VR’s Camera Surveillance Data Protection Notice
Updated 25.6.2026
VR Sverige uses cameras at our depots, wash facilities and fueling stations, as well as body-worn cameras carried by our customer hosts and platform/ramp staff. This notice explains how we use these cameras, how recorded material is handled and how personal data is processed in connection with camera surveillance.
1 Controller
VR Sverige AB
Business ID: 556351-9437
Sicklastråket 4
131 54 Nacka, Sweden
If you have questions regarding the processing of personal data or wish to exercise your rights, you may contact our Data Protection Officer:
2 Data Protection Officer
VR Sverige AB
Sicklastråket 4
131 54 Nacka, Sweden
Email: dpo@vrsverige.com
3 Cameras operated by transport authorities
For station areas, platforms, bus stops, trains and buses, VR Sverige cooperates with the relevant public transport authority. In these cases, the public transport authority is generally responsible for the camera installation and acts as the data controller for the processing of personal data.
Security cameras are installed on platforms and at bus stations, as well as inside train carriages and buses. These camera systems are managed by the relevant public transport authority, in accordance with section 3 of this data protection notice. In some cases, VR Sverige may have access to recorded material in order to provide it to the Police in connection with criminal investigations.
The purpose of camera surveillance is to:
- Increase safety and security for passengers and staff.
- Detect and preserve evidence of vandalism and other incidents.
- Assist police investigations by providing video footage upon request.
- Support safety investigations and accident investigations.
VR Sverige may in certain situations have access to recorded material in order to assist the Police with criminal investigations. However, VR Sverige does not determine the purposes or means of processing for camera systems operated by the public transport authorities.
For more information about how personal data is processed through these camera systems, please refer to the relevant transport authority:
4 Camera surveillance under VR Sverige’s control
4.1 Body-worn Cameras with audio recording
VR Sverige’s customer hosts and platform/ramp staff are equipped with body-worn cameras that record both video and audio. The cameras are approximately the size of a mobile phone and are worn either around the neck or in a special holder attached to the uniform.
Unlike the security cameras at stations, on trains, and on buses – which are continuously recording – the staff manually activate the body-worn cameras when needed.
The recorded video and audio material, once recording has been activated, is stored in a specially protected IT system. Access to the recordings is restricted to authorised personnel within VR Sverige’s Security Department. Recorded material may be disclosed to the Police when required in connection with the investigation of a suspected crime. Employees using body-worn cameras cannot access recordings. The material is encrypted throughout transfer and storage, and access to recordings is logged and monitored.
Recorded material is automatically deleted after seven days unless it is required for a lawful purpose, such as a criminal investigation.
Purpose of processing
The purpose of these cameras is to reduce threats and violent incidents directed towards our employees and to support the investigation of incidents where necessary.
Categories of personal data
Depending on the circumstances, the processing may include:
- Video recordings
- Audio recordings
- Images of individuals
- Information relating to incidents and security events
- Technical information associated with recordings, such as timestamps and camera identifiers
Legal basis
The processing is based on VR Sverige’s legitimate interest in protecting the safety and security of employees and supporting the investigation of incidents.
4.2 Fixed cameras at depots, fueling stations and wash facilities
VR Sverige operates fixed camera systems at depots, fueling stations and wash facilities.
Fixed camera systems at depots and fueling stations do not cover areas that are accessible to the general public.
Cameras located in wash facilities are used solely to identify damage to vehicles following washing procedures so that repairs can be carried out where necessary. Recorded material is retained for seven days and is then automatically deleted unless it is required in connection with insurance-related matters.
Purpose of processing
The purpose of these cameras is to:
- Prevent, investigate and document vandalism and other criminal offences
- Protect VR Sverige’s property and operations
- Identify damage to vehicles following washing procedures
- Support insurance-related matters where necessary
Categories of personal data
Depending on the circumstances, the processing may include:
- Video recordings
- Images of individuals
- Information relating to incidents and security events
- Technical information associated with recordings, such as timestamps and camera identifiers
Legal basis
The processing is based on VR Sverige’s legitimate interest in protecting its personnel, property and operations and in investigating incidents affecting its business activities.
5 What to do if you have been the victim of a crime on public transport
If you have been the victim of a crime on public transport, you should report the incident to the Police as soon as possible. This enables the Police to request relevant recorded material through their own procedures and conduct any necessary criminal investigation.
Only the Police have access to stored footage used in criminal investigations. Neither VR Sverige nor the public transport authorities conduct criminal investigations.
When filing a police report, you should ask the investigating officer to request the relevant footage. The request should be made within 72 hours of the incident, otherwise there is a risk that the recorded material may no longer be available.
6 Disclosure of Personal Data
Recorded material may be disclosed to the Police in connection with the investigation of suspected criminal offences. VR Sverige may also disclose personal data to other public authorities where required by law or by a decision of a competent authority.
VR Sverige may engage service providers to support the operation, maintenance and security of its camera systems. Where such service providers process personal data on behalf of VR Sverige, appropriate contractual arrangements are in place to ensure that personal data is processed only in accordance with VR Sverige’s instructions and applicable data protection legislation.
VR Sverige does not disclose personal data beyond what is described in this Data Protection Notice.
7 Transfers of Personal Data outside the EU/EEA
Personal data collected through VR Sverige’s camera surveillance systems is processed and stored within the EU/EEA. VR Sverige does not transfer personal data collected through camera surveillance outside the EU/EEA.
8 Protection of Personal Data
VR Sverige is committed to maintaining a high level of security for personal data processed through its camera surveillance systems. Appropriate technical and organisational measures have been implemented to protect recorded material against unauthorised access, alteration, disclosure, loss and destruction. Access to recorded material is restricted to authorised personnel whose duties require such access.
Recorded material is encrypted from the camera device throughout transfer to the storage system and remains encrypted while stored. Employees using body-worn cameras cannot access recordings. Access to recordings is restricted to authorised personnel within VR Sverige’s Security Department and all access and activities relating to recordings are logged and monitored.
Recorded material from camera systems is stored in specially protected systems with access controls designed to ensure that only authorised individuals can access the material. Where personal data is processed by service providers on behalf of VR Sverige, contractual arrangements are implemented to ensure an appropriate level of protection for personal data and compliance with applicable data protection legislation.
9 Data subject’s rights
If you wish to exercise your rights or have questions regarding the processing of your personal data, you may contact us at dpo@vrsverige.com. We will process your request as soon as possible and no later than one month from receiving it.
Please note that personal data recorded through camera surveillance may include images and, in some cases, audio recordings of multiple individuals. Camera recordings may also be required for law enforcement purposes or other legal obligations. As a result, it may not always be possible for VR Sverige to provide access to, erase or otherwise act upon recorded material in the manner requested.
If you have been the victim of a crime and recorded material may be relevant to a criminal investigation, requests relating to recorded material should primarily be made through the Police. The Police may request and obtain relevant recordings as part of their investigation.
Subject to applicable data protection legislation, you have the following rights:
- Right of access – You may request information about whether we process your personal data and obtain access to the personal data we hold about you.
- Right to rectification – You may request that inaccurate or incomplete personal data be corrected.
- Right to erasure – You may request that your personal data be deleted where there is no legal basis for continued processing.
- Right to restriction of processing – In certain circumstances, you may request that we restrict the processing of your personal data.
- Right to object – You may object to the processing of your personal data where the processing is based on a legitimate interest.
- Right to lodge a complaint – You may lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data violates applicable data protection legislation.