IMY – CJEU Judgment (European Union, 2025)

= AB Storstockholms Lokaltrafik (the controller) is the public transport authority for the Stockholm area and operates public transport services. The controller equipped its ticket inspectors with body cameras. The cameras are used to prevent and document threats and violence against inspectors and to verify the identity of passengers who do not have a ticket and need to pay a fine. The cameras had a “circular memory” and automatically erased footage after a certain amount of time; however, ticket inspectors could press a button to preserve the footage. The DPA investigated the controller’s use of body cameras. In 2021 it concluded that the controller operated the cameras in violation of Article 6(1)(f), 5(1)(a)(c), and 13 the GDPR. In particular, the DPA held that the controller violated Article 13 GDPR by failing to inform the passengers (the data subjects) that they were being recorded. On these grounds the DPA issued a fine for a total SEK 16,000,000 (€1,422,000). Out of the total, SEK 4,000,000 (€ 355,500) related specifically to the violation of Article 13. The controller challenged the decision with the Administrative Court of Stockholm. The Court dismissed the action in so far as it concerned the breach of Article 13. The controller further challenged the decision with the Administrative Court of Appeal of Stockholm. Contrary to the DPA and the first instance court, the Court of Appeal held that in the case at hand, Article 14 applied instead of Article 13. On this basis, the Court annulled the DPA’s fine with regards to the SEK 4,000,000 that related to the violation of Article 13. The DPA challenged the Court of Appeal’s decision before the Supreme Administrative Court and claimed that Article 13 GDPR was the applicable provision and the correct ground for fining the controller. The Supreme Administrative Court then referred case to the CJEU for a preliminary ruling. = The Supreme Administrative Court referred the following question to the CJEU: “which of Articles 13 and 14 of the GDPR applies where personal data are obtained by a body camera?”. The controller and the DPA put forward different interpretations: * Under the DPA’s interpretation, Article 14 applies whenever the data subject is not the source of the data, regardless of its involvement in the collection of the data. This interpretation was in line with EDPB guidance and the case laws of DPAs; * Under the controller’s interpretation, Article 14 applies when the data subject does not actively take part in the collection of their data through a deliberate action (for instance, by filling out a form). Articles 13 and 14 both regulate the controller’s duty to provide information about the processing of personal data but differ in several ways, including the applicable exemptions and the time at which the information must be provided. In the case at hand, the difference mattered because the controller argued for the exemption found under Article 14(5)(b): “paragraphs 1 to 4 shall not apply where and insofar as (…) the provision of such information proves impossible or would involve a disproportionate effort”. On 1 August 2025 the AG delivered its Opinion on the case. Based on CJEU case law, the AG clarified that Articles 13 and 14 are mutually exclusive and that the scope of Article 14 is defined negatively by reference to Article 13 of the GDPR. In other words, Article 14 covers any processing of personal data that is not covered by Article 13. The AG held that Article 13 applies whenever the data subject is the source of the data (“collected from the data subject”), regardless of the data subject’s involvement in the collection of the data. In other words, for Article 13 to apply, “there should be no intermediary between the data subject and the controller"Margin 30.. It follows that Article 14 applies whenever the data are collected from a source other than the data subject. In this regard, the AG also pointed to the wording of Article 14(2)(f) GDPR and Recital 62 GDPR, as both support this interpretation. Finally, the AG clarified that the view that Article 13 applies to data collection by means of a body camera, is in line with the general principle of transparency. Unlike Article 14, Article 13 requires the controller to provide information immediately. This allows data subjects to adapt their behavior or even to refrain from entering the area under surveillance. For these reasons, the AG held that the case at hand fell under Article 13 GDPR. TBD