When should you be informed about the protection of your personal data when using body cameras?

When inspectors use body cameras on public transport, they must immediately inform passengers about the processing of their personal data. The Court of Justice of the European Union ruled on 18 December 2025 (C-422/24) that this type of data collection falls under the direct information obligation of Article 13 of the General Data Protection Regulation (GDPR). This means that transparency cannot be achieved retrospectively, but must be guaranteed at the moment of recording itself.

The facts: body cameras in Swedish public transport

The case originated in Stockholm, where the transport company AB Storstockholms Lokaltrafik (SL) equipped its inspectors with body cameras. These cameras were used to document aggression against staff and to identify passengers without valid tickets.

The cameras were constantly recording in a ‘circular memory’ (where images were automatically overwritten after one minute), but inspectors could permanently save the recording by pressing a button in the event of incidents or when issuing fines. The Swedish privacy authority imposed a fine of approximately €1.4 million, partly because SL had failed to adequately inform passengers in accordance with Article 13 of the GDPR. SL contested this, arguing that Article 14 of the GDPR applied instead, which offers more flexible rules regarding the timing of information provision.

The decision: immediate collection requires immediate information

The Court of Justice states unequivocally that Article 13 of the GDPR applies to the collection of personal data via body cameras. The essence of the decision is as follows:

• The source is decisive: For the distinction between Article 13 (direct collection) and Article 14 (indirect collection), only the source of the data is relevant.
• Observation is direct collection: When data is obtained by simply observing or filming someone, it is collected directly from the data subject.
• No action required: The fact that a traveler is passive and does not consciously “provide” data to the inspector does not detract from the fact that the collection is direct.

According to the Court, allowing Article 14 GDPR in this context would increase the risk of “covert surveillance,” which is contrary to the high level of protection that the GDPR aims to achieve.

Legal analysis and interpretation

This ruling clarifies a fundamental debate within data protection law concerning the boundary between direct and indirect data collection. The controller (in this case, the transport company) attempted to argue that the “source” of the data was the camera recording itself, regardless of any active interaction with the data subject.

The Court rejects this technocratic approach. It bases its decision on the principle of transparency set out in Article 5 of the GDPR and the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

An important aspect of the reasoning is that Article 14 of the GDPR is an exception, intended for situations in which the controller has no direct contact with the data subject (for example, when purchasing a database). With bodycams, there is physical proximity between the inspector and the passenger, which means that direct provision of information is possible in principle and mandatory.

Furthermore, the Court confirms that previous case law, such as the Ryneš ruling (C-212/13), does not imply that Article 14 of the GDPR applies to camera surveillance; that ruling concerned the so-called “domestic exception” and not the demarcation of information obligations.

What this specifically means

The ruling has direct consequences for any organization that uses mobile cameras or wearables in public spaces.

For governments and businesses

• Immediate action: You cannot postpone the information requirement until a later time. The information must be available at the moment the camera captures the images.
• Layered approach: The Court allows a “layered approach” in accordance with the guidelines of the European Data Protection Board (EDPB).
  • Layer 1: A clear warning sign or sticker on the uniform with the most important information (who is filming and why).
  • Layer 2: A reference (e.g., via a QR code or website) to the full data protection statement.

For citizens

• Right to transparency: You have the right to know that you are being filmed before the interaction with an officer or inspector is fully completed.
• Protection against covert surveillance: The GDPR prohibits companies from hiding behind technical complexity to inform you about recordings days later.

Frequently asked questions (FAQ)

Does an inspector have to tell me verbally that his camera is on?
No, that is not strictly necessary. The information can also be provided in writing or via icons, as long as it is done in a comprehensible and easily accessible manner at the time of collection. A clearly visible icon on the uniform is often sufficient as a first layer.

Is a sign at the entrance to the tram or bus sufficient?
Often, yes, provided that the sign meets the requirements of the layered approach. It must alert travelers to the use of body cameras by inspectors and refer them to where they can find the full information.

Does this rule also apply to fixed surveillance cameras in stores?
Yes. Although this ruling specifically concerns bodycams, the Court confirms that camera surveillance in general falls under the rules of Article 13 of the GDPR (direct collection) because the images are recorded directly from the data subject.

Conclusion

This ruling by the Court of Justice sets a clear limit on the discretionary power of data controllers: technological innovation such as bodycams must never come at the expense of the obligation of transparency. Companies and public authorities in Belgium must now critically review their information processes for mobile camera surveillance.