The most important points in brief In its ruling of 18 December 2025, the European Court of Justice made a landmark decision on the use of body cameras in Europe. The core question is: What data protection information obligations apply when ticket inspectors, security personnel or other employees wear body cameras?
The ECJ’s answer is clear: Article 13 of the GDPR applies. This means that data subjects must be informed at the time of recording and not retrospectively, as is the case with Article 14 of the GDPR.
The ruling thus confirms a position that we at NetCo have been advocating for years: GDPR-compliant use of body cameras is not only possible, but absolutely necessary for the protection of passenger rights and for the security of evidence in court. ## Table of contents ## The original case: £300,000 fine in Stockholm
The Swedish transport company AB Storstockholms Lokaltrafik (SL) has been equipping its ticket inspectors with body cameras since December 2018. The objectives were clear: to document threatening situations, prevent assaults and identify passengers without valid tickets. This is a concern that is becoming increasingly important in view of rising violence against public transport staff throughout Europe. Nevertheless, in June 2021, the Swedish Data Protection Authority imposed a fine of approximately £355,000. The accusation: passengers were not informed about data processing in accordance with Art. 13 GDPR.
The transport company argued that this was data collection within the meaning of Article 14 of the GDPR, as passengers did not actively provide their data. The Supreme Administrative Court of Sweden finally referred the question to the ECJ. ## The key points of the ECJ ruling ### Article 13 of the GDPR is applicable – not Article 14
The ECJ clarifies: If a person is recorded by a body camera, they themselves are the source of the data. The data is collected directly from the data subject, even if they are not actively involved or aware of the recording. Art. 14 GDPR is only applicable if the controller has no direct contact with the data subject and obtains the data from another source. This is not the case with body cameras.
Information must be provided immediately According to Art. 13(1) GDPR, the information must be provided “at the time of collection”. The ECJ emphasises that providing information after the fact is generally not sufficient in the case of body cameras. Data subjects should be able to understand as early as possible that they are being filmed and for what purpose.
The Court warns that without timely information, there is a risk of covert surveillance practices. This constitutes a violation of Articles 7 and 8 of the EU Charter of Fundamental Rights.
Practical implementation: the tiered information model The ECJ refers to the European Data Protection Board (EDPB) Guidelines 3/2019 on video surveillance. According to these guidelines, the information obligation can be fulfilled in a tiered procedure: ### Level 1: On-site notice The most important information must be immediately visible on a notice sign:
- Name and contact details of the controller * Purpose of data processing (e.g. protection of staff, de-escalation) * Legal basis for processing * Recipients of the data * Storage period of the recordings * Reference to rights of access and erasure ### Level 2: Complete data protection information
The complete mandatory information can be provided in an easily accessible location – for example, via a QR code on the information sign, a notice in the vehicles or on the transport company’s website. ## GDPR-compliant body cam use: How to implement it successfully The ECJ ruling confirms what we at NetCo have been implementing in practice for years: Body-Cams can be used in compliance with the GDPR – if the right measures are implemented from the outset. From camera recording to data processing, our solution complies with European data protection guidelines. ### Checklist for GDPR-compliant use To ensure legally compliant use of body-cams, the following points must be observed:
- Create an implementation concept: Use is only permitted if it is event-related and for predefined purposes. * Define the purpose of processing: For example, protecting your own staff from assaults. * Establish a processing directory: Documentation of all processing activities.
- Comply with the transparency requirement: Implement the information obligation in accordance with Art. 13 GDPR. * Adapt the works agreement: The deployment concept should become part of a service or works agreement. * Carry out a data protection impact assessment: Risk assessment for the rights of the data subjects.
- Take technical and organisational measures (TOM): Ensure the protection of personal data.
Tip: Free guide to GDPR-compliant body cam use offers proven strategies from market leaders and success stories with concrete figures. Request practical guide ”
No other country has such strict data protection regulations governing the use of body cameras. As the only German manufacturer, we know how to use them in a GDPR-compliant manner. ” Dr Matthias Hagner, CEO NetCo Body-Cam ## De-escalation instead of just documentation The ECJ ruling strengthens the information requirements, but does not question the fundamental benefits of body cameras. On the contrary: when used correctly, body cameras are an effective tool for de-escalation and staff protection. The figures speak for themselves: at Deutsche Bahn alone, over 75,000 acts of violence against employees have been recorded since 2022. The Railway and Transport Union (EVG) expressly supports the use of body cameras as a preventive measure.
The NetCo body cam takes a unique approach: the large front display with mirror function immediately confronts aggressive individuals with their own behaviour. This gives them the opportunity to reflect and perceive the possible consequences. In this way, crimes are prevented – not just documented.
The results in practice: * 75% de-escalation simply by activating the display at the Duisburg Public Order Office * Wiener Linien observed de-escalation in 50% of cases by switching on the display ## Proven in practice
NetCo body cams have been used successfully in several countries for more than five years. Our customers include, for example: * Deutsche Bahn: used to protect inspection staff * Kölner Verkehrs-Betriebe (KVB): public transport safety in a city of millions * Wiener Linien: de-escalation through front display
- Bremen Police: reliable tool since 2018 * Duisburg Public Order Office: consistently positive feedback from emergency services * Charité: protection of patients and medical staff
Sharing knowledge: The Body Cam Conference The annual Body Cam Conference brings together experts from the police, public transport, security services and local authorities. Under the motto “Expertise – Network – Best Practice”, the conference offers a platform for the latest developments, challenges and best practices relating to the use of body cameras and all related topics, including data protection.
The next conference will take place on 27 May 2026 in Frankfurt. More about the conference
Transparency and protection go hand in hand The ECJ ruling sets a clear standard for data protection: anyone who films people with body cameras must also inform them immediately. Invoking Article 14 of the GDPR – and thus the possibility of providing information retrospectively or not at all – is not an option when it comes to body cameras.
For transport companies, municipal law enforcement agencies and security companies, this means that body camera concepts must be designed holistically. In addition to a sound legal basis and short deletion periods, visible, comprehensible and multi-level data protection notices are essential. As the only German manufacturer of body cameras, we at NetCo are fully aware of the requirements of German data protection law. Our solutions, from hardware and software to comprehensive guidelines, are specially developed for GDPR-compliant use. Data protection cannot be added later. Transparency begins with the first image. ## Legal basis * ECJ, judgment of 18 December 2025 – C-422/24
- Art. 13 GDPR – Duty to provide information when collecting data from the data subject * Art. 14 GDPR – Duty to provide information when collecting data from other sources * EDPB Guidelines 3/2019 on the processing of personal data by video equipment * Art. 7 and 8 EU Charter of Fundamental Rights ## Frequently asked questions (FAQ) Do passengers have to consent to body cam recording? No. Recording may be carried out on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR. Consent is not required – but information pursuant to Art. 13 GDPR is.
Does the ruling also apply to pre-recording functions? Yes. As soon as the camera is activated and image data is captured, data collection is taking place. The NetCo body cam offers a pre-recording function of up to 120 seconds – this ensures that crucial moments are always captured, even if recording is only started later.
Can body cam recordings be used in court? Yes – but only if used in compliance with the GDPR. The ruling emphasises that if transport companies do not comply with their information obligations, they risk not only fines but also the usability of the recordings. The NetCo solution was developed specifically for German data protection requirements.
How long can the recordings be stored? As short as possible. The storage period depends on the purpose. For the documentation of incidents, a few days to weeks is standard. Longer storage periods require special justification.