ECJ: Some Body Cam Data Must Be Given to Passengers Immediately
Certain information collected by a body camera during a ticket inspection must be provided immediately to the passenger concerned under the GDPR, the European Court of Justice (ECJ) ruled Thursday (Case C-4242/24, Storstockholms Lokaltrafik).
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The most important information may be indicated on a warning sign, while other information can be provided in an easily accessible place, the court said.
The case involved a Swedish public transport company that equips its inspectors with body cameras to film passengers as their tickets are inspected, the court said. The Swedish DPA fined the company for several GDPR violations, but the company argued that the data collection was indirect and that it didn't breach its obligations to provide information. The Swedish court asked the ECJ for an interpretation of the GDPR.
The court found that since data obtained via body cameras is collected directly from a data subject, that individual must be given some information immediately. Classifying data collection as "direct" doesn't require either that the data subject knowingly provided the data or any particular action on his or her part, the court said. Therefore, data obtained from observing someone is considered to have been collected directly.
In situations involving indirect data collection, where the data controller isn't in direct contact with the individual and obtains the data from another source, the obligation to give the person information may be handled via a multi-layered approach that includes a warning sign with additional information provided in some easily accessible place, the court said.