Core Question:
When ticket inspectors use body cameras to record passengers (images + sound), does the duty to inform under the GDPR fall under Article 13 (direct collection) or Article 14 (indirect collection)?
Key Findings:
- Direct Collection = Article 13
- Data from a body camera is collected directly from the data subject by observation, without intermediaries.
- Article 13 applies even if the subject does not actively provide data or is unaware before recording.
- Awareness of surveillance should result from compliance with Article 13, not be a precondition for it.
- Why Not Article 14?
- Article 14 covers indirect collection (data from third parties or other sources).
- Using Article 14 here would weaken transparency, delay informing subjects, and risk hidden surveillance.
- Timing of Information:
- Article 13 requires info “at the time when personal data are obtained” (immediately).
- Article 14 allows delays (up to 1 month), but these are irrelevant for direct body cam collection.
- Practical Application – Layered Approach:
- Controllers must take appropriate measures (Art. 12 GDPR) to inform clearly and accessibly.
- For body cams, warning signs act as the first layer; more detailed info (e.g., via QR codes, websites, printed leaflets) forms the second layer.
- This method, used in fixed CCTV, is equally applicable to mobile body cameras.
- No Exception for Disproportionate Effort:
- The Art. 14(5)(b) “disproportionate effort” exemption is irrelevant because the collection is direct.
- Risk & Transparency Principle:
- Body cam recording is as intrusive as fixed CCTV and carries high privacy risks.
- Transparency is essential so that people can adapt their behaviour or avoid monitored areas.
Conclusion of the Advocate General:
For personal data collected by body cameras worn by ticket inspectors in public transport, Article 13 GDPR applies and Article 14 does not.