CJEU delivers preliminary ruling on obligation to provide information when using body cameras to collect personal data

Background

A Swedish public transport company (AB Storstockholms Lokaltrafik) (the Company) equipped fare inspectors with body cameras to record passengers during ticket controls (the Filmed Persons). The recordings were automatically overwritten after one minute unless a button is pressed which retains the footage; this feature was used when issuing fines or in threatening situations. 

The Swedish Authority for Privacy Protection (the IMY) fined the Company SEK 16 million (~€1.42 million), of which SEK 4 million (~€360,000) was attributed to inadequate information provided to passengers, including for failing to provide (at the time of collection) sufficient information about the personal data obtained from the Filmed Persons via the body cameras. 

A key issue was whether the collection of personal data via the body cameras was governed by Article 13 GDPR (data collected from the data subject) or Article 14 GDPR (data not obtained from the data subject). In turn, this determined when and what information must be given to data subjects and whether the IMY was entitled to fine the Company. The Swedish Supreme Administrative Court referred the question to the Court for interpretation. 

CJEU Decision

Article 13 GDPR addresses cases where personal data is “collected from the data subject”, whilst Article 14 GDPR applies to situations where data is “not obtained from the data subject”. The determining factor is the source of the data. The Court clarified that “obtained” in Article 14 GDPR includes data sourced from persons other than the data subject and data the controller generates from those third-party inputs. By contrast, “collected from the data subject” in Article 13 GDPR captures any situation where the controller gathers data directly from the individual, regardless of the data subject’s level of participation. The Court stated that it is immaterial whether the data subject has knowingly provided personal data or whether the controller has collected personal data by observation.

In the context of personal data gathered by body cameras worn by fare inspectors, the Court determined that this amounted to a direct collection of data from the Filmed Persons. 

The Court noted that if Article 14 GDPR was applied to body camera recordings, controllers could delay notice even though personal data is obtained directly from the Filmed Persons and that such an approach could facilitate hidden surveillance practices and undermine the objectives of the GDPR. 

The Court therefore held that where personal data is collected by body cameras worn by fare inspectors on public transport, the controller’s information obligations are governed by Article 13 GDPR rather than Article 14 GDPR. Drawing on the European Data Protection Board (EDPB) guidance on data collection by video devices, the Court confirmed that these obligations can be met through a layered approach, with the most salient information being provided as a first layer via a warning sign and the remaining information made available through an accessible second layer. 

The preliminary ruling is available here.