{"id":344437,"date":"2025-12-31T09:58:12","date_gmt":"2025-12-31T09:58:12","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/344437\/"},"modified":"2025-12-31T09:58:12","modified_gmt":"2025-12-31T09:58:12","slug":"a-cjeu-holiday-gift-ending-the-gdpr-articles-13-vs-14-tug-of-war-for-body-worn-cameras-privacy-protection","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/344437\/","title":{"rendered":"A CJEU Holiday Gift: Ending The GDPR Articles 13 Vs 14 Tug Of War For Body Worn Cameras – Privacy Protection"},"content":{"rendered":"

Zahra Laher\u2019s articles from Lewis Silkin are most popular:<\/p>\n


\n within Privacy topic(s)
\n in United Kingdom <\/p>\n

Lewis Silkin are most popular: <\/p>\n


\n within Cannabis & Hemp, Law Practice Management and Criminal Law topic(s)
\n with readers working within the Retail & Leisure industries <\/p>\n

As the festive season draws near, the Court of Justice
\nof the European Union (CJEU) has added something to the compliance
\ncalendar, a ruling that unwraps long standing uncertainty around
\ntransparency obligations under the General Data Protection
\nRegulation (GDPR) for body worn cameras.<\/p>\n

Background<\/p>\n

In its decision in C\u2011422\/24 Storstockholms
\nLokaltrafik<\/a> (SL), the CJEU ruled
\nthat when ticket inspectors record passengers during ticket checks,
\nthe personal data captured is obtained directly from the
\nindividual. This means organisations must comply with Article 13 of
\nthe GDPR and inform individuals at the point of data collection
\nabout who is processing their data, why it is being processed, and
\nhow it will be used. This contrasts with the obligations within
\nArticle 14 of the GDPR, which applies when personal data is
\ncollected indirectly, i.e. from sources other than the
\nindividual themselves, allowing greater flexibility in when and how
\nthat information is provided. The ruling reinforces the GDPR’s
\ncore notice at collection principle, rejecting interpretations that
\ncould delay or dilute transparency where individuals themselves are
\nthe source of the data.<\/p>\n

For businesses, this decision offers much needed clarity on the
\nuse of video surveillance technologies and is likely to set an
\nimportant precedent across the EU for how such systems should be
\noperated in compliance with data protection law.<\/p>\n

The facts<\/p>\n

SL, a public transport company operating in Sweden, equipped its
\nticket inspectors with body worn cameras to deter threats and
\nviolence and to verify passenger identity when issuing penalty
\nfares. The devices captured audio and video recordings in short,
\ncontinuous loops, automatically overwriting footage every minute
\nunless it was saved for enforcement purposes. While intended as a
\nsafety measure, this practice operated in a legal grey area.<\/p>\n

In 2021, the Integritetsskyddsmyndigheten (DPA)
\naudited SL’s practices and concluded that, between December
\n2018 and June 2021 the use of body cameras breached several GDPR
\nprovisions, most notably the failure to provide data subjects with
\nadequate information about the processing of their personal data at
\nthe point of collection. As a result, the DPA imposed a significant
\nfine of approximately \u20ac1.42 million, including \u20ac355,188
\nspecifically for non-compliance with Article 13 of the GDPR.<\/p>\n

SL challenged the decision, arguing that the collection of
\npersonal data was indirect, meaning that Article 13 GDPR
\nobligations did not apply. The case progressed through the Swedish
\ncourts and reached the H\u00f6gsta f\u00f6rvaltningsdomstolen
\n(Swedish Supreme Administrative Court), which referred two key
\nquestions to the CJEU:<\/p>\n


\nWhich GDPR provision applies when personal data is collected
\nvia body worn cameras, i.e. does this constitute direct or
\nindirect collection of personal data? <\/p>\n

(This distinction is crucial for
\ndetermining transparency. Article 13 of the GDPR applies when
\npersonal data is collected directly from the data subject,
\nrequiring organisations to inform the individual at the point of
\ndata collection. Whereas Article 14 of the GDPR applies when
\npersonal data is obtained from sources other than the data subject,
\nallowing organisations to provide the required information at a
\nlater stage).<\/p>\n


\nCan failure to inform data subjects at the time of
\ncollection justify an administrative fine? <\/p>\n

The CJEU’s bottom line on transparency<\/p>\n

In reaching its decision the CJEU agreed with the DPA’s
\nposition, ruling that Article 13 of the GDPR applies to body worn
\ncamera recordings because the data is collected directly from the
\nindividual, and not from a third-party source. Specifically, the
\nCJEU noted that “the classification of data collection as
\n‘direct’ does not require either that the data subject
\nknowingly provide data or any particular action on his or her part.
\nTherefore, data obtained from observing the data subject is
\nconsidered to have been collected directly from him or
\nher.”<\/p>\n

The CJEU explained that organisations must provide information
\nimmediately at the point of collection and advised using a
\n“multi-layered approach” that combines methods
\nof communication such as clear signage and accessible notices that
\nrecordings are taking place. Referring to EDPB Guidelines 3\/2019<\/a>, the CJEU
\nconfirmed that transparency can be achieved through:<\/p>\n


\nFirst layer: Clear signage or a “warning
\nsign” stating that a recording is taking place.
\n
\nSecond layer: Along with other mandatory information,
\na full privacy notice stating the purpose, types of data collected,
\nand identity of the controller made available in an
\n“appropriate and complete manner, in an easily accessible
\nplace” such as via a QR code, website, or printed
\nmaterial. <\/p>\n

The CJEU explained that if Article 14 of the GDPR applied
\n“the data subject would not receive any information at the
\ntime of collection, even though he or she is the source of those
\ndata, which would allow the controller not to provide information
\nto that data subject immediately. Therefore, such an interpretation
\nwould carry the risk of the collection of personal data escaping
\nthe knowledge of the data subject and giving rise to hidden
\nsurveillance practices.”<\/p>\n

In essence, the CJEU confirmed that real time transparency is
\nnon-negotiable. Organisations using body worn cameras must inform
\nindividuals immediately when data is collected, not later. The CJEU
\nhas closed the door on any attempt to rely on Article 14 of the
\nGDPR as this would allow organisations to delay or avoid informing
\nindividuals, creating a risk of hidden surveillance, an outcome
\nincompatible with the GDPR’s objective of ensuring a high level
\nof protection for individual rights.<\/p>\n

What should organisations be doing in light of this
\ndecision?<\/p>\n

Organisations who have implemented or considering implementing
\nbody worn cameras are encouraged to:<\/p>\n


\nReview transparency measures to ensure compliance with relevant
\nGDPR provisions and build these into operational processes and not
\nsimply hidden in a privacy policy.
\n
\nUpdate policies and procedures for direct data collection i.e.
\nembed Article 13 GDPR obligations into operational workflows for
\nsystems collecting data including body worn cameras, CCTV, or
\nsimilar technologies.
\n
\nAssess technical configurations so that features like short
\nloop recording and override functions are documented and justified
\nto demonstrate compliance with the GDPR principles of data
\nminimisation and purpose limitation.
\n
\nEnsure appropriate employee training to understand when and how
\nto provide information to an individual and how to respond to
\nquestions about data processing. <\/p>\n

The content of this article is intended to provide a general
\nguide to the subject matter. Specialist advice should be sought
\nabout your specific circumstances.<\/p>\n","protected":false},"excerpt":{"rendered":"Zahra Laher\u2019s articles from Lewis Silkin are most popular: within Privacy topic(s) in United Kingdom Lewis Silkin…\n","protected":false},"author":2,"featured_media":15222,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[59,57,58,50,56,54,55],"class_list":["post-344437","post","type-post","status-publish","format-standard","has-post-thumbnail","category-united-kingdom","tag-gb","tag-great-britain","tag-greatbritain","tag-news","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/344437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=344437"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/344437\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/15222"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=344437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=344437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=344437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}