Provisional text

delivered on 1 August 2025 (1)

Case C‑422/24

Integritetsskyddsmyndigheten

AB Storstockholms Lokaltrafik

(Request for a preliminary ruling from the Högsta förvaltningsdomstolen (Supreme Administrative Court, Sweden))

( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data and the free movement of such data – Regulation (EU) 2016/679 – Personal data obtained by means of a body camera worn by ticket inspectors working for a public transport company – Information to be provided to the data subject – Articles 13 and 14 )

I.Introduction

1.The present case concerns the obligation of a controller, as defined in point 7 of Article 4 of Regulation (EU) 2016/679 (‘the GDPR’), (2) to provide information to a data subject where personal data are collected by means of a body camera worn by ticket inspectors on public transport. The controller’s obligation to provide information to subjects of the processing of personal data is the corollary of the right to information which is conferred on those data subjects by Articles 12 to 14 of the GDPR. (3) As the cornerstone of the principle of transparency, (4) the right to information ‘guarantees transparency of all processing’ in the context of the GDPR. (5)

2.The Court is requested, more specifically, to rule on whether, in situations involving the collection of data by means of a body camera, the appropriate legal basis is Article 13 or Article 14 of the GDPR. The delimitation of the scope of each of those provisions has important implications for the timing for the provision of information, and also for the possible exceptions.

II.Legal framework

3.Article 13 of the GDPR, entitled ‘Information to be provided where personal data are collected from the data subject’, provides:

‘1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(d) the right to lodge a complaint with a supervisory authority;

(e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

4. Paragraphs 1, 2 and 3 shall not apply where and in so far as the data subject already has the information.’

4.Article 14 of the GDPR, entitled ‘Information to be provided where personal data have not been obtained from the data subject’, provides:

‘1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) the categories of personal data concerned;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the [European] Commission …

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;

(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(e) the right to lodge a complaint with a supervisory authority;

(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

(g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

3. The controller shall provide the information referred to in paragraphs 1 and 2:

(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

(b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

(a) the data subject already has the information;

(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;

…’

III.Background to the main proceedings and the question referred

5.AB Storstockholms Lokaltrafik (Stockholm Public Transport; ‘SL’) operates public transport services. The company has equipped its ticket inspectors with body cameras. The cameras are used to film passengers who are not in possession of a valid ticket when ticket inspections are carried out and to whom a fine is issued. The use of body cameras is intended to prevent and document threats and violence against inspectors and to verify the identity of passengers who have to pay a fine.

6.In the course of its supervisory activities, the Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection; ‘the Authority for Privacy Protection’) examined whether SL’s processing of personal data collected through the use of the body cameras was compliant with the GDPR. That authority issued a supervisory decision in June 2021 (‘the supervisory decision’), which contains a number of findings on the use and functioning of the body cameras. More specifically, it is apparent from that decision that ticket inspectors wear the cameras throughout their work shift. The cameras film continuously with images and sound. They have a so-called circular memory, which means that, after a certain period of time, all video material is automatically deleted. After deletion, the recorded material is erased. Initially, the recorded material was stored for two minutes but, during the supervision audit, that period was shortened to one minute. By pressing a button, ticket inspectors can suspend automatic deletion, thereby ensuring that the recording is not erased. Ticket inspectors are instructed to suspend automatic deletion in all situations where a fine is issued and also in the event of a threat.

7.In its supervisory decision, the Authority for Privacy Protection found that, from December 2018 until the date of that decision in June 2021, by using body cameras in connection with ticket inspections, SL had processed personal data in a manner contrary to several provisions of the GDPR. SL had, inter alia, failed to provide adequate information to the data subjects as required by Article 13 of the GDPR. As a consequence, SL was ordered to pay an administrative fine totalling 16 million kronor (SEK) (approximately EUR 1 422 000), of which SEK 4 million (approximately EUR 355 000) related to the provision of inadequate information to data subjects.

8.SL challenged the supervisory decision before the Förvaltningsrätten i Stockholm (Administrative Court, Stockholm, Sweden), which dismissed the action in so far as it concerned the fine for the provision of inadequate information.

9.SL then brought an appeal before the Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm, Sweden), which set aside the first-instance judgment and annulled the supervisory decision in so far as it imposed a fine on SL for providing inadequate information to data subjects. In its reasons for judgment, the Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm) referred to the judgment of the Court of Justice of 11 December 2014, Ryneš (C‑212/13, EU:C:2014:2428; ‘the judgment in Ryneš’), concerning the operation of a camera system installed by an individual on his family home. In the view of the Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm), it follows from that judgment that, in situations involving video surveillance, the obligation of the controller to provide adequate information is based on Article 11 of Directive 95/46/EC, (6) which was the former equivalent of Article 14 of the GDPR. Moreover, according to the Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm), the wording of Article 13 of the GDPR indicates that some type of deliberate action by the data subject is required for the personal data to be considered to have been collected from that person. That cannot be considered to be the case when the personal data are obtained by means of a body camera. The Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm) concluded that, since Article 13 of the GDPR is not applicable, the Authority for Privacy Protection had no grounds to impose a fine on SL for infringement of that article.

10.The Authority for Privacy Protection brought an appeal against the judgment of the Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm) before the Högsta förvaltningsdomstolen (Supreme Administrative Court, Sweden), which is the referring court, asking for that judgment to be set aside in so far as it relates to the fine for failure to provide the data subjects with adequate information.

11.Before the referring court, the Authority for Privacy Protection has maintained that Article 13 of the GDPR applies even if the data subject does not actively participate in the data collection. Since the use of camera surveillance requires information to be provided before the processing of personal data begins, it is the data subject who, by knowingly entering the area under surveillance, enables the collection of personal data.

12.SL has asserted before the referring court that the appeal should be dismissed. It argues that the wording of Article 13 of the GDPR suggests that the data subject must knowingly participate in the collection of personal data. Moreover, the layered approach to the provision of information when camera surveillance is used is more in line with the scheme of Article 14 of the GDPR than with that of Article 13 of the GDPR. Article 14(5)(b) of that regulation provides for an exception to the obligation to provide information where the provision of the information proves impossible or would involve a disproportionate effort. SL argues that that exception should apply in situations involving the use of body cameras, as it would be impractical to provide information individually to each passenger before the recording of data takes place.

13.In order to decide whether the Authority for Privacy Protection was justified in imposing a fine on SL for infringement of Article 13 of the GDPR, the referring court seeks to ascertain whether it is Article 13 or Article 14 of the GDPR that applies where personal data are obtained by a body camera. The determination of which provision applies also has implications for which information is to be provided, when the obligation to provide information does arise, and whether any of the exceptions to the obligation to provide information apply.

14.In those circumstances, the Högsta förvaltningsdomstolen (Supreme Administrative Court) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:

‘Which of Articles 13 and 14 of the GDPR applies where personal data are obtained by a body camera?’

15.Written observations were submitted by the parties to the main proceedings, the Austrian Government, the Danish Government and the Commission.

IV.Assessment

A.Preliminary observations on the scope of the question

16.The question posed by the referring court concerns the information-related obligations of SL, a company which operates public transport services, with respect to the use of body cameras by its inspectors. The cameras in question are body cameras which record images and sound. (7) The objective of the use of those cameras is mainly to prevent and document threats and violence against ticket inspectors.

17.It is clear from the order for reference that the relevant processing falls within the scope of the GDPR. My analysis does not, therefore, cover data processing carried out in connection with the use of body cameras by law enforcement authorities, which falls within the scope of Directive (EU) 2016/680. (8)

18.It must also be pointed out that the question posed by the referring court concerns only the controller’s obligation to provide information under Articles 13 and 14 of the GDPR. The Court has not been asked about the lawfulness of the data processing at issue under Article 6 of the GDPR.

B.Data collection by means of body cameras and the obligation to provide information to the data subject: delimitation of the scope of Articles 13 and 14 of the GDPR

19.By its question, the referring court asks, in essence, whether it is Article 13 or Article 14 of the GDPR which applies in a situation where personal data are collected by means of body cameras worn by ticket inspectors working for a company operating public transport services.

20.Articles 13 and 14 of the GDPR set out the scope of the obligation of the controller vis-à-vis the data subject to provide information. Article 13 applies where personal data are collected from the data subject (direct collection), whereas Article 14 applies where personal data have not been obtained from the data subject (indirect collection). (9)

21.Most of the items of information that must be provided under Articles 13 and 14 of the GDPR are the same, although there are some differences. (10) The most important difference between the two provisions concerns the time at which the information must be provided and the possible exceptions to the obligation to provide information.

22.Under Article 13(1) and (2) of the GDPR, where personal data are collected from the data subject, the information must be provided ‘at the time when personal data are obtained’. When personal data have not been obtained from the data subject, the controller must provide the information referred to in Article 14(1) and (2) of the GDPR within the time frames set out in Article 14(3)(a), (b) and (c) thereof. The general rule is that the controller must provide the information within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed (Article 14(3)(a) of the GDPR). The time frame within which the controller must provide the information is different in the situations provided for under Article 14(3)(b) and (c). (11)

23.As to the possible exceptions to the obligation to provide information, in cases of direct collection of information under Article 13 of the GDPR, the only one applicable is ‘where and in so far as … the data subject already has the information’. In cases of indirect collection, the catalogue of possible exceptions set out in Article 14(5) of the GDPR is longer. Those exceptions include situations where the provision of information ‘proves impossible or would involve a disproportionate effort’ (Article 14(5)(b) of the GDPR). In such cases, the controller must ‘take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available’.

24.It is obvious from the foregoing that the scope of the controller’s obligation to provide information will differ, depending on whether it is Article 13 or Article 14 of the GDPR that applies. The outcome of that determination will have an impact on which matters a supervisory authority has to investigate in order to determine whether there has been an infringement of the obligation to provide information.

25.Those general observations being made, it must then be examined whether the processing of data by means of a body camera such as the one used in the case in the main proceedings falls within the material scope of Article 13 or of Article 14 of the GDPR. To that end, it is necessary, in accordance with settled case-law, to consider not only the wording of those provisions but also their context and the objectives pursued by the legislation of which they form part. (12)

26.In the first place, with regard to the wording of Articles 13 and 14 of the GDPR, it must be observed, as the Court clarified in the judgment in Másdi, that the material scope of Article 14 is defined negatively by reference to Article 13 of the GDPR . (13) As is apparent from those provisions’ headings themselves, Article 13 concerns the information to be provided where personal data are collected from the data subject, while Article 14 concerns the information which must be provided where personal data have not been obtained from the data subject. (14) As stated by the Commission in its written submissions, the two provisions are mutually exclusive. In the light of that dichotomy, all situations in which data are collected from the data subject fall within the material scope of Article 13 and all situations in which data are not collected from the data subject fall within the material scope of Article 14. (15)

27.It is apparent from the order for reference that the difficulty in determining the material scope of those provisions lies specifically with the issue whether the application of Article 13 of the GDPR is conditional on the data subject being aware of the collection of his or her data or on some kind of deliberate action on his or her part in providing the data (for instance, by filling out a form). (16)

28.In that regard, it must be pointed out that the term data ‘collected’ from the data subject as referred to in Article 13(1) of the GDPR does not require a specific action on the part of the data subject. The ‘collection’ is a form of ‘processing’ of data, as the latter term is defined under point 2 of Article 4 of the GDPR. As such, the collection of data requires an action by the data controller.(17) As the Authority for Privacy Protection has submitted before the referring court, it is the data controller who plays an active role in collecting the data, not the data subject.

29.The Commission and the Authority for Privacy Protection have observed in their written submissions that the English- and Swedish-language versions of Articles 13 and 14 of the GDPR use two different verbs. While Article 13 refers to data ‘collected’ from the data subject (‘samlas’ in Swedish), Article 14 refers to data that have not been ‘obtained’ from the data subject (‘erhållits’ in Swedish). However, as pointed out by the Commission, in other language versions the same verb is used (18) and, in any event, the use of two different verbs, ‘collect’ and ‘obtain’, does not appear to have any significance. This can also be inferred from the judgment in Másdi, where the Court explains that the personal data which were ‘obtained’ by the controller within the meaning of Article 14 of the GDPR are all those data which that controller ‘collects’ from a person other than the data subject …’. (19)

30.The dichotomy between Articles 13 and 14 of the GDPR, referred to in point 26 above, demonstrates that the basis for determining their respective material scope is not the active participation of the data subject in the collection but rather the source of the data. If the data subject is the source of the data, then Article 13 applies. For that provision to apply, there should be no intermediary between the data subject and the controller. If the source of the data is any source other than the data subject, then Article 14 applies. Any other source could be, for example, third-party controllers, publicly available sources or other data subjects. (20)

31.The wording of Article 14(2)(f) of the GDPR confirms that the source of the data is the criterion for the delimitation of the material scope between Articles 13 and 14. Indeed, according to that provision, when the data have not been obtained from the data subject, the controller must inform the data subject ‘from which source the personal data originate’ (emphasis added).

32.The wording of recital 61 of the GDPR also suggests that the source of the data is the criterion distinguishing the material scope of Articles 13 and 14. That recital states that ‘the information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case’ (emphasis added). That recital further states that general information should be provided ‘where the origin of the personal data cannot be provided to the data subject because various sources have been used’ (emphasis added).

33.Data can be collected directly from the data subject using different methods. Such collection does not require the data subject’s participation or initiative in providing the data or knowledge of the collection. This approach is also confirmed by the WP 29 Guidelines on transparency, which state that Article 13 applies either when a data subject consciously provides personal data to the data controller or when a data controller collects the data from a data subject by observation. The examples of data collection by observation given therein include the use of automated data-capturing devices or data-capturing software, such as cameras. (21)

34.When there is direct collection of data by observation, the awareness of the collection by the data subject is the consequence of application of Article 13 of the GDPR and the obligation it creates for the data controller to provide information to the data subject at the time of the collection. In other words, the knowledge of the collection of the data is not a prerequisite for Article 13 to apply, but rather the consequence of the obligation provided for under Article 13 of the GDPR to inform the data subject at the time when personal data are obtained (at the latest).

35.From the moment when there is direct collection of data from the data subject and precisely because of such collection, the data controller must provide the information, thus making the data subject aware of the data collection. As submitted by the Authority for Privacy Protection, where there is an area under surveillance, there must be a relevant warning sign so that the data subject is aware of the collection before entering the monitored area. (22) By knowingly entering the monitored area, the data subject allows the collection of personal data.

36.In the case of data collection by a body camera, such as that at issue in the main proceedings, as observed by the Austrian Government, the data subject becomes the source of the data collected by virtue of his or her mere physical presence in the relevant area captured by the camera.

37.A different conclusion, to the effect that Article 13 would apply only when the data subject actively provides the data, may not be drawn from the wording of Articles 13 and 14 of the GDPR or of its recitals. More specifically, contrary to the submissions of SL and the Danish Government, such a conclusion may not be drawn from Article 13(2)(e) of the GDPR, as reflected in recital 60 thereof. According to that provision, when the data is collected from the data subject, the controller must provide information as to ‘… whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data’. As stated by the Authority for Privacy Protection before the referring court, information about a possible obligation to provide data is to be given only if required in a specific case. (23) Article 13(2)(e) of the GDPR is not to be interpreted as requiring, in all circumstances, a particular action by the data subject in order for Article 13 to apply.

38.Similarly, nor does the wording of Article 14(1)(d) of the GDPR suggest that there must be an active role played by the data subject in providing the data or that he or she must be aware of the collection of the data in order for Article 13 to apply. Article 14(1)(d) of the GDPR requires that, when personal data have not been obtained from the data subject, the controller must inform the data subject of the categories of personal data concerned. There being no requirement to provide such information under Article 13 of the GDPR, SL and the Danish Government infer that Article 13 applies when the data subject is already aware of the collection of the data. However, the information requirement under Article 14(1)(d) can be justified by the fact that the controller is processing data obtained from sources other than the data subject and is not in contact with the data subject at the time of collection of the data.

39.Therefore, the respective wording of Articles 13 and 14 of the GDPR supports the conclusion that the collection of data by a body camera, as a form of direct collection of data from the data subject, falls under the scope of Article 13.

40.In the second place, the context surrounding those provisions corroborates such an interpretation. The obligations to provide information under Articles 13 and 14 of the GDPR are specific expressions of the principle of transparency, which governs the processing of personal data, as provided for in Article 5(1)(a) of the GDPR. Under the latter provision, personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject. It follows that the processing of personal data must, inter alia, satisfy specific requirements of transparency with regard to the data subject concerned by such processing. (24)

41.The delimitation of the scope of application of Articles 13 and 14 of the GDPR based on the source of the data allows for fair and transparent processing. When the data are collected directly from the data subject, the data subject must be provided with information at the time of the collection. When the data are not collected directly from the data subject, there is some margin for the data controller to provide the information – within a reasonable period – precisely because there is no direct contact with the data subject.

42.In the case of data collection by means of a body camera, the immediate provision of information to the data subject about the collection allows the data subject to become aware of the collection so that he or she can exercise his or her rights as a data subject as from the time of the collection or even before the collection begins. As observed by the Austrian Government, by becoming aware as early as possible of the data collection, the data subject can, for instance, decide to refrain from entering the area under surveillance or adapt his or her behaviour.

43.With regard to the practical means of providing the information, it must be borne in mind that, under Article 12(1) of the GDPR, the controller must take ‘appropriate measures’ to provide the required information ‘in a concise, transparent, intelligible and easily accessible form, using clear and plain language’.

44.The parties and interested parties who submitted written observations accept as a general premiss that, in the case of camera surveillance, the information should be provided through a ‘layered approach’. The EDPB Guidelines on video surveillance give a detailed and practical overview of the layered approach. The first-layer information concerns the ‘primary way in which the controller first engages with the data subject’. In the case of video surveillance, this will normally be a warning sign so that the data subject is aware that he or she is entering a surveillance area. The first-layer information must then be complemented by the second-layer information, preferably by referring to a digital source (for example, a QR code or a website address), although the information should also be easily available in non-digital form. (25)

45.SL and the Danish Government have argued that the layered approach is more in line with the general scheme of Article 14 of the GDPR, as opposed to Article 13 of the GDPR. They take the view that the difficulty in providing the information at the time of collection of the data when body cameras are used should give rise to the application of the exception under Article 14(5)(b) of the GDPR. That exception applies when the provision of the information ‘proves impossible or would involve a disproportionate effort’. In such a case, the controller must ‘take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests’.

46.I am not convinced by those arguments. First, it follows from Article 12 of the GDPR that the ‘appropriate measures’ which the controller must take to provide information relate to the information referred to both in Article 13 and in Article 14. This means that the data controller must take appropriate measures to provide information in situations of both direct and indirect collection of the data.

47.Secondly, as pointed out, in essence, by the Authority for Privacy Protection, the appropriateness of the measures depends on the context in which the data are collected and relates, inter alia, to the interest of the data subjects. The collection of data by a body camera is as intrusive as video surveillance and involves significant risks for the privacy of the data subjects. (26) When the controllers seek to determine the most appropriate measures to provide information to the data subjects, due regard must be had to the principle of transparency and the degree of intrusiveness of the means employed to collect the data. If it is generally accepted that the layered approach is appropriate for video surveillance, which involves significant risks for privacy, the same should hold true for the collection of data by body cameras.

48.Thirdly, there are convincing arguments demonstrating that the layered approach is not ‘impractical’ or ‘impossible’ in the case of a body camera. The Authority for Privacy Protection, the Austrian Government and the Commission have submitted that the layered approach for video surveillance is similarly applicable in the case of body cameras, referring to the EDPB Guidelines on video surveillance. The non-binding nature of those guidelines does not change the fact that they demonstrate in concrete terms that the layered approach is possible and practicable. (27)

49.In the third place, the interpretation to the effect that Article 13 applies in the case of data collected by means of a body camera is consistent with the objectives pursued by the legislation of which Articles 13 and 14 of the GDPR form part. The objective pursued by the GDPR, as set out in Article 1 thereof and in recitals 1 and 10 thereof, consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) TFEU. (28) In accordance with that objective, any processing of personal data must, inter alia, comply with the principles relating to the processing of such data set out in Article 5 of the GDPR, including the principle of transparency.

50.The obligation of the controller to provide information as laid down in Articles 13 and 14 of the GDPR is an expression of the principle of transparency. As it was already observed above, (29) the timing of the obligation to provide information differs, depending on which of those provisions applies. Direct collection requires the immediate provision of information. When collection is not direct because the data are collected from other sources, the information may be given at a later stage. The GDPR allows for different timing in the provision of information precisely because the collection is indirect.

51.If it were to be accepted that Article 14 of the GDPR applies in the case of data collection by means of a body camera, that would mean that data subjects would not be provided with information at the time of the collection of data, despite being the source of the data. As observed, in essence, by the Austrian Government and the Commission, this could undermine the effet utile of Article 13 of the GDPR. Indeed, it would allow the controllers to abstain from providing information to the data subjects immediately, notwithstanding the fact that the data were collected directly from those data subjects. (30) It creates the risk of the data capture going unnoticed by the data subjects and of hidden surveillance practices. (31) Such circumvention of Article 13 of the GDPR would constitute a serious infringement of the data subject’s right to information.

52.Lastly, if the distinction of the respective material scopes of Articles 13 and 14 of the GDPR were to be contingent on whether or not the data subject was actually aware of the collection of his or her data at the moment of collection, that would blur the boundaries between the two provisions and make their application dependent on random circumstances.

53.It follows, therefore, from a literal, contextual and teleological interpretation of Articles 13 and 14 of the GDPR that, in the case of data collection by means of a body camera, which is a form of direct collection of the data from the data subject, the obligation of the data controller to provide information comes within the scope of the former provision.

54.For the sake of completeness, I will offer a few final remarks on the relevance of the judgment in Ryneš to the present case. (32) In that judgment, the Court interpreted the exception to the application of Directive 95/46 in the case of a purely ‘personal or household’ activity, as set out in the second indent of Article 3(2) of that directive. It ruled, in essence, that the operation of a camera system, installed by an individual on his or her family home for the purposes of protecting the property, health and life of the home owners, but which also monitored a public space, could not be regarded as an activity which is a purely ‘personal or household’ activity for the purposes of that provision. Therefore, such processing could not escape the application of Directive 95/46.

55.In paragraph 34 of that judgment, the Court held that ‘at the same time, the application of Directive 95/46 makes it possible, where appropriate, to take into account – in accordance, in particular, with [Article 7(f), Article 11(2) and Article 13(1)(d) and (g)] of that directive – legitimate interests pursued by the controller …’.

56.The reference to Article 11(2) of Directive 95/46 in that specific paragraph does not amount to an interpretation by the Court of the appropriate legal basis for the data controller to provide information in the case of video surveillance. The issue raised in that judgment was completely different from that in the present case, as it concerned the application of the ‘household exception’, not the obligation to provide information. In that paragraph, the Court merely illustrates that it is possible to take into account the legitimate interests pursued by the controller in the light of the limitations and exceptions set out in Directive 95/46. The Commission also rightly observes that it appears from the reference for a preliminary ruling in the case giving rise to the judgment in Ryneš that, in the context of the national procedure, the national supervision authority had considered that there was an infringement of the national legislation implementing Article 11 of Directive 95/46.

57.In any event, the time frame for providing information under Article 14 of the GDPR does not correspond to the time frame that was set out under Article 11 of Directive 95/46. (33) Moreover, the EU legislature clarified the distinction of the respective scopes of application of Articles 13 and 14 of the GDPR with the reference to the source of the data in recital 61 thereof. (34)

58.For those reasons, I believe that the judgment in Ryneš is not relevant for the present case and that it is not capable of leading to a different conclusion from the one proposed in the present Opinion.

59.In view of all of the above, I consider that Articles 13 and 14 of the GDPR must be interpreted as meaning that, in a situation in which personal data are collected by means of body cameras worn by ticket inspectors working for a public transport company, Article 13 applies, while Article 14 does not apply.

60.In the light of the foregoing considerations, I propose that the Court should answer the question referred for a preliminary ruling by the Högsta förvaltningsdomstolen (Supreme Administrative Court, Sweden) as follows:

Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that, in a situation in which personal data are collected by means of body cameras worn by ticket inspectors working for a public transport company, Article 13 applies, while Article 14 does not apply.

—

1Original language: English.

2Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).

3See, to that effect, judgment of 11 July 2024, Meta Platforms Ireland (Representative action) (C‑757/22, EU:C:2024:598, paragraph 58).

4Vrabec, H.U., Data Subject Rights under the GDPR, Oxford University Press, Oxford, 2021, p. 64.

5Opinion of Advocate General Cruz Villalón in Bara and Others (C‑201/14, EU:C:2015:461, point 74).

6Directive of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).

7See point 6 of the present Opinion.

8Directive of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89). On the distinction of the scope of application between the GDPR and Directive 2016/680, see judgment of 21 June 2022, Ligue des droits humains (C‑817/19, EU:C:2022:491, paragraph 67 et seq.).

9See my Opinion in Másdi (C‑169/23, EU:C:2024:474, points 23 to 25). On the distinction between direct and indirect collection of data, see, under Directive 95/46, judgment of 7 November 2013, IPI (C‑473/12, EU:C:2013:715, paragraph 24).

10More specifically, under Article 13(2)(e) of the GDPR, the controller must inform the data subject as to whether the provision of personal data is a statutory or contractual requirement, and as to whether the data subject is obliged to provide the personal data, and of the possible consequences of the failure to provide such data. Under Article 14(1)(d) of the GDPR, the data controller must provide information on the categories of personal data concerned. Moreover, under Article 14(2)(f) of the GDPR, the data controller must inform the data subject from which source the personal data originate.

11According to the Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, 29 November 2017, WP260 rev. 01, paragraph 28, endorsed by the European Data Protection Board (EDPB) on 25 May 2018 (‘the WP 29 Guidelines on transparency’), the maximum time limit within which information under Article 14 must be provided is in any case one month.

12See, to that effect, judgment of 28 November 2024, Másdi (C‑169/23, EU:C:2024:988, paragraph 39).

13Judgment of 28 November 2024, Másdi (C‑169/23, EU:C:2024:988, paragraph 48).

14Ibid.

15See, to that effect, judgment of 28 November 2024, Másdi (C‑169/23, EU:C:2024:988, paragraph 48).

16See points 9, 11 and 12 of the present Opinion.

17See, Roßnagel, A., ‘Kapitel I Allgemeine Bestimmungen, Artikel 4 Nr. 2 Begriffsbestimmung „Verarbeitung“’, in Simitis, S., Hornung, G. et al., Datenschutzrecht, Datenschutzgrundrechtverordnung, Bundesdatenschutzgesetz, Nomos, Baden-Baden, 2nd ed., 2025, paragraph 15.

18That is the case, for instance, in the French-, German- and Greek-language versions of the GDPR.

19Judgment of 28 November 2024, Másdi (C‑169/23, EU:C:2024:988, paragraph 47) (emphasis added).

20WP 29 Guidelines on transparency, paragraph 26.

21Ibid.

22See EDPB, ‘Guidelines 3/2019 on processing of personal data through video devices’, 29 January 2020, point 113 (‘the EDPB Guidelines on video surveillance’). Whether the data subject actually understood the information is a separate matter and depends on whether the information was given in a ‘concise, transparent, intelligible and easily accessible form, using clear and plain language’, according to Article 12 of the GDPR.

23The WP29 Guidelines on transparency give the example of information that might be required to be given to a current or prospective employer in an employment context.

24Judgment of 11 July 2024, Meta Platforms Ireland (Representative action) (C‑757/22, EU:C:2024:598, paragraph 53).

25See, in detail, the EDPB Guidelines on video surveillance, points 112 to 119.

26See, in general, the EDPB Guidelines on video surveillance, point 1 et seq.

27On the practical implementation of the information provision requirements in the case of use of body cameras, see Data Protection Commission (Ireland), ‘Guidance on the use of body worn cameras or action cameras’, 10 January 2020, p. 3, stating that ‘the appropriate measures to convey this information to the data subject depend on the specific context and environment in which the data is collected and processed, and in the case of body worn cameras may include visible notices containing the information, badges next to the equipment containing information or links, public signage, or otherwise declaring to or bringing to the attention of data subjects the relevant information.’ See also Datenschutzkonferenz (DSK) (Data Protection Conference, Germany) ‘Orientierungshilfe der Datenschutzaufsichtsbehörden zu dem Einsatz von Bodycams durch private Sicherheitsunternehmen’, 22 February 2019, (‘DSK Orientierungshilfe’), p. 4. It follows from those guidelines that there are practical means for bringing the relevant processing to the attention of the data subject. For instance, when the body camera is activated, an optical signal must be activated (‘red lamp’ (‘rote Lampe’)) and the persons wearing the body cameras must have visible signs, such as warning jackets with camera symbols (‘beschriftete Warnwesten mit Kamerasymbolen’).

28Judgment of 3 April 2025, Ministerstvo zdravotnictví (Data concerning the representative of a legal person) (C‑710/23, EU:C:2025:231, paragraph 29).

29See point 41 of the present Opinion.

30This is without prejudice to the application of any restrictions on the right of the data subject to be provided with information under the conditions laid down in Article 23 of the GDPR.

31See, to that effect, DSK Orientierungshilfe, footnote 28, op. cit., p. 1.

32The Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm) based its reasoning on that judgment. SL and the Danish Government, in their written submissions, also argue that that judgment is relevant for the present case.

33Under Article 11 of Directive 95/46, the controller was obliged to provide the information to the data subject ‘at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed’.

34As pointed out by the Commission in its written submissions, the wording in recital 61, ‘where the personal data are obtained from another source’, is new in comparison to Directive 95/46. See point 32 of the present Opinion.