A2 CofC Privacy and Data Protection — Questions and Answers
Question 1: Under the UK GDPR, what is considered personal data in the context of drone operations?
- Only the names and addresses of people filmed
- Any information that can identify a living individual, including images, video, vehicle registration plates, and location data (Correct answer)
- Only data stored in written documents
- Personal data does not apply to drone footage
Correct answer: Any information that can identify a living individual, including images, video, vehicle registration plates, and location data
Under UK GDPR, personal data is any information relating to an identified or identifiable living individual. In drone operations, this includes photographs, video footage showing recognisable individuals, vehicle registration plates, and location data that could identify someone.
Question 2: Who is the data controller when a commercial drone operator collects personal data during a survey flight commissioned by a client?
- The drone pilot only
- The client who commissioned the survey
- Both the client and the drone operator may be joint controllers or have a controller-processor relationship depending on the arrangement (Correct answer)
- The Information Commissioner's Office (ICO)
Correct answer: Both the client and the drone operator may be joint controllers or have a controller-processor relationship depending on the arrangement
The data controller is determined by who decides the purposes and means of processing personal data. In a commissioned drone survey, the client typically determines why the data is collected, while the operator may have discretion over how. This may create joint controllership or a controller-processor relationship, which should be documented.
Question 3: What is the lawful basis most commonly relied upon by drone operators for incidental capture of personal data during legitimate operations?
- Consent from every individual filmed
- Legitimate interests, balanced against the rights and freedoms of data subjects (Correct answer)
- A contract with each data subject
- Vital interests of the data subjects
Correct answer: Legitimate interests, balanced against the rights and freedoms of data subjects
For incidental capture of personal data during legitimate drone operations (such as property surveys or infrastructure inspections), legitimate interests is the most practical lawful basis. The operator must conduct a Legitimate Interests Assessment (LIA) to balance their interests against the privacy rights of individuals.
Question 4: What rights do members of the public have if they are captured in drone footage under UK GDPR?
- They have no rights regarding drone footage
- They have the right to access, erasure, and objection to processing of their personal data (Correct answer)
- They can only complain to the police
- They must pay a fee to exercise any data rights
Correct answer: They have the right to access, erasure, and objection to processing of their personal data
Under UK GDPR, individuals have several rights including the right to be informed about data collection, right of access to their data, right to erasure ('right to be forgotten'), right to object to processing, and right to lodge a complaint with the ICO. These apply to identifiable individuals captured in drone footage.
Question 5: Under what circumstances is a Data Protection Impact Assessment (DPIA) required for drone operations?
- A DPIA is never required for drone operations
- When the processing is likely to result in a high risk to individuals' rights and freedoms, such as systematic surveillance of public areas (Correct answer)
- Only when flying over government buildings
- Only for drones weighing over 25 kg
Correct answer: When the processing is likely to result in a high risk to individuals' rights and freedoms, such as systematic surveillance of public areas
A DPIA is required under UK GDPR when processing is likely to result in a high risk to individuals' rights and freedoms. For drone operations, this includes systematic monitoring of public areas, large-scale processing of personal data, or operations involving vulnerable individuals.
Question 6: What should a drone operator do to comply with the transparency principle of UK GDPR when flying in a public area?
- Nothing, as filming in public requires no notification
- Where practicable, provide notice of the drone operation, such as signs in the area, and have a privacy policy available explaining how personal data will be handled (Correct answer)
- Shout warnings to people in the area
- Only fly when no one is present
Correct answer: Where practicable, provide notice of the drone operation, such as signs in the area, and have a privacy policy available explaining how personal data will be handled
The transparency principle requires data controllers to inform individuals about the collection and use of their personal data. For drone operations, this can include posting notices in the operating area, wearing identification, and maintaining a publicly available privacy policy that covers drone data collection.
A2 CofC Privacy and Data Protection
Under the UK GDPR, what is considered personal data in the context of drone operations?