Unmanned Aerial Vehicles or “Drones” are increasingly becoming popular for civilian use. However, whether used for recreational or commercial purposes, operators of drones need to be aware of their legal obligations.
The Regulation of Drones
The Irish Aviation Authority (the “IAA”) regulates the operation and use of drones. Drones over 1kg (including the weight of the battery and all attached equipment) must be registered with the IAA.
The Small Unmanned Aircraft (Drones) and Rockets Order 2015 (SI 563 of 2015) (the “Order”) contains a number of limitations for the operation of drones. The limitations include a requirement that drones cannot fly within 5km of an aerodrome or in controlled airspace (such as prisons, military installations) or above urban areas.
Permission from the IAA to fly a drone is not required if users operate within the limits set out in the Order. Also, no qualification is needed but safety training must be undertaken where the drone weighs between 4kg and 25kg.
Recent Bill A Bill that prohibits the use of a drone to photograph, video or conduct surveillance of another person’s home was introduced in the Seanad in January 2016. Entitled “Regulation of Drones Bill 2016” (the “Bill”), it will regulate the use of drones having regard to public safety as well as the privacy rights of individuals. The Bill will also build upon the requirements introduced under the Order. It is certain the Bill will be amended during the legislative process and so, it will be some time yet before the Bill becomes law.
Data Protection and Privacy issues
A drone fitted with camera and surveillance equipment can be used to collect personal data (such as facial images and car registration plates). As a consequence, concerns have arisen about privacy and data protection compliance. The processing of personal data relating to the management of an individual’s personal, family or household affairs or for recreational purposes is exempt from data protection legislation. This does not, however, extend to the surveillance of a public area outside an individual’s home and so if a drone captures personal data, it will be subject to the Data Protection Acts 1988 and 2003 (the “Acts”).
The Office of the Data Protection Commissioner recently issued a guidance note on the use of drones which gives operators and the public clarity as to what is required from a data protection perspective (see https://www.dataprotection.ie/docs/Guidance-on-the-use-of-Drone-Aircraft/1510.htm).
Practical steps to take
To comply with their data protection obligations, drone users should take the following steps:
- Obtain the consent of individuals whose personal data will be captured by making timely use of notifications, signage, media or publicity
- Ensure that drones are operated only with sensor equipment necessary to achieve the purpose for which they are intended
- Only record personal data that is required and for which consent has been obtained
- Have robust security and access controls in place ensuring only authorised persons have access to the images
- Ensure that any transfer of personal data is secured and is possible with the consent already obtained
- Consider mechanisms that automatically blur faces or other means to ensure that unintended captured personal data is avoided or removed before further processing occurs
- Use a software programme that automatically deletes the remaining personal data collected once the task is completed
For those who use drones for commercial purposes, such as aerial photography, they must ensure that:
- A privacy impact assessment is carried out prior to use
- Appropriate contracts are in place
- Adopt a written Drone Usage Policy