6. What is data protection law and why you need to know about it?


Like the right to a private life, the right to protection of personal data is also a protected fundamental right in the EU. It is protected by Article 8 of the Charter of Fundamental Rights of the EU. This means that dealing with any information about a person (personal data) that could allow his or her recognition or identification is subject to a number of legal principles that you must follow. The goal is to allow people control over who, how and why their personal data is collected and usedby. They are given the right to ask you to delete personaldata you have about them and limit how you can use it

If you are an individual or a company using drones for professional purposes/ commercial activities and you capture any personal data, you have to follow some detailed legal requirements. The EU has two legal acts which are important in this regard:

For certain other bodies, there are specialised data protection laws. For example, if you are a law enforcement agency, make sure to be aware of the requirements of Directive 2016/680 and if you are a journalist, you should follow your national law. Consult your national professional association and national data protection authority if you would like further guidance.

Why is it important for you?

Data protection law in the EU has strict requirements and principles that you need to follow. If you don’t, you could be facing a fine up to 20 000 000 EUR or 4% of your worldwide company turnover. Individuals could also sue you and get compensation in court if you have harmed their data protection rights.

  • You must follow data protection laws if bothof the following conditions apply to you and your drone commercial activities:

    • You are based in the EU or you operate your drones in the EU
    • You have collected in some way personal or sensitive data of a person (information that relates to an identified person or allows his or her identification).
  • There are two kinds of data you should be aware of. If you collect either type of information, you will have to act in accordance with the data protection principles

    1. Personal data - personal data means any information relating to an identified or identifiable person. Examples include an image, a name, a location, specific physical or physiological features.

    A recording or other information you collect through a drone will contain personal data if one of the following is true:

    • A person’s face is clearly visible.However, if there are individuals in the distance and the faces are blurred, it is unlikely to be considered personal data.
    • The person can be identified in another way – from the location, visible address numbers, car plate numbers, time of day, specific clothing, etc.
    • It shows details about the person’sbodily characteristics,behaviour, private life or his or her professional activities.
    • It is used when making decisions on how to treat, act towards or evaluate that person.
    • It focuses on or targets that particular person, especially if for a prolonged period of time.

    2. Sensitive data - Sensitive data is personal data about people that revealstheir race, ethnicity, political opinions, religious or philosophical beliefs, trade union membership, health condition, sex life or sexual orientation. This is also known as special categories of data. If you capture sensitive data, you must implement special safeguards.

    It is always best not to capture sensitive data, but if that is unavoidable, you should only capture sensitive data when:

    • The sensitive data is absolutely necessary for your activities
    • You have informed people of your activities and what you will use the information for
    • People have explicitly agreed to this
    • OR, People are acting in a clearly visible way in public and you happen to capture it. 

    Even then, however, you should not willingly harm people by using this information and you should respect all data protection principles.

Download the full PDF version