On Friday 1 August 2025, Advocate General Medina delivered her Opinion in Case C‑422/24, Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) v AB Storstockholms Lokaltrafik (SL). The case was referred to the Court of Justice of the European Union by the Supreme Administrative Court of Sweden (Högsta förvaltningsdomstolen).
The case concerns the use of body-worn cameras by ticket inspectors on public transport in Stockholm, Sweden, and raises a key question under the General Data Protection Regulation (GDPR) when personal data are collected via such cameras. The question: does the obligation to inform data subjects fall under Article 13 or Article 14 of the GDPR?
In her Opinion, she advised the Court that it is Article 13 GDPR which applies in situations where personal data are collected directly from the data subject, even if passively, such as through observation by body-worn cameras. She rejected the argument advanced by SL that Article 14 GDPR (which allows for delayed and more flexible information provision) could apply in this context. For her, the decisive factor is the source of the data, not the data subject’s awareness or active participation.
Facts and Background
The case before the Court of Justice of the European Union (CJEU) concerns the use of ‘body-worn cameras’ by ticket inspectors employed by AB Storstockholms Lokaltrafik (SL), the public transport operator in Stockholm, Sweden. These cameras, worn throughout inspectors’ shifts, record audio and video continuously, with a circular memory system that automatically deletes footage unless manually preserved. The company states the purpose of some of its employees wearing body-worn cameras is twofold: 1) to prevent threats made by users of public transport against its employees, and to documents them where made; and, 2) to identify travellers who have been issued with fines for not having the correct tickets when making use of public transport.
SL instructed inspectors to retain footage in cases involving fines or threats.
In 2021, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) issued a supervisory decision finding that SL had breached of several provisions of the General Data Protection Regulation (GDPR), notably Article 13 GDPR, for failing to provide adequate information to data subjects – transport users. SL was fined SEK 16 million, with SEK 4 million specifically for the information-related breach.
Article 13 GDPR concerns information to be provided where personal data are collected from the data subject, and Article 14 GDPR concerns information to be provided where personal data have not been obtained from the data subject.
SL challenged the decision. On the case reaching the and the Administrative Court of Appeal of Stockholm (Kammarrätten i Stockholm), it annulled the fine, reasoning that Article 14 GDPR, not Article 13, applied. The Administrative Court of Appeal of Stockholm relied on the judgment in Ryneš (C-212/13), suggesting that video surveillance does not involve data collection ‘from’ the data subject.
On an appeal taken by the Swedish Authority for Privacy Protection to the Supreme Administrative Court of Sweden (Högsta förvaltningsdomstolen), that national court has made a reference for a preliminary ruling to the Court for an interpretation of Articles 13-14 GDPR, as applied to the case at hand.
The jist of the case concerns which provision of the GDPR applies – Article 13 GDPR or Article 14 GDPR? The distinction is crucial, as Article 13 GDPR requires immediate information provision, while Article 14 GDPR allows for delayed notification and includes broader exceptions.
Opinion of the Advocate General
AG Medina began by emphasising that Article 13 GDPR and Article 14 GDPR are mutually exclusive. For her, Article 13 GDPR applies when data are collected directly from the data subject, while Article 14 GDPR applies when data are obtained from another source. The determinant is the source of the data, and not the awareness or participation of the data subject.
She rejected the notion that Article 13 GDPR requires active involvement by the data subject (e.g., filling out a form). Instead, she affirmed that observation-based collection, such as via cameras, still constitutes direct collection under Article 13 GDPR if the data subject is the source.
AG Medina addressed the argument that Article 13 GDPR presupposes the data subject’s awareness of the collection. She countered that such awareness is not a prerequisite, but rather a consequence of the controller’s obligation to inform. For her, the GDPR, taken as a whole, mandates that information be provided at the time of collection, thereby enabling awareness.
SL argued that the layered approach to information provision – using signage, QR codes, or websites – is more compatible with Article 14 GDPR, which allows for exceptions where providing information is impossible or disproportionate.
She rejected this, noting that Article 12 GDPR requires controllers to take appropriate measures to provide information, regardless of whether Article 13 GDPR or Article 14 GDPR applies. The layered approach, for her, was not impractical for body-worn cameras; as it is already widely used in video surveillance, which shares similar privacy risks.
She cited EDPB Guidelines on Video Surveillance and national guidance in other EU Member States, which recommend visible notices, camera symbols, and optical signals (e.g., red lights) to inform data subjects – transport users. For her, these measures were feasible and effective, and their use supports the application of Article 13 GDPR.
Turning to the issue of timing, the AG noted that Article 13 GDPR requires information to be provided at the time of collection, while Article 14 GDPR allows for a delay of up to one month. In her reasoning, she stated that applying Article 14 GDPR to body-worn cameras would undermine the effet utile of Article 13 GDPR, allowing controllers to delay or avoid informing data subjects, despite collecting data directly from them. This could lead to hidden surveillance practices, violating the GDPR’s transparency principle and the fundamental right to privacy under Article 8 of the Charter.
Therefore, AG Medina concluded that Article 13 GDPR applies when personal data is collected via body-worn cameras by ticket inspectors on public transport. If the Court agrees with her conclusion, this means SL was required to provide information at the time of collection, and the Swedish Authority for Privacy Protection was justified in imposing a fine for SL’s failure to do so. If the Court agrees with the conclusion of her Opinion, the Supreme Administrative Court of Sweden would be expected to reverse the judgment of the Administrative Court of Appeal of Stockholm, and uphold the fine against SL.
The judgment of the First Chamber of the Court can be expected later in 2025.
Read the Opinion
The Opinion of Advocate General Medina in Case C‑422/24, Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) v AB Storstockholms Lokaltrafik (SL), delivered on Friday 1 August 2025, referred by the Supreme Administrative Court of Sweden (Högsta förvaltningsdomstolen) can be read here.