DATA PROTECTION | The CJEU on data collection through body cameras

On 18 December 2025, the EU Court of Justice (the CJEU) issued a judgement in case C-422/24 (Storstockholms Lokaltrafik), clarifying the obligations of data controllers when collecting personal data through body cameras.

The case at stake involved a Swedish transport company that had equipped its ticket inspectors with body cameras without providing any warning notice to the passengers who were recorded.

The ruling provides guidance on the distinction between direct and indirect data collection under the GDPR. Indeed, pursuant to Article 13 of GDPR, when personal data is collected directly from the data subject, the controller must, at the time of collection, provide the individual with relevant information about the processing of personal data. By contrast, where personal data is not collected directly from the data subject, Article 14 of GDPR allows the controller to provide such information at a later stage.

The CJEU held that data collection qualifies as “direct” even when the data subject does not actively provide the data or take any specific action. Personal data is collected directly whenever the controller obtains it through direct contact with the data subject, including by means of body-worn cameras. Conversely, Article 14 of GDPR applies only where there is no contact between the controller (or its employees) and the data subject at the time of collection.

In the case at hand, the CJEU found that passengers filmed by ticket inspectors should have been informed on the spot about the recording in an appropriate manner, namely, through a warning notice and a separate privacy policy pursuant to article 13 of GDPR, to be provided in an appropriate and complete manner, in an easily accessible place.

Newsletter n. 114 – January 2026