Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject (CJEU)

Judgment of the Court of Justice in Case C-422/24 (Storstockholms Lokaltrafik) dated 18.12.2025 - GDPR: If a body camera is used during a ticket inspection, certain information must be provided immediately to the passenger concerned.


The most important information may be indicated on a warning sign, while other information may be provided in an easily accessible place.

A public transport company in Stockholm (Sweden) equips its ticket inspectors with body cameras to film passengers during ticket inspections. The Swedish Authority for Privacy Protection fined that company for breaching several provisions of the General Data Protection Regulation (GDPR). [1] 

Among other things, it considers that the use of body cameras allowed personal data to be collected directly [2] from the persons filmed, who had not been provided with sufficient information in that regard. 

The company disputes that there has been a breach of the obligation to provide information. It maintains that it collected the data indirectly, [3] a method of collection that determines the timing and scope of that obligation differently and that, in its view, makes the fine unjustified. The Swedish court hearing that dispute asked the Court of Justice to interpret the GDPR. 

The Court replies that, since data obtained by means of body cameras are collected directly from the data subject, that data subject must be provided with certain information [4] immediately. The classification of data collection as ‘direct’ does not require either that the data subject knowingly provide data or any particular action on his or her part. 

Therefore, data obtained from observing the data subject is considered to have been collected directly from him or her. The second situation, that relating to indirect data collection, applies where the controller is not in direct contact with the data subject and obtains the data from another source. In the case of collection of data directly from the data subject, the obligation to provide information may be implemented in the context of a multi-layered approach. [5] 

The most important information may be indicated on a warning sign. The other mandatory information may be provided to the data subject in an appropriate and complete manner, in an easily accessible place. (curia.europa.eu/photo freepik.com)

The judgement is available here

___________________

1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. 

2 Article 13 of the GDPR, headed ‘Information to be provided where personal data are collected from the data subject’. 

3 Article 14 of the GDPR, headed ‘Information to be provided where personal data have not been obtained from the data subject’. 

4 This information includes the identity and contact details of the controller, the purposes of the processing, the legal basis for the processing, the recipients of the data, the period for which the personal data will be stored and the right to request access to and erasure of the data. 

5 As envisaged by European Data Protection Board (EDPB) Guidelines 3/2019 on processing of personal data through video devices, adopted on 29 January 2020.

Comments

Post a Comment

Popular posts from this blog

Fully-funded PhD position in AI, Law and Public Power

Image
Erasmus University Rotterdam School of Law, department Law & Markets, is looking for a fulltime PhD researcher in AI, Law and Public Power (4,5 years with 20% teaching tasks). PhD AI, Law and Public Power Are you curious about how artificial intelligence is changing state actor powers? Do you want to conduct critical and in-depth legal research at the intersection of technology, law and power? And would you like to combine that with academic teaching? Then this PhD position at Erasmus School of Law is for you. Within the Law & Markets team, you will spend 4.5 years researching the legal regulation of AI in the public sector. How do we protect fundamental rights when algorithms help decide on who receives public benefits, how to perform enforcement or how to enact environmental policy? What is the role of the state, and where is the limit of government power in a data-driven society? You will have plenty of space to choose your own research angle and work in a multidisci...
Read more

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Harassment During Job Interviews Under Cyprus Law

Image
By Giorgos Kazoleas, LL.M., Lawyer, Managing Partner at Legal Experts Cyprus Harassment or bullying during a job interview can now legally be considered workplace harassment. This is explicitly provided for in recent Cypriot legislation regarding workplace harassment, which widens the scope of application to include candidates for employment. The Legal Framework in Cyprus: Law 42(I)/2025 Law 42(I)/2025 (The Prevention and Combating of Violence and Harassment at Work Law), which came into force on April 11, 2025, explicitly extends protection against harassment and violence to the recruitment process and employment negotiations before a contract is signed. According to the interpretation of terms in Article 2 of the Law, the definition of an "employee" includes, among others, a person: "Whose employment relationship has not yet begun, in cases where the violation of the provisions of this Law has been committed during the recruitment process or at another stage of...
Read more

The Delivery Delay Clause in Residential Construction Contracts: Consumer Protection in Cyprus and Europe

Image
By Giorgos Kazoleas, LL.M., Lawyer, Managing Partner at Legal Experts Cyprus The purchase or construction of a new residence is one of the most significant financial and personal decisions a consumer can make. Residential construction contracts or agreements for the sale of property under construction are a crucial and defining element of the entire process, as certain terms they may contain can be detrimental to the buyer. One of the most critical aspects is the contractual delivery time of the project and the provision for delay, through the so-called delivery delay clause. The Delivery Delay Clause: Its Role and Legal Nature The delivery delay clause (also known as a penalty clause in the event of default) is a term usually included in the contract that specifies a predetermined compensation amount that the contractor or seller must pay to the buyer for every day, week, or month of delay beyond the agreed delivery date. The purpose of the clause is twofold: -Compensatory: ...
Read more

Moving between Member States without an identity card or passport - A fine amounting to 20% of the amount of the offender’s average net monthly income, is not proportionate to the seriousness of the offence

Image
In its Judgment in Case C-35/20 (6.10.2021) , the European Court of Justice ruled that a Member State may require its nationals to carry a valid identity card or passport when travelling to another Member State, irrespective of the means of transport used and the itinerary, subject to sanctions. While EU law does not preclude the imposition of a criminal penalty, it does preclude disproportionate penalties, such as a fine amounting to 20% of the offender's average net monthly income. A, a Finnish national, made a round trip between Finland and Estonia in August 2015 on a pleasure boat. During that trip, he crossed the international waters between Finland and Estonia. He was the holder of a valid Finnish passport, but did not have it with him during that trip. As a result, during a border check in Helsinki on his return, A was unable to produce his passport or any other travel document, although his identity could be established on the basis of his driving licence. The syyttäjä ...
Read more

Judicial Workload and Compensation: EU Law Does Not Mandate Extra Pay for Covering Vacant Posts (CJEU)

Image
Judgment of the Court of Justice in Case C-272/24 (Tribunalul Galați) on 13.11.2025: A judge who carries out tasks which fall to a vacant post at his or her court, in addition to those within the remit of the post to which he or she has been appointed, is not necessarily entitled to financial compensation. The grant of a rest period to compensate for the additional work is, under certain conditions, an adequate measure. The Galați Regional Court (Romania) is understaffed due to various judicial posts remaining vacant. A judge who has been working at that court since 2017 took the view that, since 2019, he has performed not only the tasks associated with his own post, but also, in part, those tasks linked to vacant posts.  Being of the opinion that he has worked overtime, that judge requested that he be remunerated for it. Specifically, he brought legal proceedings to claim a share of the net salaries and allowances attached to the vacant posts, divided by the number of judges in ac...
Read more

Gigantic fine for unfair practices imposed on Booking.com by the Competition Authority of Hungary

Image
One of the highest fines for violation of unfair competition law has been imposed (28/4/2020) on online hotel booking platform ‘’Booking.com’’ by the Hungarian Competition Authority. The amount of the fine (approximately EUR 6 million / HUF 2.5 billion) imposed by the Authority illustrates the seriousness of the Dutch company's violations. The Hungarian Competition Authority (GVH) imposed a fine of HUF 2.5 billion on the operator of the online booking portal booking.com, and at the same time banned the Dutch company from continuing its aggressive sales methods. According to the decision of the competition authority, Booking.com B.V. engaged in unfair commercial practices against consumers by, among other things, misleadingly advertising some of its accommodations with a free cancellation option and exerting undue psychological pressure on consumers to make early bookings. As a result of the Competition Authority’s competition supervision proceeding  initiated in 2018, the autho...
Read more