Russell, I live in Andalucía, and (as a host) I must collect guests' ID information (DNI/passport number and details, name, and a copy of the photo ID) to turn in at the local police station or (with a certain sort of registration in the obligatory guest reporting system) online.
I imagine it's a similar situation in Madrid. (So, bottom line: your host probably isn't trying to scam you. She's probably just trying to comply with whatever law and procedure is in effect in Madrid.)
I haven't perceived any difference post-GDPR.