Whilst there is no doubt that drones perform useful services and are an emerging technology with a range of commercial uses, the fact that many drones have built in cameras raises data protection and human dignity concerns.
When drones are used by individuals for their private purposes there is a risk that images of citizens are collected without their consent but more importantly where drones are used in a commercial setting whether it be for the management of landed estates, the delivery of commercial products or the review of commercial buildings, the Information Commissioner’s Office have identified that without appropriate practices the use of drones will infringe the data protection rights of individuals and render the commercial operator of drones non-compliant with the Data Protection Act 1998 and the General Data Protection Regulation (as from 25th May 2018).
In particular the use of drones is identified in the latest CCTV Code of Practice published by the Information Commissioner’s Office (ICO), which describes drones as Unmanned Arial Systems (UAS). The ICO distinguishes between individuals who use drones as “hobbyists” and those individuals or organisations that use drones for professional or commercial purposes.
The ICO CCTV Code states that “the use of UAS have a high potential for collateral intrusion by recording images of individuals unnecessarily and therefore can be highly privacy intrusive. Individuals may not always be directly identifiable from the footage captured by UAS but can still be identified through the context they are captured in but by using the devices ability to zoom in on a specific person. As such, it is very important that you can provide a strong justification for their use. As with all of the other technologies discussed, performing a robust privacy impact assessment will help you decide if using UAS is the most appropriate method to address the lead that you have identified.”
The CCTV Code of Practice goes on to remind commercial users of drones that they need to comply with all aspects of the Data Protection Act 1998 particularly as regards notifying individuals that their images may be captured and giving individuals information relating to their rights as a data subject.
Apart from data protection issues, the fact that drones may inadvertently or otherwise capture information relating to the property and activities of individuals may be an infringement of their rights under section 8 of the Human Rights Act 2000.
It should also be in mind that recordings from drones need to be stored in a secure manner in order to comply with the 7th principle of the Data Protection Act 1998, and businesses that store drone camera footage need to apply the same rigorous information security controls as they would do in respect of general CCTV footage.