GDPR: if a body camera is used during a ticket inspection, certain information must be provided immediately to the passenger concerned
GDPR: if a body camera is used during a ticket inspection, certain information must be provided immediately to the passenger concerned
29 December 2025
The Court of Justice of the European Union (CJEU) ruled that when data obtained by means of body cameras are collected directly from the data subject, that data subject must be provided with certain information immediately. The most important information may be indicated on a warning sign, while other information may be provided in an easily accessible place.
A public transport company in Stockholm (Sweden) equips its ticket inspectors with body cameras to film passengers during ticket inspections.
The Swedish Authority for Privacy Protection fined that company for breaching several provisions of the General Data Protection Regulation (GDPR). Among other things, it considers that the use of body cameras allowed personal data to be collected directly from the persons filmed, who had not been provided with sufficient information in that regard.
The company disputes that there has been a breach of the obligation to provide information. It maintains that it collected the data indirectly, a method of collection that determines the timing and scope of that obligation differently and that, in its view, makes the fine unjustified.
The Swedish court hearing that dispute asked the Court of Justice to interpret the GDPR. The Court replies that, since data obtained by means of body cameras are collected directly from the data subject, that data subject must be provided with certain information immediately.
The classification of data collection as ‘direct’ does not require either that the data subject knowingly provide data or any particular action on his or her part. Therefore, data obtained from observing the data subject is considered to have been collected directly from him or her.
The second situation, that relating to indirect data collection, applies where the controller is not in direct contact with the data subject and obtains the data from another source.
Read more here
