THE BOTTOM LINE
- Direct Collection Confirmed: If your business uses body cameras, CCTV, or similar video surveillance, the EU’s top court has ruled you are collecting personal data directly from the individual being filmed.
- Immediate Information Required: This triggers the stricter information duties under GDPR Article 13. You must provide privacy information “at the time of collection,” meaning on the spot. The more lenient rules for delayed notification (Article 14) do not apply.
- Layered Notices are Key: To comply practically, businesses should adopt a “multi-layered” information strategy. This involves a clear, visible first layer (e.g., a sign on a uniform or a prominent sticker) combined with a second, more detailed layer accessible via a QR code or website.
THE DETAILS
This landmark clarification comes from a dispute between the Swedish Data Protection Authority and Stockholm’s public transport company, AB Storstockholms Lokaltrafik (SL). SL equipped its ticket inspectors with body cameras to record interactions, particularly when issuing fines or in response to threats. The Swedish authority fined SL, arguing that it failed to adequately inform passengers that they were being recorded, thereby violating its transparency obligations under the GDPR. The case escalated to the EU’s highest court to resolve a critical question: does filming someone constitute collecting data from them (triggering the immediate notice requirements of Article 13) or collecting data about them from an indirect source (allowing the delayed notice under Article 14)?
The Court of Justice of the European Union (CJEU) provided a clear and decisive answer. The defining criterion is the source of the data. When a body camera captures a person’s image, voice, and actions, the personal data originates directly from that individual. Therefore, the processing falls squarely under Article 13 of the GDPR. The Court reasoned that Article 14 is reserved for situations where data is obtained indirectly, for example, from a third-party data broker or a public database. Applying Article 14’s looser notification standards to direct surveillance, the Court warned, would risk creating a loophole for “hidden surveillance,” directly contradicting the GDPR’s core goal of ensuring fair and transparent data processing.
For CEOs and legal counsel, the ruling solidifies compliance requirements for all forms of video monitoring. The obligation to provide information “at the time” of recording is not optional. The most effective way to meet this standard is by implementing a layered notice system, as recommended by the European Data Protection Board. The first layer should be a concise, easily visible notice—such as a clear symbol on the camera or a badge on a uniform—informing people that recording is in progress. This initial alert should then direct them to a second, more comprehensive privacy notice detailing the purposes of processing, data retention periods, and their rights as data subjects. This pragmatic approach balances the legal mandate for immediate transparency with the practical constraints of real-world operations.
Source: Court of Justice of the European Union
