At an event

Event

You are organising an outdoor concert and decide to use your drone to fly above the concert for promotion of future events. After you have acquired the proper authorisation to fly above crowds of people (this is typically required in most EU countries), you take footage of people in the crowd enjoying themselves. Some people are dancing, drinking alcohol; others are hanging out in crowds with friends, colleagues, and loved ones. After the event you want to upload images to your social media accounts.

Below you will see some of the main privacy and data protection issues that could arise in this situation and tips/ safeguards for how to avoid them. Keep in mind the detailed information provided in the Handbook.

  • PRIVACY

    Transparency, visibility and accountability: Individuals on the ground may not know a drone is in operation. They should be aware who, when and how is using the drone and for what purpose. This allows them to adjust their privacy expectations, be prepared and keep control over their privacy by acting accordingly.

    Privacy of association: The footage collected by the drone may directly link individuals to their preferences, such as type of music they listen to and the company they keep, their relationships and friendships. This may infringe their right to freely associate with other persons of their choice without detection.

    Privacy of behaviour and action: People have the right to act freely, in public and in private spaces, without being subjected to systematic recording, monitoring or controlling by others. There may be an issue if they are specifically targeted and observed while they enjoy the concert.

    DATA PROTECTION

    Remember that there are special requirements that apply whenever people whose images you collected can be identified. Keep in mind that sometimes it may be possible to identify people also from the context.

    Lawfulness, fairness, transparency: Your collection and processing of personal data must be lawful, based on one of the options laid down by EU law.  It must be fair, meaning that it must not cause any harm to the individuals. It must also be transparent – people have to know if their images have been captured and by whom.

    Purpose limitation: People have the right to know exactly for what purpose their data is collected and, once you inform them of the reason (promotion of the concert, the band, record sales), you cannot use their data for a different incompatible purpose without informing them again and ensuring your actions are lawful (see above).

    Data minimisation: You should strive to collect as little footage of identifiable people as possible. Only collect data which is necessary for your activity (purpose) and/or which is unavoidable.

    Accountability: Remember that, if you collect personal data and can choose what to do with it, you will be accountable if you don’t follow the relevant data protection rules.

    SAFEGUARDS

    TIPS - Inform attendees of the event of the filming, e.g., via a notification in the terms and conditions statement when they buy their tickets, display signs at the entrance to the concert, or on the posters and other promotional material of the event. Make sure to include contact information so people can express any concerns and receive answers to their questions.

    TIPS - Consider flying at a higher altitude to ensure less focussed data is collected. This can make the identification of individuals more difficult and can help minimise the impact of your activities on their privacy. Remember to also observe the maximum allowed flight altitudes.

    TIPS - Do not engage in discriminatory targeting – e.g., recording is focused on a particular group of people (e.g., women, minorities).

    TIPSAsk people for their permission before taking any pictures or videos of them specifically. This could be included in the Terms and Conditions of their ticket purchase for the concert, for example.

    TIPS - Individuals recorded have a right to access the material in which they can be identified and can request the data controller to delete that material. You should inform them of that right.

    TIPSBe aware who the data controller and the data processor is in this case, especially if you are carrying out this activity together with another company. Remember that data controllers and data processors are subject to various legal obligations in the EU.