José Carlos Erdozain. Of Counsel at PONS IP

The judgment issued by the Court of Justice of the European Union on 18 December (Case C-422/24) answers the question of what is the effective scope of the obligation to inform public transport users about the processing of their data by body cameras worn by inspectors in order to record possible threats or physical assaults, as well as to provide evidence of travel without a valid ticket. The dispute arose between the Swedish supervisory authority and the public transport company.

It should be noted that the cameras had an automatic deletion mechanism for recorded content that lasted at least one minute. In any case, ticket inspectors could alter this recording process in such a way as to prevent deletion in circumstances such as those described.

The controversy arises because, according to the Swedish supervisory authority, the transport company did not adequately inform passengers about the processing of their personal data by means of these cameras. However, the sanctioned company disagreed, arguing that no sanction could be imposed on the basis of Article 13 of the GDPR (which regulates the content of the duty to provide information), since it was, rather, a case of processing obtained indirectly from the data subject, and therefore Article 14 of the GDPR (which regulates the content of the duty to provide information when the data is not obtained directly from the data subject) was applicable. If the latter argument had been accepted, the scope of the duty to provide information would have been narrower and the sanction would not have been applicable.

In line with this fundamental issue, the European Court of Justice has ruled on how the verb “obtains” should be interpreted in both provisions. In that sense, it states that Article 14 of the GDPR applies when personal data is “obtained” from a person other than the data subject, as well as data generated by the controller in the exercise of its function based on that data. On the other hand, Article 13 of the GDPR applies when the data subject knowingly provides personal data to the controller or when the latter obtains the data from the data subject through observation, including through cameras.

Thus, what is relevant in order to delimit the scope of application of Articles 13 and 14 of the GDPR is not so much the activity carried out by the data subject whose data is being processed, but rather the source from which the controller obtains or processes the data in question.

Applying the above to the case brought before the Court of Justice, the conclusion can only be that processing via body cameras requires the data subject to be directly informed of all the aspects referred to in Article 13 of the GDPR (i.e. the identity of the controller, the purposes of the processing, the rights of the data subject, etc.). Otherwise, as the Court rightly points out, covert surveillance recordings could be justified, which would not duly respect the fundamental rights and freedoms of citizens. It should also be borne in mind that this duty to provide information can be fulfilled on two levels or layers, without the controller having to provide exhaustive information on all aspects of the processing in the first instance.

This ruling raises the question of what happens, for example, with recordings made by private detectives or even by hidden cameras. To be legal, should the person being recorded be expressly informed of the fact of the recording, its purposes, etc.? Would this not be contrary to the intended purpose of such recordings?

To begin with, I believe it is appropriate to start from the premise that the CJEU’s judgments are very precise and are handed down in relation to very specific facts. In fact, the ruling emphasises that the context in which it is handed down is “in a situation where personal data is obtained by body cameras worn by inspectors on public transport. It is particularly relevant to note this point. The doctrine established here should not, therefore, be extrapolated to any case of image capture by means of recording cameras.

That said, it is no less true that our Constitutional Court has established (SC 25/2019) that recording using these techniques without freedom of information prevailing is contrary to the fundamental rights to privacy and one’s own image. In the opinion of the Constitutional Court, if there is a less invasive or alternative means, it should be used as a priority. However, constitutional case law is inconsistent in this regard, since on other occasions it has admitted, for example, dismissals based on recordings when workers have not been warned of the existence of cameras (STC 119/2022).

In conclusion, the use of cameras to record images of people is subject to possible legal restrictions that must be weighed up before proceeding with any recording. The validity of these in proceedings, not to mention the possibility of being administratively sanctioned for violating personal data protection regulations, depends on this.