Body cameras for ticket checks: GDPR requires information for passengers
The Court of Justice of the European Union has delivered a judgment in case C-422/24 concerning the use of body cameras for ticket checks in public transport and the related obligations under the GDPR.
The Stockholm public transport company Storstockholms Lokaltrafik equipped its inspectors with body cameras that recorded images of passengers during ticket checks. The Swedish Data Protection Authority (Authority for Privacy Protection) has fined the carrier for breaching several obligations under the GDPR, in particular for failing to provide sufficient information to data subjects about the processing of their personal data.
The carrier argued that it had obtained personal data indirectly and was therefore subject to the more lenient information regime under Article 14 of the GDPR. The Swedish court therefore asked the CJEU for an interpretation of whether the recording of images by a body camera constituted direct or indirect collection of personal data.
The key conclusions of the Court of Justice of the EU were that the recording of a passenger’s image by a body camera constitutes direct collection of personal data from the data subject and that for this to be direct collection of data, neither the conscious provision of the data nor the active action of the passenger is necessary. The mere observation of the person by technical means is sufficient. Thus, the obligations under Article 13 of the GDPR should have been fulfilled and apply whenever the controller is in direct contact with the data subject.
Indirect collection of data under Article 14 of the GDPR is only possible if the controller obtains the data from another source and without direct contact with the person.
The Court also confirmed that the so-called layered method of information is in line with the GDPR and the essential information (in particular that the recording is taking place, the identity of the controller and the purpose of the processing) must be provided immediately and visibly, for example by means of a sticker, pictogram or notice on the inspector’s uniform.
Other mandatory information such as the legal basis for processing, the retention period, the rights of the data subjects can be made available in an easily accessible place, for example on a website, in a mobile application or on an information poster in the vehicle, and this approach balances the protection of passengers' privacy with the practical needs of carriers.
Although the use of body cameras for ticket control is not yet common practice in Slovakia, the decision has a universal impact. If carriers (in public transport, regional transport or trains) introduce body cameras, they must ensure that passengers are informed in a clear manner and that all obligations under Article 13 of the GDPR are met, as well as appropriate technical and organizational measures. Otherwise, they will be exposed to the risk of sanctions by the Office for Personal Data Protection of the Slovak Republic in accordance with the case law of the Court of Justice of the European Union.
