A2 CofC Privacy and Data Protection 2 — Questions and Answers
Question 1: A drone pilot inadvertently captures footage of a person in their garden. What offence might this constitute under UK law?
- No offence as gardens are visible from above
- Potential violation of the right to privacy under the Human Rights Act 1998, Article 8, and possible voyeurism or harassment offences (Correct answer)
- Only an offence if the footage is published
- An offence only if the drone weighs over 2 kg
Correct answer: Potential violation of the right to privacy under the Human Rights Act 1998, Article 8, and possible voyeurism or harassment offences
Capturing footage of someone in their garden — where they have a reasonable expectation of privacy — could constitute a violation of Article 8 of the Human Rights Act (right to respect for private and family life). Depending on intent and circumstances, it could also be a criminal offence under voyeurism or harassment legislation.
Question 2: How long should drone operators retain personal data captured during flights under UK GDPR?
- Indefinitely for future reference
- Only for as long as necessary for the purpose it was collected, as defined in their retention policy (Correct answer)
- Exactly 6 years in all cases
- Until the drone's memory card is full
Correct answer: Only for as long as necessary for the purpose it was collected, as defined in their retention policy
UK GDPR's storage limitation principle requires that personal data be kept for no longer than necessary for the purposes for which it was collected. Drone operators should have a clear data retention policy specifying how long footage is kept and when it will be securely deleted.
Question 3: What is the role of the Information Commissioner's Office (ICO) in relation to drone operations that capture personal data?
- The ICO has no jurisdiction over drone footage
- The ICO is the UK's independent data protection authority that enforces UK GDPR and can investigate complaints, issue fines, and provide guidance on drone privacy issues (Correct answer)
- The ICO only regulates government drone use
- The ICO issues drone flight permits
Correct answer: The ICO is the UK's independent data protection authority that enforces UK GDPR and can investigate complaints, issue fines, and provide guidance on drone privacy issues
The ICO is the UK's supervisory authority for data protection. It enforces UK GDPR, investigates complaints from the public about privacy breaches including those involving drones, can issue enforcement notices and monetary penalties, and publishes guidance for drone operators on data protection compliance.
Question 4: When is the domestic purposes exemption likely to apply to recreational drone flying?
- Always, for any recreational flight
- When a person flies a drone purely for personal or household activities with no intention to share footage publicly or commercially (Correct answer)
- Whenever the drone weighs less than 250g
- Only when flying in one's own garden
Correct answer: When a person flies a drone purely for personal or household activities with no intention to share footage publicly or commercially
The domestic purposes exemption (also called the household exemption) applies when personal data is processed by an individual purely for personal, family, or household purposes. For drone footage, this would apply to truly private recreational use with no intention to publish, share widely, or use commercially. However, it does not exempt the operator from other drone regulations.
Question 5: A commercial drone operator receives a Subject Access Request (SAR) from someone who believes they appear in drone footage. What must the operator do?
- Ignore the request as drone footage is not covered by SARs
- Respond within one calendar month, providing the individual with a copy of any personal data held about them, or confirming that no data is held (Correct answer)
- Charge a mandatory £50 fee before responding
- Forward the request to the CAA
Correct answer: Respond within one calendar month, providing the individual with a copy of any personal data held about them, or confirming that no data is held
Under UK GDPR, a data controller must respond to a Subject Access Request within one calendar month. The operator must search their records, provide copies of any personal data held about the requester (or confirm none exists), and explain how the data is being processed. This service is generally provided free of charge.
Question 6: What additional privacy consideration applies when a drone is equipped with a thermal imaging camera?
- Thermal cameras do not capture personal data
- Thermal imaging can reveal information about activities inside buildings, potentially constituting a more invasive privacy intrusion that requires stronger justification and safeguards (Correct answer)
- Thermal cameras are prohibited on all drones in the UK
- Thermal imaging only requires consent from the property owner
Correct answer: Thermal imaging can reveal information about activities inside buildings, potentially constituting a more invasive privacy intrusion that requires stronger justification and safeguards
Thermal imaging cameras can detect heat signatures through walls and windows, potentially revealing information about activities inside private spaces. This represents a more intrusive form of surveillance than standard photography, requiring stronger justification under UK GDPR and potentially a DPIA before use in populated areas.
A2 CofC Privacy and Data Protection 2
A drone pilot inadvertently captures footage of a person in their garden.
What offence might this constitute under UK law?