Europe’s top court has ruled that public transport operators using body-worn cameras must provide passengers with immediate information about data collection, reinforcing transparency obligations under the EU’s General Data Protection Regulation (GDPR).
In a judgment issued on December 18, the Court of Justice of the European Union (CJEU) clarified that Article 13 of the GDPR applies when personal data are collected through body cameras worn by ticket inspectors, rather than Article 14, which governs data obtained indirectly from third parties. The ruling came in response to a request from Sweden’s Supreme Administrative Court in a dispute between the Swedish privacy regulator, Integritetsskyddsmyndigheten, and public transport operator AB Storstockholms Lokaltrafik (SL).
The case centered on SL’s use of body cameras worn by ticket inspectors during ticket checks on Stockholm’s public transport network. The cameras continuously recorded video and audio, with footage automatically overwritten after a short period unless inspectors intervened to preserve recordings during incidents such as issuing fines or facing threats. Sweden’s privacy authority fined SL for failing to adequately inform passengers about the data processing, citing a violation of Article 13 of the GDPR.
Lower courts reached differing conclusions on whether Article 13 or Article 14 applied, prompting the referral to the CJEU. In its ruling, the court emphasized that the decisive factor is the source of the data. Because images and audio captured by body cameras are obtained directly from the individuals being recorded, the data are considered “collected from the data subject,” triggering Article 13 obligations.
The court stressed that applying Article 14 in such cases would risk allowing “hidden surveillance,” undermining the GDPR’s core principles of fairness and transparency. Data subjects, the judges said, must be informed at the time of collection whenever possible, particularly in situations involving direct observation through cameras.
The ruling also endorsed a practical, layered approach to transparency. Operators may provide key information through visible signage at the point of recording, supplemented by more detailed disclosures through accessible channels, such as websites or printed notices.
The decision has broader implications for public authorities and private entities across the EU that rely on body-worn cameras or video surveillance. It confirms that transparency duties apply even when individuals do not actively provide their data, strengthening protections for privacy and reinforcing the GDPR’s high standard for informing the public about how their personal data are used.
Need Help?
If you have questions or concerns about any global guidelines, regulations and laws, don’t hesitate to reach out to BABL AI. Their Audit Experts can offer valuable insight, and ensure you’re informed and compliant.
