CJEU rules body cameras require immediate disclosure under GDPR Article 13

The Court of Justice of the European Union (CJEU) has ruled in case C-422/24 that personal data captured by body cameras constitutes direct collection under Article 13 of the EU General Data Protection Regulation (GDPR). The case concerns a dispute involving a Stockholm public transport company, which was fined by the Swedish data protection authority (DPA) for failing to provide adequate information to passengers captured on ticket inspectors’ body cameras.

The company appealed, arguing that the data was collected indirectly, which would have altered its disclosure obligations. However, the CJEU held that, because the data was obtained directly from the individual via a body camera, it must provide the required information immediately. The ruling clarifies transparency requirements for mobile surveillance technology, ensuring that individuals are informed in real time when their data is being processed.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.