On 18 December 2025, the ECJ delivered its judgment in Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik (Case C-422/24), clarifying which information obligations under the General Data Protection Regulation (GDPR) apply when personal data are collected through body cameras worn by ticket inspectors.

Background

The case originated in Sweden and concerned the use of body cameras by ticket inspectors employed by AB Storstockholms Lokaltrafik (SL). The cameras continuously recorded images and sound during inspectors’ shifts, using a circular memory system that automatically overwrote footage after a short period unless manually preserved. Inspectors were instructed to retain recordings in situations involving fines or threats.

Following an investigation, the Swedish Data Protection Authority (Integritetsskyddsmyndigheten) concluded that SL had infringed Art. 13 GDPR by failing to provide adequate information to data subjects about the processing of their personal data. It imposed an administrative fine of SEK 16 million, of which SEK 4 million related specifically to the information deficit.

While a first-instance court upheld the fine, the Administrative Court of Appeal annulled it, holding that Art. 13 GDPR was not applicable and relying in part on the earlier ECJ's judgment in Ryneš (Case C-212/13). The Swedish Supreme Administrative Court then referred the question to the ECJ as to whether Art. 13 GDPR ( headed "Information to be provided where personal data are collected from the data subject" or Art. 14 GDPR (headed "Information to be provided where personal data have not been obtained from the data subject") governs information duties where personal data is collected via body cameras.

The ECJ’s decision and reasoning

The judges in Luxembourg held that Art. 13 GDPR applied. They emphasised that the decisive criterion for distinguishing between Arts. 13 and 14 GDPR is the source of the data. Art. 13 governs situations in which personal data is collected directly from the data subject, whereas Art. 14 applies only to data obtained from another source.

According to the ECJ, footage captured by body cameras constitutes data collected directly from the data subject, even if the individual plays no active role in providing it. Accepting the application of Art. 14 in such cases would risk allowing the collection of personal data without immediate transparency, potentially enabling hidden surveillance practices. Such an interpretation would be incompatible with the GDPR’s objective of ensuring a high level of protection of fundamental rights, in particular Arts. 7 and 8 of the Charter of Fundamental Rights of the EU.

The ECJ noted that its earlier ruling in Ryneš did not resolve the distinction between Arts. 13 and 14 GDPR and could not justify excluding Art. 13 in this context. It further clarified that transparency obligations under Art. 13 GDPR could be implemented through a layered approach, for example by combining visible warning signs with more detailed information provided in an easily accessible place.

What’s next?

The case now returns to the Swedish Supreme Administrative Court, which must resolve the dispute in light of the CJEU’s interpretation. More broadly, the judgment provides guidance for public authorities and private operators using body-worn cameras or similar video devices across the EU. Controllers collecting data directly through video recording must ensure that data subjects are informed in accordance with Art. 13 GDPR at the time of collection, subject to the regulation’s specific exceptions.

The ruling thus strengthened the transparency requirements applicable to surveillance technologies and clarified the boundaries between Arts. 13 and 14 GDPR in practice.