The most important things in brief
In its judgment of December 18, 2025, the European Court of Justice made a groundbreaking decision regarding the use of Body-Cams in Europe. At its core, it concerns the question: What data protection information obligations apply when ticket inspectors, security personnel, or other employees wear body cameras?
The ECJ’s answer is clear: Art. 13 GDPR is applicable. This means that affected persons must be informed immediately at the time of recording and not only subsequently as with Art. 14 GDPR.
The judgment thus confirms a line that we at NetCo have been advocating for years: GDPR-compliant Body-Cam use is not only possible, but also mandatory for the protection of passenger rights as well as for the admissibility of evidence in court.
Inhaltsverzeichnis
Initial situation: 355,000 euro fine in Stockholm
Since December 2018, the Swedish transport company AB Storstockholms Lokaltrafik (SL) has equipped its ticket inspectors with Body-Cams. The goals were understandable: to document threatening situations, prevent assaults, and identify passengers without valid tickets. A concern that is gaining importance in view of increasing acts of violence against public transport personnel throughout Europe.
However, in June 2021, the Swedish Data Protection Authority imposed a fine of around 355,000 euros. The accusation: Passengers were not informed about the data processing in accordance with Art. 13 GDPR.
The transport company argued that this was data collection within the meaning of Art. 14 GDPR, since the passengers did not actively provide their data. The Supreme Administrative Court of Sweden finally submitted the question to the ECJ.
The core statements of the ECJ ruling
Article 13 GDPR is applicable – not Article 14
The ECJ clarifies: If a person is recorded by a Body-Cam, they themselves are the source of the data. The data is collected directly from the data subject, even if they are neither actively acting nor aware of the recording.
Article 14 GDPR only applies if the controller has no direct contact with the data subject and receives the data from another source. This is not the case with Body-Cams.
The information must be provided immediately
According to Art. 13 para. 1 GDPR, the information must be provided “at the time of collection.” The ECJ emphasizes: Subsequent information is generally not sufficient for Body-Cams. Those affected should be able to understand as early as possible that filming is taking place and for what purpose.
The Court warns: Without timely information, there is a risk of covert surveillance practices. This constitutes a violation of Articles 7 and 8 of the EU Charter of Fundamental Rights.
Practical implementation: The layered information model
The ECJ refers to the Guidelines 3/2019 of the European Data Protection Board (EDPB) on video surveillance. According to these guidelines, the obligation to provide information can be fulfilled in a multi-layered procedure:
Level 1: On-site note
The most important information must be immediately visible – for example, on a sign in the vehicles, on the uniform of the inspection personnel, or via a signal light on the Body-Cam. The core information includes:
- Name and contact details of the responsible person
- Purpose of data processing (e.g., protection of personnel, de-escalation)
- Legal basis for processing
- Recipients of the data
- Storage duration of recordings
- Reference to rights to information and deletion
Level 2: Complete Data Protection Information
The complete mandatory information can be made available in an easily accessible location, such as via QR code on the information sign, posted in the vehicles, or on the transport company’s website.
GDPR-compliant Body-Cam deployment: How to implement it successfully
The ECJ ruling confirms what we at NetCo have been putting into practice for years: bodycams can be used in compliance with the GDPR—if the right measures are implemented from the outset. From camera recording to data processing, our solution complies with European data protection guidelines.
Checklist for GDPR-compliant use
To ensure the legal use of Body-Cams, the following points must be observed:
- Create an operational concept: The operation is only permitted if it is carried out for previously defined purposes related to the specific occasion.
- Define the purpose of processing: For example, protecting your own staff from assaults.
- Establish a processing directory: Documentation of all processing activities.
- Comply with transparency requirements: Implement the information obligation under Article 13 GDPR.
- Adapt company agreement: The deployment concept should become part of a service or company agreement.
- Conduct a data protection impact assessment: Risk assessment for the rights of data subjects.
- Take technical and organizational measures (TOM): Ensure the protection of personal data.
Tip: Free guide to GDPR-compliant body camera use offers proven strategies from market leaders and success stories with concrete figures.
Request for practical guidelines
„
In no other country is the use of body cams so heavily regulated by data protection laws. As the only German manufacturer, we know how to ensure GDPR-compliant use.
“
Dr. Matthias Hagner, CEO NetCo Body-Cam
De-escalation instead of mere documentation
The ECJ ruling strengthens information obligations but does not question the fundamental usefulness of Body-Cams. On the contrary, when used correctly, body cameras are an effective tool for de-escalation and for protecting staff.
The numbers speak for themselves: At Deutsche Bahn alone, over 75,000 acts of violence against employees have been recorded since 2022. The Railway and Transport Union (EVG) expressly supports the use of Body-Cams as a preventive measure.
The NetCo Body-Cam relies on a unique approach: the large front display with mirror function confronts aggressive individuals directly with their own behavior. This is followed by the opportunity for reflection and perception of possible consequences. This prevents criminal offenses – not just documenting them.
The results from practice:
- 75% de-escalation solely through activation of the display at the Duisburg Public Order Office
- Wiener Linien found that switching on the display led to a de-escalation in 50% of cases.
Proven in practice
NetCo Body-Cams have been successfully used in several countries for more than five years. Our customers include, for example:
- Deutsche Bahn: Deployment to protect inspection staff
- Cologne Transport Authority (KVB): Public transport safety in a city of millions
- Vienna Public Transport: De-escalation through front display
- Bremen Police: reliable resource since 2018
- Duisburg Public Order Office: consistently positive feedback from emergency services
- Duisburg Public Order Office: consistently positive feedback from emergency services
Sharing knowledge: The Body Cam Conference
The annual body-cam conference brings together experts from police, public transport, security services, and municipalities.
Under the motto “Expertise – Network – Best Practice,” the conference offers a platform for the latest developments, challenges, and best practices regarding the use of Body-Cams and all related topics, including data protection.
The next conference will take place on May 27, 2026, in Frankfurt.
Transparency and protection belong together.
The ECJ ruling sets a clear data protection standard: anyone who films people with Body-Cams must also inform them immediately. Reliance on Art. 14 GDPR, and thus the possibility of subsequent or absent information, is excluded for body cameras.
For transport companies, municipal law enforcement agencies and security companies, this means that Body-Cam concepts must be thought of holistically. In addition to a sustainable legal basis and short deletion periods, visible, understandable and multi-level data protection notices are indispensable.
As the only German manufacturer of Body-Cams, we at NetCo know the requirements of German data protection law exactly. Our solutions, from hardware to software to comprehensive guidelines, are specially developed for GDPR-compliant use.
Data protection cannot be an afterthought. Transparency begins with the first image.
Legal Foundations
- ECJ, judgment of December 18, 2025 – C-422/24
- Art. 13 GDPR – Duty to provide information when collecting data from the data subject
- Art. 14 GDPR – Duty to provide information when collecting data from other sources
- EDSA Guidelines 3/2019 on the processing of personal data by video devices
- Articles 7 and 8 of the EU Charter of Fundamental Rights
Frequently Asked Questions (FAQ)
Do passengers have to consent to the Body-Cam recording?
No. The recording can be made on the basis of a legitimate interest according to Art. 6 para. 1 lit. f GDPR. Consent is not required – but information according to Art. 13 GDPR is.
Does the ruling also apply to pre-recording functions?
Yes. As soon as the camera is activated and image data is captured, data collection is taking place. The NetCo Body-Cam offers a pre-recording function of up to 120 seconds – ensuring that crucial moments are always captured, even if the recording starts later.
Can Body-Cam recordings be used in court?
Yes – but only with GDPR-compliant use. The ruling emphasizes: Without adhering to the information obligations, transport companies risk not only fines but also the usability of the recordings. The NetCo solution was specifically developed for German data protection requirements.
How long may the recordings be stored?
As short as possible. The storage duration depends on the purpose. For the documentation of incidents, a few days to weeks is common. Longer retention periods require a special justification.