Provisional text

JUDGMENT OF THE COURT (First Chamber)

18 December 2025 (*)

( Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject )

In Case C‑422/24,

REQUEST for a preliminary ruling under Article 267 TFEU from the Högsta förvaltningsdomstolen (Supreme Administrative Court, Sweden), made by decision of 13 June 2024, received at the Court on 17 June 2024, in the proceedings

Integritetsskyddsmyndigheten

AB Storstockholms Lokaltrafik,

THE COURT (First Chamber),

composed of F. Biltgen, President of the Chamber, T. von Danwitz (Rapporteur), Vice-President of the Court, I. Ziemele, A. Kumin and S. Gervasoni, Judges,

Advocate General: L. Medina,

Registrar: A. Calot Escobar,

having regard to the written procedure,

after considering the observations submitted on behalf of:

– the Integritetsskyddsmyndigheten, by C. Agnehall, A. Persson and D. Törngren, acting as Agents,

– AB Storstockholms Lokaltrafik, by J. Forzelius, advokat, and G. Tranvik, biträdande jurist,

– the Danish Government, by D. Elkan, C.A.‑S. Maertens, J. Sandvik Loft and M. Jespersen, acting as Agents,

– the Austrian Government, by A. Posch, J. Schmoll and C. Gabauer, acting as Agents,

– the European Commission, by A. Bouchagiar, C. Faroghi and H. Kranenborg, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 1 August 2025,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).

2 The request has been made in the context of a dispute between the Integritetsskyddsmyndigheten (Authority for Privacy Protection, Sweden) (‘the Authority’) and AB Storstockholms Lokaltrafik (‘SL’), a Swedish public transport company, concerning an administrative fine imposed on the latter for infringing Article 13 of the GDPR in the context of the collection of personal data by means of body cameras worn by ticket inspectors working for that company.

Legal context

3 Recitals 60 and 61 of the GDPR state:

‘(60) The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed. Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling. Where the personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of the consequences, where he or she does not provide such data. That information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable.

(61) The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case. Where personal data can be legitimately disclosed to another recipient, the data subject should be informed when the personal data are first disclosed to the recipient. Where the controller intends to process the personal data for a purpose other than that for which they were collected, the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information. Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided.’

4 Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, provides:

‘1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);

…

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);

…’

5 Article 12 of the GDPR, entitled ‘Transparent information, communication and modalities for the exercise of the rights of the data subject’, is worded as follows:

‘1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language … The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. …

…

5. … Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

…

(b) refuse to act on the request.

The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

…’

6 Article 13 of the GDPR, headed ‘Information to be provided where personal data are collected from the data subject’, provides:

‘1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the [European] Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(d) the right to lodge a complaint with a supervisory authority;

(e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.’

7 Under Article 14 of the GDPR, headed ‘Information to be provided where personal data have not been obtained from the data subject’:

‘1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) the categories of personal data concerned;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;

(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(e) the right to lodge a complaint with a supervisory authority;

(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

(g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

3. The controller shall provide the information referred to in paragraphs 1 and 2:

(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

(b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

5. Paragraphs 1 to 4 shall not apply where and insofar as:

(a) the data subject already has the information;

(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;

(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or

(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.’

The dispute in the main proceedings and the question referred for a preliminary ruling

8 SL operates public transport services in Stockholm (Sweden). That company has equipped its ticket inspectors with body cameras, used to film passengers who do not have a valid ticket when ticket inspections are carried out and who are thus issued with a fine. The use of those cameras is intended to prevent and document threats and violence against ticket inspectors and to verify the identity of passengers subject to such a fine.

9 In the course of its supervisory activities, the Authority examined whether SL’s processing of personal data by means of body cameras complied with the rules set out in the GDPR. In June 2021, it adopted a decision from which it is apparent that the ticket inspectors are to wear the cameras throughout their shift and that they are continuously to record video with images and sound.

10 Those cameras have a ‘circular’ memory, which means that, after a certain period of time, all recorded content is automatically overwritten. Once that overwriting process is complete, the recorded material is deleted. Initially, the recorded material was stored for two minutes but, during the supervision audit carried out by the Authority, that period was shortened to one minute. By pressing a button, however, ticket inspectors can interrupt the automatic overwriting process and thus ensure that recorded data are not deleted. In that case, the information stored in the camera is also preserved by means of pre-recording technology, where the information is recorded during the minute preceding the moment the ticket inspector pressed the button. Ticket inspectors are instructed to interrupt the automatic overwriting process in all situations where a fine is issued and, moreover, where threats to their person arise.

11 In addition to those findings relating to the use and operation of body cameras, the Authority took the view, in its decision, that SL had, from December 2018 until the date of adoption of that decision in June 2021, processed personal data using body cameras in the course of ticket inspections, in breach of several provisions of the GDPR. In its view, SL had not provided sufficient information to the data subjects, thereby failing to comply with Article 13 of the GDPR. Consequently, the Authority imposed on SL an administrative fine totalling 16 million kronor (SEK) (approximately EUR 1 420 670), of which SEK 4 million (approximately EUR 355 188) was for failure to provide information to the data subjects.

12 The Förvaltningsrätten i Stockholm (Administrative Court, Stockholm, Sweden), before which SL had brought an action against the Authority’s decision, dismissed that action in so far as it concerned the fine imposed on that company for failing to provide information to the data subjects.

13 SL then brought an appeal before the Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm, Sweden), which set aside the judgment of the court of first instance and annulled the Authority’s decision as regards the imposition of that fine. That court held, referring to the judgment of 11 December 2014, Ryneš (C‑212/13, EU:C:2014:2428), that Article 13 of the GDPR was not applicable to the dispute brought before it and, therefore, that the Authority was not justified in imposing on SL an administrative fine for infringement of that provision.

14 The Authority brought an appeal against the judgment of the Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm) before the Högsta förvaltningsdomstolen (Supreme Administrative Court, Sweden), which is the referring court, requesting it to set aside that judgment in so far as it concerns the fine imposed on that company for providing inadequate information to the data subjects.

15 The referring court states, first of all, that the question that arises is which of Articles 13 and 14 of the GDPR applies where personal data are collected by means of a body camera. In its view, the answer to that question is necessary in two respects. First, it is necessary to determine which information is to be provided to the data subject, at what point the obligation to provide information to that person arises and what the exceptions to that obligation are. Secondly, it is necessary to establish whether the Authority was entitled to impose an administrative fine on SL on the ground that that company had not complied with the obligation to provide information laid down in Article 13 of the GDPR.

16 Next, according to the referring court, it is also unclear to what extent the differences between Articles 13 and 14 of the GDPR, as regards the scope of the obligation to provide information contained in those provisions, must be taken into account in determining which of them applies to a particular type of collection of personal data. In that regard, it states that the parties disagree as to the conclusion to be drawn from those differences.

17 Lastly, the referring court is uncertain as to the importance to be attached to the Guidelines on transparency under Regulation 2016/679, adopted on 29 November 2017, in their revised version of 11 April 2018, by the Working Party established by Article 29 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), which provide, in paragraph 26, that Article 13 of the GDPR is applicable to video surveillance.

18 It is in those circumstances that the Högsta förvaltningsdomstolen (Supreme Administrative Court) decided to stay the proceedings and to refer the following question to the Court for a preliminary ruling:

‘Which of Articles 13 and 14 of the GDPR applies where personal data are [collected] by [means of] a body camera?’

The request that the oral part of the procedure be reopened

19 Following the delivery of the Advocate General’s Opinion on 1 August 2025, SL requested, by document lodged at the Registry of the Court of Justice on 23 September 2025, that the oral part of the procedure be reopened, in accordance with Article 83 of the Rules of Procedure of the Court of Justice.

20 In support of that request, SL argues that the Court was not sufficiently informed about the facts of the main proceedings and about the significance that a decision in that case would have for data controllers making use of video surveillance systems. In particular, it maintains that the Opinion delivered by the Advocate General did not correctly define the respective scopes of Articles 13 and 14 of the GDPR.

21 In that regard, it should be noted that, under the second paragraph of Article 252 TFEU, it is the duty of the Advocate General, acting with complete impartiality and independence, to make, in open court, reasoned submissions on cases which, in accordance with the Statute of the Court of Justice of the European Union, require his or her involvement. The Court is not bound either by the Advocate General’s Opinion or by the reasoning on which it is based (judgment of 4 September 2025, Nissan Iberia, C‑21/24, EU:C:2025:659, paragraph 30 and the case-law cited).

22 It should also be noted, in that context, that the Statute of the Court of Justice of the European Union and the Rules of Procedure make no provision for the parties or the interested persons referred to in Article 23 of that statute to submit observations in response to the Advocate General’s Opinion. The fact that a party or such an interested person disagrees with the Advocate General’s Opinion, irrespective of the questions examined in the Opinion, cannot therefore, in itself, constitute grounds justifying the reopening of the oral procedure (judgment of 4 September 2025, Nissan Iberia, C‑21/24, EU:C:2025:659, paragraph 31 and the case-law cited).

23 It follows that, in so far as SL’s request that the oral part of the procedure be reopened is intended to enable it to respond to the position expressed by the Advocate General in her Opinion, that request cannot be granted.

24 That being so, under Article 83 of the Rules of Procedure, the Court may at any time, after hearing the Advocate General, order the reopening of the oral part of the procedure, in particular if it considers that it lacks sufficient information, or where a party has, after the close of that part of the procedure, submitted a new fact which is of such a nature as to be a decisive factor for the decision of the Court, or where the case must be decided on the basis of an argument which has not been debated between the parties or the interested parties referred to in Article 23 of the Statute of the Court of Justice of the European Union.

25 In the present case, however, the Court considers, having heard the Advocate General, that it has all the information necessary to answer the question referred by the referring court and that the present case does not need to be decided on the basis of an argument that has not been debated between the interested parties. Furthermore, the request that the oral part of the procedure be reopened does not reveal any new fact that is of such a nature as to be a decisive factor for the decision that the Court is called upon to give in the present case.

26 In those circumstances, there is no need to order the reopening of the oral part of the procedure.

Consideration of the question referred

27 By its question, the referring court asks, in essence, whether Articles 13 and 14 of the GDPR must be interpreted as meaning that, in a situation in which personal data are collected by means of a body camera worn by ticket inspectors on public transport, the provision of information to the data subjects is governed by Article 13 of the GDPR or by Article 14 thereof.

28 In order to answer that question, it is necessary, in accordance with the Court’s settled case-law, to consider not only the wording of those provisions but also their context and the objectives pursued by the legislation of which they form part (judgment of 28 November 2024, Másdi, C‑169/23, EU:C:2024:988, paragraph 39).

29 As regards, in the first place, the wording of Articles 13 and 14 of the GDPR, it should be noted that the material scope of Article 14 of the GDPR is defined negatively by reference to that of Article 13 of that regulation. As is apparent from those provisions’ headings themselves, Article 13 concerns the information to be provided where personal data are collected from the data subject, while Article 14 concerns the information which must be provided where personal data have not been obtained from the data subject (judgment of 28 November 2024, Másdi, C‑169/23, EU:C:2024:988, paragraph 48).

30 For the purposes of distinguishing the respective scopes of those provisions, the fact that, in certain language versions of Article 14 of the GDPR, in particular the Swedish-language version, the term ‘collected’ (‘samlas in’) appearing in Article 13 of that regulation is not repeated, is not decisive.

31 It is settled case-law that provisions of EU law must be interpreted and applied uniformly in the light of the versions existing in all the languages of the European Union and, where there is any divergence between those various versions, the provision in question must be interpreted by reference to the general scheme and the purpose of the rules of which it forms part (judgment of 13 February 2025, Verbraucherzentrale Berlin (Concept of initial commitment period), C‑612/23, EU:C:2025:82, paragraph 31 and the case-law cited).

32 In that regard, the Court has previously stated, as regards the use of the term ‘obtaining’ (‘erhållande’) in Article 14(5)(c) of the GDPR, which, in the Swedish-language version, is also used in the heading of Article 14 and in paragraph 1 thereof (‘erhållits’), that that term does in fact refer to data ‘collected’ from a person other than the data subject and to those which the controller itself generated, in the performance of its tasks, from those data (see, to that effect, judgment of 28 November 2024, Másdi, C‑169/23, EU:C:2024:988, paragraph 47).

33 Furthermore, as the Advocate General observed in point 28 of her Opinion, the term data ‘collected’ from the data subject as referred to in Article 13(1) of the GDPR requires specific action not on the part of the data subject, but solely on the part of the data controller, with the result that the degree of activity of the data subject is irrelevant for the purposes of delimiting the scope of that provision in relation to that of Article 14 of that regulation.

34 That consideration is also highlighted in the Guidelines on transparency, referred to in paragraph 17 of the present judgment, from which it is apparent that Article 13 of the GDPR applies either where the data subject knowingly provides personal data to the controller or where the controller collects the data from that data subject by observation, in particular by means of cameras.

35 In the light of the wording of Article 14(2)(f) of the GDPR, read in the light of recital 61 of that regulation, it must be held that only the source of the personal data collected is the relevant criterion for the purposes of determining the respective scopes of Articles 13 and 14 of the GDPR. Under Article 14(2)(f), where the data have not been obtained from the data subject, the controller must inform the data subject of the source of the personal data.

36 It follows that a literal interpretation of Articles 13 and 14 of the GDPR, read in the light of recital 61 of that regulation, militate in favour of the application of Article 13 to the collection of personal data by means of a body camera, since, in that situation, those data are not obtained from a source other than the data subject, but are obtained directly from that data subject.

37 In the second place, such an interpretation is supported by the context into which those provisions fit.

38 In that regard, it follows from Article 5 of the GDPR that the processing of personal data must, inter alia, satisfy specific requirements of transparency with regard to the data subject concerned by such processing (judgment of 11 July 2024, Meta Platforms Ireland (Representative action), C‑757/22, EU:C:2024:598, paragraph 53).

39 As the Commission has noted, in essence, in its written observations, by requiring that the information referred to in Article 13 of the GDPR be disclosed to the data subject at the time it is obtained, that article gives specific expression to the right of that person to be informed. By contrast, Article 14 of that regulation was adopted in order to respond to situations in which the controller is not in direct contact with the data subject, but collects the personal data from another source, with the result that the disclosure of the information referred to in that provision at the time when that information is obtained is, in practice, made difficult or even impossible. The indirect nature of such collection therefore justifies the latter provision providing for the possibility of deferring the controller’s obligation to provide information.

40 In the third place, it is necessary to interpret Articles 13 and 14 of the GDPR in the light of the objective of that regulation, which consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data, enshrined in Article 16 TFEU and guaranteed as a fundamental right in Article 8 of the Charter of Fundamental Rights of the European Union, which supplements the right to private life guaranteed in Article 7 thereof (judgment of 27 February 2025, Dun & Bradstreet Austria and Others, C‑203/22, EU:C:2025:117, paragraph 51 and the case-law cited).

41 If it were accepted that Article 14 of the GDPR applies where personal data are collected by means of a body camera, the data subject would not receive any information at the time of collection, even though he or she is the source of those data, which would allow the controller not to provide information to that data subject immediately. Therefore, such an interpretation would carry the risk of the collection of personal data escaping the knowledge of the data subject and giving rise to hidden surveillance practices. Such a consequence would be incompatible with the objective, referred to in the preceding paragraph, of ensuring a high level of protection of the fundamental rights and freedoms of natural persons.

42 That said, it should be noted that that objective does not preclude, as envisaged by European Data Protection Board (EDPB) Guidelines 3/2019 on processing of personal data through video devices, adopted on 29 January 2020, the obligations to provide information under Article 13 of the GDPR from being implemented in the context of a multi-layered approach. According to those guidelines, the most important information intended for the data subject may be indicated, at a first layer, on a warning sign, and the other mandatory information may be provided to that person, at a second layer, in an appropriate and complete manner, in an easily accessible place.

43 Lastly, it should also be stated, in response to the doubt expressed by the Kammarrätten i Stockholm (Administrative Court of Appeal, Stockholm) as to the scope of paragraph 34 of the judgment of 11 December 2014, Ryneš (C‑212/13, EU:C:2014:2428), referred to in paragraph 13 above, that the Court did not rule, in paragraph 34 of that judgment, on the scope of Article 11 of Directive 95/46, to which Article 14 of the GDPR corresponds, in relation to Article 10 of that directive, to which Article 13 of that regulation corresponds, but merely illustrated that, on account of the various limitations and exceptions provided for by that directive, its application allows the legitimate interests pursued by the controller to be taken into account.

44 Accordingly, it cannot be inferred from paragraph 34 of that judgment that the Court has previously ruled on the distinction between the scope of Article 13 of the GDPR, on the one hand, and that of Article 14 of that regulation, on the other.

45 In the light of the foregoing considerations, the answer to the question referred is that Articles 13 and 14 of the GDPR must be interpreted as meaning that, in a situation in which personal data are collected by means of a body camera worn by ticket inspectors on public transport, the provision of information to the data subjects is governed by Article 13 of that regulation and not by Article 14 thereof.

Costs

46 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (First Chamber) hereby rules:

Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC,

must be interpreted as meaning that in a situation in which personal data are collected by means of a body camera worn by ticket inspectors on public transport, the provision of information to the data subjects is governed by Article 13 of that regulation and not by Article 14 thereof.

[Signatures]

* Language of the case: Swedish.