With drones or unmanned aerial vehicles (UAVs) becoming commonplace in the UK in both commercial and non-commercial applications, the law has been required to evolve and play catch-up.
Although drones have been used by the military for some time, they are now becoming increasingly accessible to amateur and commercial users alike, since the term spans everything in technology from full-size, military-grade machinery to a glorified helicopter-type toy with a range measured in tens of metres, which can be controlled from a mobile telephone.
Coupled with ever-smaller cameras, advancements in drone technology have brought many benefits, ranging from enabling safe inspection of previously inaccessible places to assisting with fire and rescue. Drones are also being used for aerial photography, news coverage, surveying and mapping and in agricultural settings, such as for crop monitoring. Other uses include law enforcement, monitoring of wildlife, video production, private security services, and potentially even parcel delivery. As drones equipped with cameras become more accessible, they present a new set of issues for law-makers and regulators, who are attempting to speedily create new laws and guidance to govern their use and apply “old” laws to this rapidly developing technology.
Set out below are some of the key considerations when operating a drone or procuring the services of a drone operator in the UK.
Work or play?
Under Civil Aviation Authority (CAA) requirements, a distinction is drawn between drones for “commercial use” and drones for “domestic use”.
To operate drones for “commercial use”, CAA permission is likely to be required, minimum levels of third-party accident insurance must be put in place, and the operator must comply with other safety requirements.
Amateur use of drones is regulated, too. For example, flying in congested areas, close to people or property or beyond the visual line of site is prohibited, and new rules on the horizon may see drones that weigh between 7kg and 20kg needing an airworthiness assessment in order to be operated within 150m of a congested or populated area.
In terms of data privacy, UK privacy regulator the Information Commissioner’s Office (ICO) has also been pragmatic in drawing a distinction between hobbyists and those that use drones for commercial purposes. Its CCTV Code of Practice, which now incorporates a section on unmanned aircraft, states that professional users must comply with data privacy rules, but that it is good practice for domestic users also to “be aware of the potential privacy intrusion which the use of drones can cause to make sure they are used in a responsible manner”.
It is worth bearing in mind that the ICO has the power to issue on-the-spot fines to anyone not operating their drone “responsibly”, so operators should tread with care.
Plan, document, review…
The decision-making process as to whether to collect “personal data” via a camera attached to a drone (photographing an individual, for example) and the underlying reasons for such collection should be documented.
The ICO’s view is that a privacy impact assessment (PIA) should first be conducted to establish what the potential privacy risks are of collecting personal data via a drone. This should be balanced against the aims an operator seeks to achieve, before personal data is collected.
The ICO can conduct audits of those who collect or “process” personal data, and it will typically want to see evidence that a PIA has been carried out in the first instance. If a decision is made to collect personal data through a drone, periodic reviews should be made to ensure that drone use remains the best solution to achieve the aims without unduly intruding on individuals’ privacy.
Control what you capture
The ICO is concerned about “collateral intrusion” through the use of drones, which means capturing images of individuals unnecessarily.
As best practice measures, the ICO recommends (in its CCTV Code of Practice) that a drone operator should:
- Ensure that the camera on the drone can be switched on and off remotely, to limit recording to the specific function planned for; and
- Ensure software that uses selective focusing or ‘tilt-shift’ effects is incorporated to minimise the risk of producing clear images of people whose images are not intended to be captured.
Again, ignoring such guidance could have costly consequences for drone operators.
Let people know what is happening
Generally speaking, an individual’s consent is required before his or her personal data can be processed. However, if, for example, journalists are using a drone to film a protest attended by thousands of people, would they be expected to seek consent from every individual?
In such a scenario, the ICO recommends being innovative in the provision of information to individuals who may be filmed. For example, it may be appropriate for a drone operator to wear high-visibility clothing to identify the fact that he or she is operating a drone in the area, to place signs near the site to explain that overhead filming is taking place, and/or to direct attendees to a privacy notice on a website.
The key is to find some way to ensure that the people being filmed have access to the information they require to make an informed decision as to whether they want to take the risk of having their image captured by an overhead drone.
Data privacy doesn’t stop when the drone lands
The personal data collected by a drone is likely to be used in some way once it has landed, and an operator’s obligations with respect to that personal data do not end there.
In particular, the operator will still be obliged to process the data collected in line with the UK’s Data Protection Act 1998 (DPA), store it securely and retain it only for the minimum amount of time necessary, disposing of it or destroying it when no longer required.
The CAA has already prosecuted a number of drone operators in the UK, including one for flying too close to rides at a theme park and another for losing control of their drone and narrowly missing a public bridge. New measures proposed from a civil aviation perspective are on the horizon in the light of such events.
Given that drones can be deemed to have a military use, despite their specification, drone operators should also consider whether an import or export licence is required before importing or exporting a drone. The licensing regime could catch a lot of drone operators out, possibly covering taking a drone to, say, France from the UK for a holiday.
As shown above, there are increasing privacy concerns where drones are used in the UK and drone operators should be aware of these concerns, as well as knowing what the UK watchdog considers acceptable use.
With UK data protection laws set to be overhauled in the coming months, including a review of the fine levels for breach of the law, there is now more onus on organisations to implement systems, controls and other measures to ensure their drone use is lawful.