Follow this train of thought: you take public transport and all goes well. A ticket inspector joins your carriage to verify the tickets of the passengers. One of the passengers is non-cooperative and aggressive towards the inspector. The inspector, carrying a body-cam, recorded the whole interaction, from the entry in the carriage to the leaving after the transgression. Now for the GDPR question, is this recording directly or indirectly gathered from the data subjects? And which transparency regime thus applies, article 13 or 14 GDPR?
This question is addressed by the CJEU in the Storstockholms Lokaltrafik C-422/24 case.
The case originates in Sweden the public transport operator. The dispute arises from the use of body-worn cameras by ticket inspectors on public transport. These cameras continuously record images and sound, but operate with a rolling buffer: recordings are automatically overwritten unless the inspector actively intervenes, for example in the event of a conflict, threat, or issuance of a fine. In such cases, the footage from a short period before and after the intervention is retained and stored.
In this blog, we dive deeper into this case of 18 December 2025 and the potential impact on your business.
GDPR context
Direct data collection under art. 13
Article 13 GDPR applies where personal data are obtained directly from the data subject.
The underlying logic is straightforward: if a controller collects personal data from you, you should be informed at the moment of collection. Article 13 therefore requires that the information be provided at the time the personal data are obtained.
Typical examples include:
- filling in a form (online or offline),
- registering for a service,
- entering data into an app or portal,
Article 13 is stricter in timing. The expectation is immediate transparency, even if the practical implementation often relies on layered notices (for example signage combined with a more detailed privacy notice).
Indirect data collection under art. 14
Article 14 GDPR applies where personal data have not been obtained directly from the data subject.
This provision is designed for situations where the controller receives personal data from a third party or another source, such as:
- data brokers,
- public registers,
- business partners,
- group entities,
- indirectly generated data not actively provided by the individual.
Because immediate notice is often impractical in these scenarios, Article 14 allows the information to be provided within a reasonable period, generally within one month, or at the latest at the time of first communication with the data subject or first disclosure of the data.
Article 14 also contains explicit exemptions, including situations where providing the information proves impossible or would involve a disproportionate effort, subject to appropriate safeguards.
Core issue
The central question referred to the CJEU is how to classify personal data captured by body-worn cameras for the purposes of GDPR transparency:
- Are such data “obtained from the data subject”, because the individual is physically present and directly recorded?
- Or are they “not obtained from the data subject”, because the data are generated through a technical device without any active involvement or interaction from the person concerned?
The outcome determines the applicable transparency regime:
- whether transparency must be ensured immediately at the time of recording (Article 13), or
- whether more flexible timing and potential exemptions may apply (Article 14).
Key takeaways
- Any form of recording, either hidden or visible is personal data collected directly from the data subject and thus subject to the information obligation under art. 13.
- The difference between art. 13 and 14 stems from the perspective of the controller, not from the data subject.
- Informing data subjects about (potentially) being recorded must happen before the recording takes place.
- The most important information can be included on a warning sign
Decision
The Court starts from the basic structural distinction in the GDPR. Article 13 applies when personal data are collected from the data subject, while Article 14 applies only where data are not obtained from the data subject. This distinction is decisive and exclusive: Article 14 is defined negatively by reference to Article 13.
The Court explicitly rejects the idea that Article 13 requires any form of active or voluntary provision of data by the data subject. What matters is not the data subject’s behaviour, but the controller’s action. Data are still “collected from the data subject” where the controller obtains them directly by observation, including through cameras.
In the case of body cameras worn by ticket inspectors, the images and sound recordings are generated directly from the individuals being filmed. The data are not obtained via an intermediary, another database, or a third party. There is therefore no “other source” within the meaning of Article 14(2)(f) GDPR.
The Court situates Article 14 in its proper function. It exists for situations where the controller is not in direct contact with the data subject and therefore cannot realistically provide information at the moment of data collection. This explains why Article 14 allows delayed information. That logic does not apply where data are collected directly from the person concerned, as with video recording in public transport inspections.
The Court places strong weight on the GDPR’s transparency objective. Applying Article 14 to body-camera recording would allow controllers to avoid providing information at the time of recording, even though the data subject is the direct source of the data. This would create a risk of undisclosed or “hidden” surveillance, which would be incompatible with the GDPR’s aim of ensuring a high level of protection of fundamental rights.
Conclusion
With this judgement, the CJEU makes a clear distinction on the difference between the direct and indirect obtaining of data. The relevant perspective is that of the controller, not that of the data subject. The action of a controller determines if the data is collected directly from the data subject, or obtained through another third party and thus indirectly.
The Court’s reasoning is deliberately grounded in transparency. Allowing controllers to rely on Article 14 in such contexts would delay or dilute information at the very moment when individuals are being recorded, opening the door to surveillance that operates in practice without the data subject’s knowledge. That outcome, the Court makes clear, is incompatible with the GDPR’s core objective of ensuring a high level of protection of fundamental rights.
For companies, the message is both simple and sometimes uncomfortable. Transparency cannot be postponed, outsourced to privacy policies, or buried in fine print. If your systems observe people directly, your information duties begin at the moment of observation, not later, not on request, and not only in theory.
