CJEU - C‑422/24 - AB Storstockholms Lokaltrafik
| CJEU - C‑422/24 AB Storstockholms Lokaltrafik | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 5 GDPR Article 12 GDPR Article 13 GDPR Article 14 GDPR |
| Decided: | 18.12.2025 |
| Parties: | AB Storstockholms Lokaltrafik |
| Case Number/Name: | C‑422/24 AB Storstockholms Lokaltrafik |
| European Case Law Identifier: | ECLI:EU:C:2025:980 |
| Reference from: | Hd (Sweden) |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion Judgement |
| Initial Contributor: | n/a |
The CJEU held that when personal data are collected by body cameras worn by ticket inspectors on public transport, the obligation to provide information to the data subjects is governed by Article 13 GDPR, not Article 14 GDPR.
English Summary
Facts
AB Storstockholms Lokaltrafik (the controller), the operator of public transport in Stockholm, equipped its ticket inspectors with body-worn cameras that continuously recorded video and audio during inspections. The cameras had a short circular memory, automatically overwriting footage unless inspectors saved it when issuing fines or facing threats. The stated purposes of the cameras were to prevent and document violence against inspectors and to verify the identity of fined passengers.
Following a supervisory investigation, the Swedish Data Protection Authority found that the controller had infringed several provisions of the GDPR, including the obligation to provide information to data subjects. The Authority imposed an administrative fine in total SEK 16,000,000 (€1,420,670) of which SEK 4,000,000 (€355,188) was for failure to provide information to the data subjects.
The controller challenged the Swedish DPA’s decision before the Administrative court of first instance (Förvaltningsrätten i Stockholm), which upheld the fine. The controller then appealed to the Administrative Court of Appeal (Kammarrätten i Stockholm), which annulled the fine, holding that Article 13 GDPR was not applicable.
The Swedish DPA subsequently appealed to the Supreme Administrative Court of Sweden (Högsta förvaltningsdomstolen). The referring court identified the key issue as whether Article 13 GDPR or Article 14 GDPR applies to personal data collected by body-worn cameras. Resolving this question was necessary to determine the content, timing, and possible exceptions of the information obligation and to assess whether the Authority was entitled to impose an administrative fine for non-compliance with Article 13 GDPR.
The court also noted uncertainty regarding the legal weight of the Article 29 Working Party’s Guidelines on transparency, which provide that Article 13 GDPR applies to video surveillance. In these circumstances, the Supreme Administrative Court stayed the proceedings and referred the question to the Court of Justice of the European Union.
Advocate General Opinion
The Advocate General explained that body cameras used by ticket inspectors collect personal data directly from individuals, even if the person is unaware of being recorded. Therefore, Article 13 GDPR applies, meaning the controller must provide information to the data subjects at the time of collection. This can be done through measures such as warning signs or a layered approach, ensuring people are aware their data is being recorded and can exercise their rights. Article 14 GDPR, which applies to data obtained from other sources, is not applicable in this situation.
Holding
The Court of Justice held that, where personal data are collected by means of a body camera worn by ticket inspectors on public transport, the obligation to provide information to data subjects is governed by Article 13 GDPR, not Article 14 GDPR. The Court reasoned that body-camera recordings involve the collection of personal data directly from the data subject. The activity or passivity of the data subject is irrelevant, it is the controller’s act of collecting the data that is decisive. Article 14 applies only where personal data are obtained from a source other than the data subject.
Moreover, the court held that this interpretation was reinforced by the GDPR’s context. Article 13 GDPR gives concrete expression to the data subject’s right to be informed at the time of collection, whereas Article 14 GDPR is designed for situations where data are collected indirectly from third parties, making immediate information impractical. Applying Article 14 GDPR to body-camera recordings would undermine the principle of transparency laid down in Article 5 GDPR and 12 GDPR. Also, applying Article 14 GDPR in such circumstances would risk enabling hidden surveillance, since data subjects would not necessarily be informed at the time their data are collected.
Finally, the Court clarified that its earlier judgment in Ryneš did not address the distinction between Articles 13 GDPR and 14 GDPR and therefore did not support applying Article 14 GDPR in the present context.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
