{"id":2023,"date":"2020-01-22T11:48:43","date_gmt":"2020-01-22T11:48:43","guid":{"rendered":"https:\/\/www.dronesvilla.com\/?p=2023"},"modified":"2021-12-08T15:59:47","modified_gmt":"2021-12-08T15:59:47","slug":"drone-gdpr","status":"publish","type":"post","link":"https:\/\/www.dronesvilla.com\/drone-gdpr\/","title":{"rendered":"GDPR and Drones"},"content":{"rendered":"\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr.jpg\" alt=\"\"\/><\/figure><\/div>\n\n\n\n<p>The General Data Protection Regulation, or GDPR, changed the game for many industries \u2014 including the drone industry \u2014 when it was rolled out in the EU.<\/p>\n\n\n\n<p>It affects the way that pilots are able to capture data with their UAVs, in addition to regular <a aria-label=\"drone laws in the UK (opens in a new tab)\" rel=\"noreferrer noopener\" href=\"https:\/\/www.dronesvilla.com\/uk-drone-laws\/\" target=\"_blank\" class=\"rank-math-link\">drone laws in the UK<\/a> and the rest of Europe. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What is GDPR?<\/strong><\/h2>\n\n\n\n<p>The GDPR is the General Data Protection Regulation, a European Parliament legislation that came into force in Spring of 2018. It replaced the older, then outdated <a aria-label=\" (opens in a new tab)\" href=\"https:\/\/en.wikipedia.org\/wiki\/Data_Protection_Directive\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Data Protection Directive 95\/46\/ec<\/a>.<\/p>\n\n\n\n<p>The GDPR serves as the foremost legislation regulating how\nbusinesses and organizations handle and protect the personal data of EU\ncitizens. It also gives EU citizens more control over their personal data.<\/p>\n\n\n\n<p>Businesses and organizations that fail to comply with these\nregulations stand the risk of very stiff fines and penalties.<\/p>\n\n\n\n<p>Now, the GDPR is made up of 11 chapters and 91 articles, but\nhere are some key data and privacy requirements that are included in the law:<\/p>\n\n\n\n<ul><li>Demanding the consent of subjects before data\nprocessing<\/li><li>Anonymizing data collected to protect privacy of\nsubjects<\/li><li>Making available notifications of data breach<\/li><li>Carefully carrying out the transfer of data\nacross national boundaries<\/li><li>Demanding certain businesses and organizations\nto create a role solely dedicated to overseeing GDPR compliance<\/li><\/ul>\n\n\n\n<p>Ultimately, GDPR is a set of rules that establishes a set of minimum privacy expectations from anyone who deals with EU citizens. In this way, they hope to better safeguard the personal data of those under the jurisdiction of the EU.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Who Does GDPR Apply To?<\/strong><\/h3>\n\n\n\n<p>GDPR imposes a uniform data protection law on all member states of the EU, to prevent every member from having to go to the trouble of having to produce and enforce its own data and privacy protection laws.<\/p>\n\n\n\n<p>Not only does this ensure consistency, it bolsters the\nauthority and eases implementation and follow up.<\/p>\n\n\n\n<p>In addition to EU members, the GDPR is binding on all those\nwho do business with EU citizens.<\/p>\n\n\n\n<p>If your goods or services reach citizens of the EU, then\nregardless of your location, the business is subject to the requirements and\ndemands of the privacy regulation.<\/p>\n\n\n\n<p>Websites that do not comply with these rules will not be\nallowed to even be accessible to EU states. Prominent websites that came under\nthe hammer in this way after the law came into force include The LA Times and The\nChicago Tribune.<\/p>\n\n\n\n<p>Thus, you can say the reach of this data protection law goes\nworldwide.<\/p>\n\n\n\n<p>By complying and aligning with GDPR requirements, improving\ndata protection and trust, organizations and businesses will avoid having to\npay steep penalties and fines.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What Does GDPR Have\nto Do with Operating Your Drone?<\/strong><\/h2>\n\n\n\n<p>It is easy to see how the implementation of GDPR could cause panic and head scratching among business owners and organizational heads. <\/p>\n\n\n\n<p>And you would be forgiven for thinking that mainly\npermission based marketing practices and systems need worry about complying\nwith the complex, new set of rules.<\/p>\n\n\n\n<p>But what about drone pilots and enthusiasts?<\/p>\n\n\n\n<p>The GDPR rules go much deeper than you realize, and essentially involve all forms of personal data \u2014 including those you intentionally or unintentionally collect with your drone.<\/p>\n\n\n\n<p>Breaching these comprehensive set of rules as a drone operator could result in fines that mount up to 20 million euros or 4% of your business&#8217;s turnover.<\/p>\n\n\n\n<p>You want to be very aware of where the lines are concerning\nyour drone and privacy in the EU.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>What Constitutes\nPersonally Identifiable Data?<\/strong><\/h3>\n\n\n\n<p>A recording or whatever information you obtain with your drone is considered to contain personal data if any of the following holds true:<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>An Individual\u2019s Face Can Be Clearly Seen<\/strong><\/h4>\n\n\n\n<p>Details that can specifically be used to identify a person are of particular concern. So faces that are in clear resolution in the footage gathered by your drone are considered as personal data. However, people in the distance who appear in shots or whose faces appear blurred and cannot be identified do not count as personally identifiable information.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Contains Anything that Makes an Individual Identifiable<\/strong><\/h4>\n\n\n\n<p>This covers sensitive information like visible car number plates, visible address numbers, unusual clothing or uniforms, and so on.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Contains Details of a Person\u2019s Bodily Characteristics or Features<\/strong><\/h4>\n\n\n\n<p>This covers information which can be traced back to an individual, stuff like unusual colored hair and body tattoos.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Contains Details of an Individual\u2019s Professional or Private Life<\/strong><\/h4>\n\n\n\n<p>This includes information that can be used by others to pinpoint an individual\u2019s home or place of work.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Contains Information Which Can Be Used to Evaluate an Individual<\/strong><\/h4>\n\n\n\n<p>This covers information that is collected for the purpose of security or for purposes of monitoring.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Contains Footage that Targets an Individual<\/strong><\/h4>\n\n\n\n<p>When footage follows or tracks an individual for a lengthy period of time, it increases the probability that they can be identified.<\/p>\n\n\n\n<p>As a drone user, it is important that you imbibe these\nunderstandings so that you don\u2019t fly afoul of the law while operating your\ndrone.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>5 Ways In Which GDPR Affect Drone Operations<\/strong><\/h3>\n\n\n\n<p>Because GDPR is so far reaching and comprehensive, there are\na few ways in which it changes the way drone pilots and operators fly their\ndrones and interact with bystanders.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Wider Meaning of\nPersonal Data<\/strong><\/h4>\n\n\n\n<p>Rest assured that the GDPR will apply whenever you access\npersonal data with your drone. And the definition of personal data in this case\nwill cover anything that relates to an identifiable or identified individual. <\/p>\n\n\n\n<p>This includes images, videos, sounds, biometric data (facial\nrecognition markers, for instance), traffic data, location markers,\ntelecommunication data, or any combination of data already mentioned.<\/p>\n\n\n\n<p>In short, if it makes it possible to identify the individual\nconcerned then consider it as personal data under the protection of the GDPR.<\/p>\n\n\n\n<p>As a drone operator, you can probably think of several ways\nin which you can gather and compile information that can be considered\nsensitive.<\/p>\n\n\n\n<p>To keep safe, treat any recording you capture as personal\ndata. Anonymize such data by implementing techniques such as blurring or\npeople, their faces, clothing, and other identifiable information.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Same Rules, New\nPenalties<\/strong><\/h4>\n\n\n\n<p>The right to privacy is a fundamental right, and privacy\nconcerns have always been a hot button issue whenever drones are concerned.\nDrone pilots should act like they are aware of this, and avoid needless risks\nand agitation.<\/p>\n\n\n\n<p>This is even more important to consider with the new, very\nsteep sanctions put in place by the EU legislation.<\/p>\n\n\n\n<p>The stakes are now higher; those who don\u2019t comply run the\nrisk of facing monetary sanctions of up to 20 million euros or 4% of annual worldwide\nturnover<\/p>\n\n\n\n<p>There are some steps you can take to mitigate risks like:<\/p>\n\n\n\n<ul><li>Limit the amount of data you collect and store\nas much as you can<\/li><li>Restrict yourself to using the data collected\nonly for the purpose for which it was collected<\/li><li>Securely and permanently delete any unnecessary\ndata<\/li><li>Ensure top security to protect data assets and\ninfrastructure<\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Data Protection By Default and By Design<\/strong><\/h4>\n\n\n\n<p>The GDPR lays out the principle of data protection by\ndefault and by design. <\/p>\n\n\n\n<p>What this principle emphasizes for those in the drone\nindustry is that UAV manufacturers, pilots, and operators ought to consider how\nto incorporate principles of data protection into the functioning of their\nbusiness and their products if they involve the processing of personal data\nthrough operational or technical means.<\/p>\n\n\n\n<p>For instance, if you were a drone operator or pilot, you could minimize the collection of unnecessary data. You could also take much care in choosing the right drone for the right task, taking into consideration data and privacy protection issues when planning your flight path and post-handling procedures.<\/p>\n\n\n\n<p>You should also ensure you always have the express permission of anyone that you may be filming or taking photos of.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Rights of the Individual<\/strong><\/h4>\n\n\n\n<p>The GDPR affords individuals a set of rights which they can\nexercise whenever their personal data is concerned. <\/p>\n\n\n\n<p>Most of these laws will not be new to anybody who has been\noperating drones for an appreciable amount of time. But they are enforced even\nharder than before.<\/p>\n\n\n\n<p>Before you go out to fly your drone, make sure you refresh\nyour memory on what these rules are, and also ensure there are efficient\nprocedures for seeing them through.<\/p>\n\n\n\n<p>You should also make sure to remind people of these rights, some\nof which are:<\/p>\n\n\n\n<ul><li><strong>The Right to Withdraw Consent. <\/strong>People have every right to agree to their data being recorded, and they also have the right to later on change their minds.<\/li><li><strong>The Right of Access.<\/strong> If people inquire about the data you are collecting, they have a right to know if you are processing any data related to them, where, and for whatever purpose. They also have a right to receive a copy of said data.<\/li><li><strong>The Right to Be Forgotten. <\/strong>People have the right to ask that their personal data be deleted. For example, if your operations are not complying with the provisions of GDPR, if people never consented to having their data captured, or if they did but later on had a change of heart and you have no other basis to keep that data.<\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Accountability<\/strong><\/h4>\n\n\n\n<p>Under the new privacy regulations, you \u2014 the drone operator \u2014 are now accountable for the drone activities involving personal data. <\/p>\n\n\n\n<p>It is up to you to ensure that you are compliant with the\ndemands of GDPR and to demonstrate this compliance to all who are concerned and\nmay enquire.<\/p>\n\n\n\n<p>The GDPR also puts in place some administrative requirements\non businesses and organizations which can help you better understand what\ndemonstrating GDPR compliance means.<\/p>\n\n\n\n<p>For example, depending on how large your business is, you\ncould be required to keep a record of your data processing operations, data\nflows, GDPR compliance guarantees, and, depending on the risks involved with your\nactivities, you might be required to carry out a mandatory data protection\nimpact assessment (DPIA).<\/p>\n\n\n\n<p>A data processing impact assessment could mean having to\nhire a designated data protection officer for the role of data protection.<\/p>\n\n\n\n<p>Steps like these can help you assure concerned parties about\nyour compliance with GDPR in a scenario where an audit is carried out or an\nexternal request is made from a national data protection authority.<\/p>\n\n\n\n<p>Also worth noting is the fact that you will be held liable\nunder the new GDPR regime from the moment you capture, collect and keep\npersonal data until you anonymize or destroy securely and permanently.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Guidelines to Help\nDrone Operators Comply With GDPR<\/strong><\/h2>\n\n\n\n<p>Here are a few guidelines you can&nbsp;adhere to in order to comply with GDPR.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Draft a Public\nPrivacy Statement<\/strong><\/h3>\n\n\n\n<p>This is a sure way to supercharge your efforts to duly\ninform bystanders of how their data will be handled should your drone collect\nit. A proper public privacy statement should document the way you gather, use,\ndisclose, and of course manage any personally identifiable data your drone\ncollects.<\/p>\n\n\n\n<p>This document should be available on your website for\nmembers of the public to view and learn.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Inform the Public\nConcerned<\/strong><\/h3>\n\n\n\n<p>Should you realize at any time while using your drone that\nyou have gathered personally identifiable data about an individual, do not\nhesitate to inform them about it.<\/p>\n\n\n\n<p>This is important.<\/p>\n\n\n\n<p>You should also inform and educate them about their rights\nto have the data removed and also refer them to your public privacy statement\nfor any clarification they might need about your data collection and handling\npolicies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Assess Your\nOperational Risk<\/strong><\/h3>\n\n\n\n<p>While planning your drone flight, make sure to assess any\nsituation which may lead to the risk of gathering too much personally\nidentifiable data. You want to limit instances like this from occurring as much\nas possible.<\/p>\n\n\n\n<p>Assess your chosen flight path and see if there are any\ncars, houses, people, or other features that will need to be anonymized due to\ntheir sensitivity.<\/p>\n\n\n\n<p>If you realize that there is a high risk of too many people\non the ground being affected, you may want to carry out a Data Protection\nImpact Assessment (DPIA).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Anonymity<\/strong><\/h3>\n\n\n\n<p>Make anonymizing data a critical part of your drone\noperations. As part of your operational procedure, blur out any data that was\nmistakenly collected in order to stay in compliance with the demands of the GDPR.\nThis includes number plates, house numbers, faces, and anything else.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Limit the Storage of\nPersonally Identifiable Data<\/strong><\/h3>\n\n\n\n<p>Clearly state the purposes for which you are collecting any\npersonal data, and store said data for the minimum amount of time required.<\/p>\n\n\n\n<p>Make it a part of your operations to carry out data purges\njust to make sure no stray data is hanging around and making you liable to come\nunder the hammer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Make Sure All\nPersonal Data is Adequately Protected<\/strong><\/h3>\n\n\n\n<p>Access to any personally identifiable information should be\nstrictly monitored and controlled, with appropriate security measures taken.<\/p>\n\n\n\n<p>Data must never be shared with third parties without the\nexpressed consent of the individual concerned.<\/p>\n\n\n\n<p>In the case where you have to share data that contains\npersonal information, ensure that you anonymize every sensitive piece of info\nbeforehand.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Document <\/strong><\/h3>\n\n\n\n<p>Make sure you document every stage of the drone operation\nfrom the planning stage to post-flight and data handling. This ensures that you\nwill be able to demonstrate to interested parties how compliant you are with\nGDPR requirements.<\/p>\n\n\n\n<p>This would also help you should anyone file a complaint\nabout your drone flying operations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Conclusion<\/strong><\/h2>\n\n\n\n<p>It may seem like a lot of work to comply with the requirements\nof GDPR, but remember that these regulations are in place to protect the public\nfrom unscrupulous individuals.<\/p>\n\n\n\n<p>And sometimes, you never know when you might be the one\ngrateful for having your privacy protected by the law.<\/p>\n\n\n\n<p>A lot of these procedures will become second nature to you\nwith practice, anyway. Just follow the steps and guidelines outlined and you\nshould have nothing to worry about as far as GDPR regulations are concerned.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The General Data Protection Regulation, or GDPR, changed the game for many industries \u2014 including &#8230; <a title=\"GDPR and Drones\" class=\"read-more\" href=\"https:\/\/www.dronesvilla.com\/drone-gdpr\/\" aria-label=\"More on GDPR and Drones\">Read more<\/a><\/p>\n","protected":false},"author":3,"featured_media":2147,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","footnotes":""},"categories":[14],"tags":[],"uagb_featured_image_src":{"full":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr.jpg",825,457,false],"thumbnail":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr-150x150.jpg",150,150,true],"medium":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr-300x166.jpg",300,166,true],"medium_large":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr-768x425.jpg",768,425,true],"large":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr.jpg",825,457,false],"img_rate_products_categories":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr-552x306.jpg",552,306,true],"img_rate_products_slideshow":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr.jpg",825,457,false],"img_rate_products_preview":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr-168x93.jpg",168,93,true],"1536x1536":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr.jpg",825,457,false],"2048x2048":["https:\/\/www.dronesvilla.com\/wp-content\/uploads\/2020\/01\/drones-and-gdpr.jpg",825,457,false]},"uagb_author_info":{"display_name":"Sam","author_link":"https:\/\/www.dronesvilla.com\/author\/sam\/"},"uagb_comment_info":0,"uagb_excerpt":"The General Data Protection Regulation, or GDPR, changed the game for many industries \u2014 including ... Read more","_links":{"self":[{"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/posts\/2023"}],"collection":[{"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/comments?post=2023"}],"version-history":[{"count":2,"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/posts\/2023\/revisions"}],"predecessor-version":[{"id":3048,"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/posts\/2023\/revisions\/3048"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/media\/2147"}],"wp:attachment":[{"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/media?parent=2023"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/categories?post=2023"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dronesvilla.com\/wp-json\/wp\/v2\/tags?post=2023"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}