Background
AB Storstockholms Lokaltrafik (SL), the public transport operator for greater Stockholm, equipped its ticket inspectors with body-worn cameras. The cameras were activated during ticket checks to film passengers who lacked a valid ticket and were issued a penalty fare. SL’s stated purposes were to prevent and document threats and violence against inspectors and to verify the identities of passengers subject to penalty fares.
Sweden’s data protection authority, Integritetsskyddsmyndigheten (IMY), conducted a supervisory review and found that SL’s use of body-worn cameras involved multiple violations of the GDPR. Among other findings, IMY determined that SL had failed to provide sufficient information to data subjects as required by Article 13 of the GDPR. IMY imposed a total administrative fine of 16 million Swedish kronor, of which 4 million kronor was attributed specifically to the inadequate information obligation. The Administrative Court of First Instance (Förvaltningsrätten i Stockholm) upheld that portion of the fine on appeal.
The Court of Appeal (Kammarrätten i Stockholm) reversed, annulling the fine for inadequate information. The Court of Appeal reasoned that Article 13 — which applies when personal data is “collected from” the data subject — requires some form of conscious act by the data subject, which does not occur when data is captured passively by a body-worn camera. The court also drew support from the Court of Justice of the EU’s ruling in Ryneš (C-212/13), which had addressed camera surveillance by a private individual and cited the predecessor to Article 14. On that basis, the Court of Appeal concluded that Article 14 (governing data not obtained from the data subject), not Article 13, applied, and that IMY had therefore lacked grounds to impose a fine for breach of Article 13.
The Court’s Holding
Before deciding the case, the Supreme Administrative Court sought a preliminary ruling from the Court of Justice of the EU on the precise question of which article governs the information obligation when personal data is collected via body-worn cameras. The CJEU answered in Case C-422/24 (EU:C:2025:980). The CJEU held that the concept of personal data “collected from” the data subject within the meaning of Article 13(1) does not require any specific action by the data subject — it requires only that the controller take such an action. The level of activity or passivity of the data subject is irrelevant to the boundary between Articles 13 and 14. Because data captured by a body-worn camera is obtained directly from the data subject and not from any other source, it is Article 13 that applies. The CJEU also clarified that Ryneš had not in fact addressed the scope of Articles 13 and 14 at all; it had merely illustrated that a controller’s legitimate interests may be taken into account when applying data protection rules.
Applying the CJEU’s ruling, the Supreme Administrative Court held that Article 13 GDPR governs the information obligation in the present situation. The Court of Appeal had therefore erred in annulling the fine on the ground that IMY had applied the wrong article. The Supreme Administrative Court quashed the Court of Appeal’s judgment to the extent it concerned the 4 million kronor fine for inadequate information to data subjects, and remitted the matter to the Court of Appeal for a fresh examination of that question on its merits.
Key Takeaways
- Article 13 GDPR — not Article 14 — governs the transparency and information obligations of controllers who collect personal data through body-worn cameras, because the data is obtained directly from the data subject rather than from a third-party source.
- The “collected from the data subject” threshold in Article 13 does not require any conscious, deliberate, or active participation by the data subject; it turns solely on whether the controller obtains the data directly from the person concerned.
- The CJEU’s earlier Ryneš judgment (C-212/13) did not resolve — and should not be read as resolving — the Article 13 versus Article 14 boundary in camera-surveillance contexts.
- Public transport operators and other organisations deploying body-worn cameras must satisfy Article 13’s real-time transparency requirements (information provided at the moment of collection) rather than the more flexible timing rules available under Article 14.
Why It Matters
This ruling settles a genuinely contested GDPR interpretive question that had divided the Swedish courts and that arose directly from the proliferating use of body-worn cameras in public-facing roles — ticket inspection, policing, security, healthcare, and beyond. By confirming that Article 13 applies whenever a camera captures data directly from a person (regardless of whether that person acts, speaks, or consents), the decision imposes on controllers the stricter, point-of-collection disclosure duty rather than the more relaxed regime available when data comes from indirect sources. Controllers who assumed that passive camera capture fell under Article 14 may need to revisit their privacy notices and information procedures.
The case also illustrates the mechanism by which national supreme courts use CJEU preliminary references to resolve novel EU law questions before applying them domestically. The CJEU’s ruling in C-422/24 now provides binding guidance across all EU member states on this point, making the Swedish Supreme Administrative Court’s decision relevant well beyond Sweden for any practitioner advising clients on GDPR compliance for video-surveillance programmes.