual terms and make the ticket accessible to the customer.

Legal and Regulatory Framework

The Spanish Civil Code and Commercial Code establish the general rules governing contracts, consent, contractual obligations and damages. A ticket represents evidence that a contract has been concluded between the customer and the transport operator, event organiser or ticketing platform.

Law 34/2002 on Information Society Services and Electronic Commerce recognises contracts concluded electronically. A contract cannot be denied validity merely because it was made online. Before purchase, the provider must disclose its identity, the essential characteristics of the service, the total price, payment conditions and the technical steps necessary to complete the transaction.

The General Law for the Protection of Consumers and Users, contained in Royal Legislative Decree 1/2007, requires transparent contractual information and prohibits unfair terms. However, the general fourteen-day withdrawal right does not normally apply to passenger transport or leisure services scheduled for a specific date. Cancellation and reimbursement consequently depend on sectoral legislation and the contractual conditions.

Royal Decree-Law 19/2018 transposes the principal rules of the Second Payment Services Directive into Spanish law. It regulates card payments, electronic transfers, unauthorised transactions, payment authentication and liability allocation. A bank may be required to refund an unauthorised ticket payment unless the customer acted fraudulently or with gross negligence.

Regulation 2018/389 requires strong customer authentication for many online payments. Ticketing platforms and their payment providers must generally use two independent authentication factors, subject to recognised exemptions.

Electronic identification and signatures are governed by the eIDAS Regulation and Spanish Law 6/2020. An ordinary ticket does not require a qualified electronic signature. Confirmation through an account, email, application or QR code will usually be sufficient, but stronger signatures may provide greater evidential certainty.

Banking and Payment Issues

An electronic ticket is not normally a payment instrument. It is contractual evidence issued after payment. Nevertheless, some travel cards and mobile applications combine ticketing, electronic-money and payment functions. Where customer funds are stored or accepted for wider payment purposes, the operator may require authorisation as a payment institution or electronic-money institution.

Banks must distinguish between an unauthorised payment and a contractual dispute. If a criminal obtains card details and buys a ticket, the customer may invoke the statutory refund rules for unauthorised transactions. If the customer authorised the payment but the event was cancelled, the dispute is normally against the ticket issuer. A card-scheme chargeback may assist, but it is not identical to a statutory refund right.

Platforms must clearly identify whether they act as the ticket seller, payment collector or intermediary. Hidden booking fees, automatically selected insurance and misleading final prices may violate consumer law. Payment surcharges are also restricted, especially for consumer cards governed by EU interchange-fee rules.

Data Protection and Cybersecurity

Electronic ticketing involves names, payment tokens, travel history, location data and device identifiers. Processing must comply with the General Data Protection Regulation and Spanish Organic Law 3/2018. Providers must collect only necessary information, establish a lawful basis, provide privacy information and apply appropriate security.

Banks and ticketing providers should use encryption, tokenisation, access controls and fraud monitoring. A security incident affecting payment or identity information may require notification to the Spanish Data Protection Agency and, where a high risk exists, communication to affected customers.

Automated fraud controls must also be proportionate. A ticket should not be cancelled merely because an opaque algorithm categorises the customer as suspicious without an adequate review mechanism.

Important Case Laws

1. Content Services Ltd v Bundesarbeitskammer, Case C-49/11

The Court of Justice held that mandatory consumer information must be supplied on a durable medium. Merely placing information behind a website link may be insufficient. Electronic ticket providers should allow customers to retain confirmation and contractual terms.

2. Air Berlin plc v Bundesverband, Case C-573/13

The Court ruled that online booking systems must display the final price from the beginning of the booking process. The principle applies to electronic-ticket interfaces operating in Spain and restricts the late addition of unavoidable charges.

3. Vueling Airlines v Instituto Galego de Consumo, Case C-487/12

This Spanish reference concerned airline-ticket pricing and baggage charges. The Court recognised that checked baggage may constitute an optional service, while confirming that national consumer protection cannot contradict EU rules governing airline pricing.

4. Verbraucherzentrale Baden-Württemberg v Deutsche Bahn, Case C-28/18

The Court examined charges connected with online payment for rail tickets. It confirmed that traders cannot impose prohibited payment-card surcharges simply because tickets are purchased electronically.

5. Mousse v CNIL and SNCF Connect, Case C-394/23

The Court held that requiring a customer’s title or gender identity when purchasing a transport ticket was not necessarily required for contractual performance. The judgment strengthens data-minimisation duties applicable to Spanish electronic-ticket providers.

6. Verein für Konsumenteninformation v Amazon EU, Case C-191/15

The Court addressed consumer contracts concluded electronically, applicable law and unfair contractual terms. Ticketing platforms cannot use choice-of-law clauses that mislead Spanish consumers concerning the protection provided by mandatory EU and Spanish law.

7. Verein für Konsumenteninformation v Deutsche Bahn, Case C-144/20

The Court considered payment options in online transport-ticket transactions. It reinforced the requirement that payment arrangements must comply with consumer-payment protections and cannot improperly disadvantage customers using regulated payment methods.

Rights and Remedies

Customers may demand ticket delivery, correction of technical errors, reimbursement where required, compensation for non-performance and deletion of unlawfully collected data. Complaints may be directed to the seller, transport authority, Bank of Spain where payment services are involved, Spanish Data Protection Agency or consumer authorities.

Electronic records, bank statements, confirmation emails, QR codes and application logs may be used as evidence. Providers should preserve reliable transaction records without retaining personal data longer than necessary.

Conclusion

Spanish electronic-ticketing regulation is built on the interaction of contract, consumer, transport, payment and data-protection law. The central principles are valid electronic consent, transparent total pricing, secure payment authentication, limited data collection and effective refund procedures. Banks protect the payment layer, while ticket issuers remain primarily responsible for delivering the purchased service.