In previous installments, we introduced the process of registering a drone operator and verifying the pilot's qualifications. In today's installment, we will focus on drones and the protection of personal data and privacy.

Drones allow for detailed photography and video from above, opening up new possibilities in media, construction and security. However, these new possibilities also raise fundamental questions about privacy and data protection.

Legal regulation

The key regulations are: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter referred to as "the GDPR Regulation") a Act No. 110/2019 Coll., on the processing of personal data (hereinafter "Personal Data Processing Act"). These regulations stipulate rules for processing personal data, including video and audio recordings taken by unmanned aircraft.

A drone operator can become personal data controller or processorif its device captures identifiable individuals or other sensitive information.

Personal data

According to the GDPR, personal data means: any information that allows a natural person to be identified, directly or indirectlyIn connection with unmanned aircraft, this will mainly concern drones that are equipped with a camera system and thus enable the recording of people.

However, drones with camera systems can also be used in ways that are not subject to the GDPR. This may include situations where:

• no footage is taken that allows identification of persons,
• the records are made with the consent of the persons concerned or
• the footage is taken in a reasonable manner for journalistic, academic or artistic purposes.

Examples from practice:

• Aerial photos of landscapes without recognizable people are generally not subject to the GDPR,
• A photograph of the roof of an industrial building without capturing people also generally does not constitute processing of personal data,
• On the other hand, close-up shots of workers on a construction site or people in the garden of a family home usually trigger the GDPR. Here, an assessment is necessary.

Controller and processor of personal data

Operators of camera-equipped drones may be in a position to:

• personal data controller or
• personal data processor.

Personal data manager

The personal data controller determines the purpose and means of processing personal data and is responsible for ensuring that the processing is carried out in accordance with legal regulations.

Personal data processor

The personal data processor processes personal data based on the instructions of the controller.

Privacy Policy

When operating a drone with a camera system, the requirements set out in the GDPR must be complied with. This sets out the basic principles of data processing. Personal data must in particular:

• processed correctly a lawful a in a transparent manner,
• collected only pro legitimate purposes and may not be processed in a manner incompatible with those purposes,
• proportionate, relevant and limited to what is necessary,
• kept only for the necessary time (ideally within 72 hours) a
• secured against unauthorized access, loss and misuse.

The drone operator should take appropriate technical and organizational measures to protect the recorded footage in order to comply with the obligations set out in legal regulations.

Lawfulness of processing

The processing of personal data is only lawful if at least one of the legal grounds set out in the GDPR is met. These grounds include in particular:

• granting consent data subject with processing for a specific purpose,
• processing is necessary for the performance of the contract,
• processing is necessary to comply with a legal obligation,
• protection of vital interests persons,
• the performance of a task carried out in the public interest or in the exercise of official authority, or
• legitimate interest of the administrator or a third partyunless the rights of the persons concerned prevail.

In the case of drone operations, the legitimate interest of the controller is often applied in practice, for example in the protection of property or monitoring of construction work.

What to do in case of a personal data breach?

When operating drones, situations may arise that constitute a breach of personal data security. Typically, these may include:

• loss or theft of a drone containing stored recordings,
• theft of a memory card with recordings,
• unauthorized access to stored photos or videos,
• Accidentally published footage of identifiable people,
• a cyber attack on the storage where the records are kept.

If such an event occurs, the personal data controller should, without undue delay: assess whether the incident poses a risk to the rights and freedoms of the persons concerned.

If there is a probability of risk, the administrator is obliged to report a violation securing personal data to the supervisory authority, which in the Czech Republic is Office for Personal Data Protection.

Furthermore, the administrator should take action to limit the consequences of an incident, for example:

• remove unauthorized published content,
• change passwords,
• secure data storage,
• restore lost data from backups,
• review the security measures in place to prevent a similar situation from happening again.

A practical example

A construction inspection company loses a drone whose memory card contains close-up footage of employees and other people moving around the construction site.

If the data is not encrypted and there is a possibility of its misuse, it may be a breach of personal data security, which will need to be evaluated from the perspective of notification obligations under the GDPR and further action will need to be considered.

záver

The use of drones equipped with a camera system brings legal obligations in the area of ​​personal data protection. If drones are used to capture recordings that allow for the identification of persons, it is necessary to proceed in particular in accordance with the GDPR and the Personal Data Processing Act. Drone operators should be mindful of protecting the privacy of others, minimize the scope of data collected and ensure secure handling of records.

You don't know how to with processing of personal data when operating drones? Do you need advice in the area of air law? Contact us, we will be happy to advise you.

JUDr. Ing. Jan Vych, attorney and partner