Article 14 - Information to be provided where personal data have not been obtained from the data subject

2 preliminary rulings

Judgment of 18 Dec 2025, C-422/24 (AB Storstockholms Lokaltrafik)

Articles13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC,must be interpreted as meaning that in a situation in which personal data are collected by means of a body camera worn by ticket inspectors on public transport, the provision of information to the data subjects is governed by Article13 of that regulation and not by Article14 thereof.

Judgment of 28 Nov 2024, C-169/23 (Másdi)

Article 14(5)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the exception to the controller’s obligation to provide information to the data subject, laid down in that provision, concerns all personal data, without distinction, that have not been collected by the controller directly from the data subject, whether those data have been obtained by the controller from a person other than the data subject or whether they have been generated by the controller itself, in the performance of its tasks.  

Article 14(5)(c) and Article 77(1) of Regulation 2016/679 must be interpreted as meaning that, in a complaint procedure, the supervisory authority is competent to verify whether the Member State law to which the controller is subject provides appropriate measures to protect the data subject’s legitimate interests, for the purposes of the application of the exception laid down in Article 14(5)(c). That verification does not however cover the appropriateness of the measures which the controller is required to implement, under Article 32 of that regulation, in order to guarantee the security of processing of personal data.  

---