Filming a historical/cultural site
You are using a drone to fly over a historical city and you are taking footage of various landmarks. The footage focuses in on the ruins of a castle, a park and a nearby place of worship. You sell the image to a stock image database/catalogue, where it is stored indefinitely and made available for purchase by other entities.
Below you will see some of the main privacy and data protection issues that could arise in this situation and tips/ safeguards for how to avoid them. Keep in mind the detailed information provided in the Handbook.
Transparency, visibility and accountability: Individuals on the ground visiting the historical and cultural site may not know a drone is in operation. They should be aware who, when, how and why the drone is being used. This allows them to adjust their privacy expectations, and maintain control over their privacy.
Privacy of location and space: Persons living in the neighbourhood have a right to move about freely in their own home (or garden, or car) without being identified, tracked or monitored. The same applies to tourists visiting the site. Do not focus your footage specifically on one person without their knowledge and agreement.
Privacy of association: People have the right to associate freely with whomever they wish without this being monitored or revealed. This privacy may be threatened when you use your drone to capture images of people in the nearby park.
Privacy of thoughts and feelings: Individuals have a right not to share their thoughts or feelings or to have them revealed. This includes their beliefs or religious views. This privacy may be infringed if the place of worship you are taking the footage of is a religious place that is still being used.
Chilling effect: Such drone use may have the potential to make individuals feel as though they need to modify their behaviour. Individuals who live near or travel past these locations might adjust their behaviour as though they are under surveillance, even when they are not being monitored.
Remember that there are special requirements that apply whenever people whose images you collected can be identified. Keep in mind that sometimes it may be possible to identify people also from the context – location, house numbers, car registration numbers, time of day, etc.
Lawfulness, fairness, transparency: Your collection and processing of personal data must be lawful, based on one of the options laid down by EU law. It must be fair, meaning that it must not cause any harm to the individuals. It must also be transparent – people must know if their images have been captured, by whom and why.
Purpose limitation: People have the right to know exactly for what purpose their data is collected and, once you inform them of the reason (capturing the architecture, stock images, promotion of a tourist site), you cannot use their data for a different incompatible purpose (e.g. profiling visitors and locals) without informing them again and ensuring your actions are lawful (see above).
Data minimisation: You should collect as little personal data as possible to achieve your legitimate goals. Focus on the sites rather than the people.
Storage limitation: You should not keep the footage of people in a manner that would allow their identification for longer than necessary for achieving your planned purpose . If you will use the images on a stock image platform and there are people captured in them, ensure that you use the appropriate safeguards, e.g. anonymisation techniques.
Accountability: Remember that if you collect personal data and process it, then you will be accountable if you don’t follow the relevant data protection laws.
TIPS - Try and inform persons of the drone usage, the time of its operation, its purpose and intended use, as well as your contact information. You can do this, for example, through signs at the entrance of the historical sites on the specific day for tourists or visitors and through signs or announcements in local media for those living in the area. Answer questions from anyone who asks what you are doing with your drone. If people contact you and ask you to delete footage of them, you should do so.
TIPS - Consider if less intrusive technology could likely be used to capture the images of the site. If you insist on using a drone’s perspective, consider carefully when and how to capture these images, so as to minimise any harm to people’s privacy, e.g. by considering the time of day when to capture the footage.
TIPS – Appreciate the sensitivity of a place of worship if it is in use. If you want to take footage of it, consider doing this at times when there are no religious activities going on inside. On the other hand, if this is a specific moment you wish to film, make sure you carefully consider how to inform worshippers, ask for their permission and minimise the negative impact on their privacy.
TIPS – Collect the minimum amount of personal data possible. Consider flying at a higher altitude to ensure less focussed data is collected. This can make the identification of individuals more difficult and can help minimise the impact of your activities on their privacy. Remember to always observe the maximum allowed flight altitude.
TIPS - Do not collect data in the private domain without the explicit agreement of the individuals concerned; e.g., image of a person taken in the privacy of their nearby home—even if the photograph (using the drone) is taken at a high altitude.
TIPS - Consider taking steps such as blurring of the images of people as soon as possible to minimise the amount of personal data collected.
TIPS – Be aware who the data controller and the data processor is in this case, especially if you are carrying out this activity together with another company (e.g the stock image platform). Remember that data controllers and data processors are subject to various legal obligations in the EU.
TIPS - Store any personal data collected in a secure manner, and ensure that the third party (the stock images platform) also stores data securely.