A2 CofC - Drone Certificate of Competency Privacy and Data Protection Questions and Answers — Questions and Answers
Question 1: A remote pilot is hired to survey a public park for a local council. To comply with data protection law, they put up signs at the park entrances informing the public about the drone flight, its purpose, and who is operating it. This action primarily helps to fulfil which key principle of the UK GDPR?
- Integrity and Confidentiality
- Data Minimisation
- Lawfulness, Fairness and Transparency (Correct answer)
- Storage Limitation
Correct answer: Lawfulness, Fairness and Transparency
The principle of 'Lawfulness, Fairness and Transparency' requires that data processing is transparent. Providing clear notice to the public via signs explains how and why data (in this case, video footage) is being collected, which is a core part of transparency.
Question 2: While filming a property for an estate agent, a drone pilot inadvertently captures clear, identifiable footage of a neighbour sunbathing in their fenced back garden. Under the UK GDPR, why is this a serious data protection issue?
- The footage was not captured in high-definition.
- The pilot does not have a lawful basis to process the neighbour's data in a place where they have a reasonable expectation of privacy. (Correct answer)
- The pilot failed to register this specific flight with the Information Commissioner's Office (ICO) beforehand.
- The drone was flying lower than 50 metres over the neighbour's property.
Correct answer: The pilot does not have a lawful basis to process the neighbour's data in a place where they have a reasonable expectation of privacy.
The UK GDPR requires a lawful basis for processing personal data. While the pilot has a lawful basis to film the client's property, this does not extend to filming a neighbour in their private garden where they have a reasonable expectation of privacy. This is considered a serious breach, often referred to as 'collateral intrusion'.
Question 3: If a member of the public believes their personal data has been unlawfully captured by a commercial drone operation, which UK organisation is the primary regulatory body they should contact to make a formal complaint?
- The Civil Aviation Authority (CAA)
- The local Police Constabulary
- The Surveillance Camera Commissioner (SCC)
- The Information Commissioner's Office (ICO) (Correct answer)
Correct answer: The Information Commissioner's Office (ICO)
The Information Commissioner's Office (ICO) is the UK's independent authority responsible for upholding information rights and data privacy. Complaints regarding potential breaches of the UK GDPR and the Data Protection Act 2018, including those involving drones, should be directed to the ICO. The CAA handles aviation safety and regulation, not data protection.
Question 4: Which of the following is the clearest example of 'personal data' that could be captured by a drone, according to the definitions used by the Information Commissioner's Office (ICO)?
- A thermal image showing heat loss from a factory roof.
- A wide, high-altitude photograph of a crowd at a festival where no individuals are distinguishable.
- A clear image of a car's registration plate parked on a public street. (Correct answer)
- A landscape video of a mountain range with no people visible.
Correct answer: A clear image of a car's registration plate parked on a public street.
Personal data is any information that can be used to identify a living person. A vehicle registration plate can be used to identify the registered keeper of the vehicle and is therefore considered personal data under UK GDPR. The other options do not contain information that directly identifies an individual.
Question 5: A drone operator regularly conducts commercial flights that may inadvertently capture images of people. To comply with the 'accountability' principle under UK GDPR, which of the following actions is most important?
- Insuring the drone against accidental damage.
- Maintaining documented records of their data processing activities and privacy policies. (Correct answer)
- Using a drone that has a maximum flight time of less than 30 minutes.
- Submitting every flight plan to the Civil Aviation Authority (CAA) for approval.
Correct answer: Maintaining documented records of their data processing activities and privacy policies.
The accountability principle requires data controllers not only to comply with the UK GDPR but also to be able to demonstrate that compliance. This is achieved through measures like maintaining records of processing activities (ROPAs), having clear data protection policies, and documenting decisions, such as conducting a Data Protection Impact Assessment (DPIA).
Question 6: A remote pilot has completed a roof inspection and the captured video contains incidental footage of identifiable people walking in the street below. According to the principle of 'data minimisation', what should the pilot do with this incidental footage?
- Upload the full, unedited video to a public social media channel.
- Keep the footage indefinitely in case it is needed for future projects.
- Blur or anonymise the faces of the identifiable individuals before storing or sharing the video. (Correct answer)
- Send a copy of the unedited footage to everyone who was recorded.
Correct answer: Blur or anonymise the faces of the identifiable individuals before storing or sharing the video.
Data minimisation means only processing the personal data that is necessary for the specific purpose. Since the people in the street are not relevant to the roof inspection, their personal data should not be processed unnecessarily. The best practice is to anonymise this data (e.g., by blurring faces) to protect their privacy while retaining the necessary footage for the client.
A2 CofC - Drone Certificate of Competency Privacy and Data Protection Questions and Answers
A remote pilot is hired to survey a public park for a local council.
To comply with data protection law, they put up signs at the park entrances informing the public about the drone flight, its purpose, and who is operating it.
This action primarily helps to fulfil which key principle of the UK GDPR?