Court of Justice of the EU: where a bodycam is used during ticket inspections, certain information must be provided immediately to the passenger concerned.

A public transport company in Stockholm (Sweden) equips its ticket inspectors with body-worn cameras to record passengers during ticket inspections. The Swedish data protection authority imposed a fine on the company, alleging breaches of several provisions of the General Data Protection Regulation (GDPR). In particular, the authority considered that the use of bodycams enabled the collection of personal data directly from the individuals being filmed, who were not adequately informed of such processing.

The company challenged the alleged breach of the information obligation, arguing that the data had been collected indirectly. According to the company, this mode of collection entails different requirements as to the timing and scope of the information to be provided and therefore rendered the fine unjustified.

The Swedish court hearing the dispute referred questions to the Court of Justice of the European Union for an interpretation of the GDPR. The Court held that, since data obtained through bodycams are collected directly from the data subject, the latter must be provided with certain information immediately. The classification of data collection as “direct” does not require that the data subject knowingly provides the data, nor does it require any specific action on the part of the data subject. Consequently, data resulting from the observation of a person who is the source of the data are regarded as being collected directly from that person. By contrast, indirect data collection applies where the controller is not in direct contact with the data subject and obtains the data from another source.

Where personal data are collected directly from the data subject, the information obligation may be fulfilled through a layered approach. The most essential information may be provided by means of a warning sign, while the remaining mandatory information may be made available to the data subject in an appropriate and comprehensive manner in an easily accessible place.