A2 CofC Privacy Law & GDPR — Questions and Answers
Question 1: Under UK GDPR, drone footage containing identifiable individuals is classified as what type of data?
- Personal data requiring a lawful basis for processing (Correct answer)
- Public domain data freely usable without restriction
- Anonymised data exempt from GDPR
- Sensitive biometric data always requiring explicit consent
Correct answer: Personal data requiring a lawful basis for processing
Images and footage of identifiable people constitute personal data under UK GDPR. The drone operator (as data controller) must have a lawful basis for capturing, storing, and using this data. For commercial operations, this typically means a legitimate interest assessment or obtaining explicit consent.
Question 2: Which UK legislation, alongside UK GDPR, governs the use of personal data collected by drones?
- The Data Protection Act 2018 (Correct answer)
- The Human Rights Act 1998 only
- The Surveillance Camera Code of Practice only
- The Computer Misuse Act 1990
Correct answer: The Data Protection Act 2018
The Data Protection Act 2018 supplements UK GDPR in domestic law. Together they form the primary data protection framework in post-Brexit UK. Drone operators conducting aerial photography of people must comply with both pieces of legislation.
Question 3: What is the 'legitimate interests' lawful basis and how might it apply to commercial drone photography?
- Processing is justified by the genuine business need of the operator, provided it does not override individuals' rights — e.g., property photography where people are incidentally captured (Correct answer)
- Any commercial activity automatically qualifies as a legitimate interest
- It only applies to law enforcement bodies
- Legitimate interests cannot be used for aerial photography under any circumstances
Correct answer: Processing is justified by the genuine business need of the operator, provided it does not override individuals' rights — e.g., property photography where people are incidentally captured
Legitimate interests can justify processing personal data where the operator has a genuine, proportionate business purpose and a Legitimate Interests Assessment (LIA) shows that the individuals' rights are not overridden. Aerial property photography where passers-by are incidentally captured may qualify, but the operator must document their assessment.
Question 4: A drone pilot captures footage of a private garden while filming an aerial property shoot. What privacy consideration applies?
- The footage may intrude on reasonable expectation of privacy; the operator should minimise capture of private spaces and consider whether processing is justified (Correct answer)
- Private gardens are publicly visible from the air so no privacy law applies
- Only footage taken below the garden fence height triggers privacy law
- The garden owner must be identified and billed for the footage
Correct answer: The footage may intrude on reasonable expectation of privacy; the operator should minimise capture of private spaces and consider whether processing is justified
People have a reasonable expectation of privacy in their gardens even though they are visible from above. Drone operators should plan flights to minimise capture of private spaces, consider the necessity and proportionality of the footage, and be prepared to justify their processing under UK GDPR if challenged.
Question 5: How long may a drone operator retain footage containing identifiable individuals under UK GDPR principles?
- Only for as long as necessary for the specified purpose, then it must be securely deleted (Correct answer)
- Indefinitely, provided it is stored securely
- For a maximum of 12 months regardless of purpose
- For as long as the operator holds an ICO registration
Correct answer: Only for as long as necessary for the specified purpose, then it must be securely deleted
The UK GDPR storage limitation principle requires that personal data is kept only for as long as necessary for the purpose for which it was collected. Once the purpose is fulfilled, footage containing personal data must be securely deleted or anonymised.
Question 6: What should a commercial drone operator do if a member of the public requests access to footage in which they appear?
- Respond to the Subject Access Request (SAR) within one calendar month, providing the footage or an explanation if an exemption applies (Correct answer)
- Refuse the request as aerial footage is not covered by UK GDPR
- Delete the footage immediately to avoid compliance issues
- Only comply if the individual can prove they are in the footage
Correct answer: Respond to the Subject Access Request (SAR) within one calendar month, providing the footage or an explanation if an exemption applies
Under UK GDPR, any individual has the right to submit a Subject Access Request for their personal data. The data controller (drone operator) must respond within one month, providing a copy of relevant footage or explaining any applicable exemptions (e.g., if providing the footage would reveal personal data of a third party who cannot be redacted).
A2 CofC Privacy Law & GDPR
Under UK GDPR, drone footage containing identifiable individuals is classified as what type of data?