Data protection and security in public spaces readjusted

With its ruling of 18 December 2025 (C-422/24), the European Court of Justice (ECJ) has set a key course for the use of body cameras in Europe. The decision focuses on a question of high practical relevance for transport companies, security services and local authorities: What data protection information obligations apply when employees wear body cameras?

The decision provides legal certainty across Europe, but at the same time tightens the requirements for transparency, protection of fundamental rights and legally compliant security concepts in public spaces.

Key finding of the ruling: Art. 13 GDPR is mandatory

The ECJ makes it unambiguously clear that Art. 13 GDPR is applicable to the use of body cameras. In this context, personal data is collected directly from the data subject as soon as they are recorded by a body camera. It follows that the necessary data protection information must be provided at the time of recording. Subsequent information, as provided for in Article 14 GDPR, is generally not permissible in the case of body cameras, as no data is collected from other sources.

With this interpretation, the Court of Justice defines a binding standard for all forms of personal video recording by wearable cameras in public spaces.

Background to the proceedings: Fine imposed on Stockholm transport company

The starting point for the decision was a case from Sweden. Since 2018, the public transport company AB Storstockholms Lokaltrafik (SL) had equipped ticket inspectors with body cameras to document assaults, prevent escalations and increase staff safety. This goal is becoming increasingly important in view of rising violence on public transport across Europe.

However, in 2021, the Swedish Data Protection Authority imposed a fine of around €355,000. It justified this by stating that passengers had not been properly informed about the video recording in accordance with Article 13 of the GDPR. SL, on the other hand, took the view that this was data collection in accordance with Article 14 of the GDPR, as the data subjects had not actively provided their data. The ECJ has now clearly rejected this argument.

Direct collection by body cameras: Why Article 13 applies

In the opinion of the Court, the decisive factor is that the person being filmed is the source of the personal data. Whether the data subject is actively involved or aware of the recording is legally irrelevant. The only decisive factor is that the data is generated directly through contact between the camera and the person.

This constitutes direct collection of personal data, which is why Article 13 GDPR must be applied. Art. 14 GDPR remains limited to situations in which data comes from external sources and there is no direct contact with the data subject, such as in the case of databases or third-party transfers. This clarification is of considerable importance for security-related scenarios, as it legally excludes covert or delayed video recordings.

Time of information: immediately, not retrospectively

The ECJ takes a particularly clear position on the time of information. The mandatory information required under data protection law must be provided at the start of the recording. A later or merely theoretical possibility of providing information is not sufficient.

The Court expressly warns of the danger of covert surveillance and points out that a lack of or delayed information may lead to violations of the fundamental rights to respect for private life and the protection of personal data under Articles 7 and 8 of the EU Charter of Fundamental Rights. Transparency is thus understood as an essential component of security measures that comply with fundamental rights.

Practical implementation: the tiered information model

For practical implementation, the ECJ refers to the European Data Protection Board’s Guidelines 3/2019 on video surveillance. These provide for a tiered information model that is particularly suitable for dynamic operational situations such as the use of body cameras.

In the first stage, the key information must be provided immediately and clearly visible at the location of use. This includes, in particular, the name and contact details of the controller, the purpose of the recording – such as self-protection or de-escalation – the underlying legal basis, a reference to the rights of data subjects and basic information on the storage period of the recordings.

In a second stage, the complete data protection information can be made available in easily accessible locations. This can be done, for example, via QR codes, notices in vehicles or buildings, or via the website of the responsible operator. This ensures transparency without practically hindering operational security measures.

Body cameras remain permissible – but only with a system

The ruling makes it clear that body cameras are not prohibited. However, their use requires a comprehensive data protection and security concept. In particular, a clearly defined and event-related deployment concept, a clear purpose limitation of data processing and the proper documentation of all processing activities are required.

In addition, existing service or works agreements must be adapted, a data protection impact assessment must be carried out, and appropriate technical and organisational measures must be implemented. Only the interaction of these organisational, legal, and technical elements enables legally compliant and, at the same time, practical use.

De-escalation as security-related added value

The ECJ expressly does not question the security-related benefits of body cameras. On the contrary, numerous practical experiences show that the visible activation of the camera often has a de-escalating effect.

In particular, transparent systems with a clearly recognisable recording indicator can curb aggressive behaviour at an early stage, protect emergency services personnel and provide reliable evidence in serious cases. Body cameras are thus increasingly seen not only as a means of documentation, but also as a preventive tool for security work.

Significance for security markets and operators

For transport companies, municipal law enforcement agencies and private security service providers, the message of the ruling is clear: data protection is not a downstream compliance issue, but an integral part of modern security architecture.

Visible and comprehensible information, short storage periods, clearly defined responsibilities and transparent processes are just as relevant to security as technical reliability or tactical deployment concepts.

Conclusion: transparency as a prerequisite for security and acceptance

The ECJ ruling of December 2025 sets binding guidelines for the use of body cameras throughout Europe. It strengthens the rights of those affected and at the same time provides operators with clear guidance for legally compliant security solutions.

Body cameras remain an important tool for dealing with violence and escalation in public spaces. However, their social acceptance and legal viability depend crucially on transparency, data protection and security being considered and implemented together from the outset.