New CJEU Decision On Body-Worn Cameras And The Duty To Inform

In its decision dated 18 December 2025 (Case C-422/24), the Court of Justice of the European Union (CJEU) classified recordings made through body-worn cameras used in security and inspection processes as "direct collection" of personal data.

A summary of the facts and the Court's approach is set out below.

FACTS

The case arose from an administrative fine imposed by the Swedish Data Protection Authority on Stockholm's public transport operator, SL, due to the use of body-worn cameras by ticket inspectors. In its defence before the court, SL focused on two main arguments:

• Individuals recorded by body-worn cameras do not actively participate in the process or demonstrate any intention to provide data; therefore, the situation should fall under Article 14 of the GDPR (personal data not obtained from the data subject – indirect collection), rather than Article 13 (personal data obtained from the data subject – direct collection).
• If the process were to be classified as indirect collection, the duty to inform should be exempted under Article 14(5)(b) of the GDPR on the grounds of impossibility or disproportionate effort, given that providing individual notices to each passenger in a crowded environment would be impracticable.

DECISION

In line with the Opinion of the Advocate General, the Court held that recordings made via body-worn cameras constitute "direct collection of personal data" and therefore fall within the scope of Article 13 of the GDPR. The Court based its decision on the following reasoning:

• "Direct collection" does not require the data subject to knowingly provide the data or to take any active step.
• Data obtained solely by observing the data subject is also deemed to be collected directly from that person.
• Article 14 (indirect collection) applies only where the controller obtains personal data from a third party or from another source, not from the data subject themselves.

IMPACT

This decision has important implications for both the timing and the method of fulfilling the duty to inform:

• Timing: Since the data is collected directly, the information notice must be provided at the time of recording (or prior to it).
• Method (Layered Notice): To address practical challenges, the Court endorsed the use of a "layered information" approach. Accordingly, the most essential information (such as the identity of the data controller and the purposes of processing) should be provided immediately via a sign or notice, while more detailed information should be made easily accessible through other means (e.g. a website, QR code, etc.).

FROM A TURKISH DPL (KVKK) PERSPECTIVE

As is known, the principles governing the fulfilment of the duty to inform are regulated under the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

The matters set out in Article 13 of the GDPR correspond to Article 4 of the Communiqué, while indirect collection is regulated under Article 6 thereof. In addition, the KVKK guidelines also address points to be considered in cases of direct and indirect collection of personal data.

In this context, it is considered that the CJEU's decision may serve as a reference for the interpretation of the relevant provisions under Turkish data protection legislation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.