In the European Union, data protection law applies, and typically includes provisions along the lines:
Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
Some hotels in the UK and in other countries in the EU nevertheless ask would-be guests to supply their passport numbers in order to confirm their bookings, even if the booking is only for a night or two, and even if the hotel is inexpensive (i.e. the cost of the accommodation is far short of the transaction amount that would trigger legitimate money-laundering concerns).
To me, a passport number seems grossly excessive in relation to that purpose, and in any case it seems wholly unwise to divulge one's passport number to any stranger or organisation unnecessarily, as doing so increases the risk of identity theft.
What recourse does a person have in the case where a hotel in the EU asks for a passport number in order to confirm a booking?
Can the person decline to supply the passport number but insist that the hotel nevertheless honours the reservation?
Should I have posted this to law.stackexchange.com instead?