Cybersecurity Policy Report, Ticket Inspectors’ Body Camera Use Needs to Comply With GDPR, EU Court Rules, (Jan 2, 2026)

By Tony Foley

When body cameras are used during a ticket inspection, certain information must be provided to ticketholders immediately, according to a recent ruling by the Court of Justice of the European Union.

A public transportation company in Sweden equipped its ticket inspectors with body cameras to film passengers during inspections, the court noted in a news release.

The Swedish Authority for Privacy Protection (IMY) investigated and fined the company for breaches of the EU’s General Data Protection Regulation (GDPR). IMY said the use of body cameras enabled personal data to be collected directly from the person filmed and concluded that the subjects were not provided with sufficient information prior to the collection. On appeal, however, the transportation company disputed that there was a breach of the requirement to provide information, maintaining that it collected the data indirectly.

Pursuant to a referral from a Swedish court, the CJEU agreed with IMY, finding that the data obtained from body cameras was collected directly from the data subject. The court said the classification of data collection as “direct” did not require that the data subject knowingly provided data. Therefore, data obtained from observing the data subject is considered to have been collected directly from him or her, it said. The court ruled that indirect data collection applied where the controller was not in direct contact with the data subject and obtained data from another source.

With respect to situations in which data is collected directly from a data subject, the CJEU’s ruling said the obligation to provide information may be implemented in the context of a multi-layered approach. For example, the most important information may be indicated on a warning sign, while other mandatory information may be provided to the data subject in an appropriate and complete manner, in an easily accessible place.

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR