A Collection is a selection of features, articles, comments and opinions on any given theme or topic. It allows you to stay up‑to‑date with what interests you most.
Login here to access your saved articles and followed authors.
We have sent you an email so you can reset your password.
Sorry, we had a problem.
Tags related to this article
Published 1 February 2016
The Office of the Data Protection Commissioner (ODPC) has released a guidance note (Guidance Note) relating to drones, including recommendations on steps that users can take to ensure that they comply with the Data Protection Acts 1998 and 2003 (the Acts). The same rules that apply to users of CCTV and Body Worn Cameras (BWCs) apply to users of drones.
In order to ensure compliance with the Acts, the ODPC expects data controllers to carry out detailed assessments which should demonstrate that the personal data captured by drones is justified, proportionate, reasonable and transparent. These assessments should seek to balance the use of drones against an individual's fundamental right to privacy and data protection.
Section 2(1)(c)(iii) of the Acts require that data shall be "adequate, relevant and not excessive" for the purpose for which it is collected. Under this principle, drones equipped with different technologies for data collection (camera, thermal imaging, GPS, altimeter, motion, radio frequency equipment and other sensors) should only collect information that is necessary for achieving the purpose pursued by this collection. Drone operators should ensure that the collection and processing of personal data is minimised and only images of the quality or resolution necessary is captured. It is also important to remember that data captured may become personal data after capture if it is combined with other data. In order to be in compliance with the Acts, drone operators should consider what measures could be applied in order to limit unnecessary capturing and processing of personal data including using a lower resolution camera, only using still images rather than video images, using a live stream rather than recording, or not using photographic imagery at all.
Under Section 2D of the Acts it is necessary to do as much as possible to identify that recording is taking place, by whom, for what purpose and with whom the data may be shared. If necessary, this information should be made clear to the general public in the area in which the drone operates by means of conspicuous signage, advertising posters, leaflet handouts, local newspaper and multi-channel/mode media campaigns and so on – whatever is necessary in order to ensure individuals are adequately and clearly informed before and during the flight, and that valid consent has been obtained The dates and times of the flights, the flight path and the types of personal data (e.g. imagery, radio, geometry, location etc.) that may be collected should accurately be described, along with the contact details of the operator and the data controller. Drones should also be visible.
All personal data captured by drones should be stored in an appropriately secured environment and access to the data should be controlled, logged and monitored. This may mean storing imagery or footage on a secure or encrypted medium accessible only to authenticated and authorised users. The Guidance Note also refers to the requirement of data controller's justifying the retention period and any imagery or video footage containing personal data that is not needed, or where it has been inadvertently captured, should be deleted. Where a drone operator is undertaking work on behalf of a client, the personal data transmitted and captured by the drone should be secured while in their possession and not retained after handover to a client. Alternatively, it may be possible to use anonymisation techniques. This may take the form of blurring or pixilation of facial images or registration plates.
Where unauthorised access or capture of this personal data has taken place a “breach” may have occurred and steps to secure the data, inform those involved and perhaps contact the ODPC may be required. Similar to the requirements set out in our CCTV summary, data controllers should have policies, procedures and training in place so that staff can take the appropriate action should a data breach occur.
The processing of personal data kept by an individual and concerned solely with the management of his/her personal, family or household affairs or kept by an individual for recreational purposes is exempt from the provisions of the Acts. This exemption, sometimes called the “household exemption”, would generally apply to the handling of the personal data of private persons, as long as this takes place for personal, non-commercial purposes. However the household exemption is limited in scope as seen clearly in the case of František Ryneš (C-212/13) where the CJEU found that video surveillance by an individual of a public area outside his home fell under the Data Protection Directive. The CJEU found that as the CCTV also monitored a public space, it did not amount to the processing of data in the course of a purely personal or household activity, for the purposes of the “household exemption”. Therefore, anyone intending to use a drone should ensure that it does not inadvertently capture personal data from third persons as this will mean that the provisions of the Acts apply.
To view the Guidance Note on the use of Drones, please click here.
Article submitted by Rowena McCormack, Associate – DAC Beachcroft Dublin
There are several practical steps drone operators can take to ensure that they comply with the Acts including:
London - Walbrook
+44 (0)20 7894 6577
Shehana Cameron Perera, Lorraine Ekong, Jade Kowalski, Rhiannon Webster, Ceri Fuller, Khurram Shamsee, Christopher Air, Sophie Devlin
Shehana Cameron Perera, Michael McMillen, Lorraine Ekong
Jade Kowalski, Shehana Cameron Perera, Zoe Lockton, Rhiannon Webster
Aleksandar Dimitrov, Neal Pal
Rhiannon Webster, Charlie Christie
Michael McMillen, Rhiannon Webster, Ben Savery
Ceri Fuller, Khurram Shamsee, Christopher Air, Jade Kowalski, Sophie Devlin
Hans Allnutt, Patrick Hill, Laura Stewart, Lorraine Ekong
Lorraine Ekong, Hans Allnutt
Hans Allnutt, Camilla Elliot
Hans Allnutt, Patrick Hill
Hans Allnutt, Rhiannon Webster, Patrick Hill
Hans Allnutt, Rhiannon Webster