In light of the increased use of drones, police in the UK have seen a spike in over 2,000% in drone related calls. Many of these calls are as a result of the public’s increased awareness of the use of drones, however, there is a lack of awareness in relation to the aviation and privacy laws that apply.
The Office of the Data Protection Commissioner (“ODPC”), on 22 December 2015, issued guidance on the use of drones which provide both users and the public with greater clarity in relation to what is required from a data protection legislation perspective.
The operation and use of drones that process personal data kept by an individual and which is solely concerned with the management of his/her personal, family or household affairs or kept for recreational purposes is exempt from the application of the data protection legislation. This does not, however, extend to the surveillance by an individual of a public area outside his/her home, which was recently held by the CJEU to fall within the Data Protection Directive. Therefore, anyone intending to use a drone should seek to ensure that it does not inadvertently capture third party personal data as to do so would require that individual to comply with the obligations and safeguards set out in the data protection legislation and the guidance issued by the ODPC.
Any drone which captures personal data will be subject to the Data Protection Acts 1988 and 2003 (the “Acts”) and operators of these drones will need to ensure they comply with the requirements of the Acts in relation to the collection, processing and retention of personal data.
This guidance provides similar obligations as those prescribed in respect of CCTV use. The obligations include the following:
- Proportionality – drones equipped with different technologies for data collection (camera, thermal imaging, GPS, altimeter, motion, radio frequency equipment and other sensors) should only collect information that is necessary for achieving the purpose pursued by this collection;
- Transparency – individuals may not be aware that they are being recorded or that a drone is equipped with recording equipment – as such, it is necessary to do as much as possible to identify that recording is taking place, by whom, for what purpose and with whom the data may be shared;
- Storage and Retention – images and videos containing personal data that is no longer needed, or where it has been inadvertently captured should be deleted or the use anonymisation techniques should be adopted;
- Security – Any data captured should be stored securely in an appropriate environment. It is advised that the data should be controlled, logged and monitored, for example, this may mean storing imagery or footage on a secure or encrypted medium and only to authenticated and authorised users; and
- Data Subject Rights – those individuals whose personal data is recorded on a drone system can enforce their rights under the Acts, including seeking a copy of their own personal data in relation to the images and/or video.
Regulation by the Irish Aviation Authority
Ireland is one of the first countries in Europe to regulate the use and operation of drones. On Monday, 21 December 2015 the Irish Aviation Authority (Small Unmanned Aircraft (Drones) and Rockets) Order 2015 was introduced to regulate drones. Drone operators will need to familiarise themselves with the new rules, some of which include:
- All drones weighing 1Kg or more, which includes the weight of the battery and the attached equipment, must be registered with the Irish Aviation Authority (“IAA”);
- A drone is not allowed to fly farther than 300 metres from its operator and it must be in visible sight to its operator;
- A drone is not allowed to fly higher than 120 metres above ground level;
- A drone cannot fly within 5 kilometres of any aerodrome;
- A drone cannot fly in a prohibited, restricted area or controlled airspace e.g. military installations, prisons, over an assembly of people or over urban areas;
- Drone operators must ensure they operate their drone in a manner that will not be a hazard to another aircraft in flight or in a negligent or reckless manner so as to endanger the life or property of others; and
- Operators of drones which weigh more than 4Kg will also need to complete safety training approved by the IAA to fly that drone.