A2 CofC - Drone Certificate of Competency Privacy and Data Protection Questions and Answers Flashcards

A remote pilot is hired to survey a public park for a local council. To comply with data protection law, they put up signs at the park entrances informing the public about the drone flight, its purpose, and who is operating it. This action primarily helps to fulfil which key principle of the UK GDPR?

Answer: Lawfulness, Fairness and Transparency

The principle of 'Lawfulness, Fairness and Transparency' requires that data processing is transparent. Providing clear notice to the public via signs explains how and why data (in this case, video footage) is being collected, which is a core part of transparency.

While filming a property for an estate agent, a drone pilot inadvertently captures clear, identifiable footage of a neighbour sunbathing in their fenced back garden. Under the UK GDPR, why is this a serious data protection issue?

Answer: The pilot does not have a lawful basis to process the neighbour's data in a place where they have a reasonable expectation of privacy.

The UK GDPR requires a lawful basis for processing personal data. While the pilot has a lawful basis to film the client's property, this does not extend to filming a neighbour in their private garden where they have a reasonable expectation of privacy. This is considered a serious breach, often referred to as 'collateral intrusion'.

If a member of the public believes their personal data has been unlawfully captured by a commercial drone operation, which UK organisation is the primary regulatory body they should contact to make a formal complaint?

Answer: The Information Commissioner's Office (ICO)

The Information Commissioner's Office (ICO) is the UK's independent authority responsible for upholding information rights and data privacy. Complaints regarding potential breaches of the UK GDPR and the Data Protection Act 2018, including those involving drones, should be directed to the ICO. The CAA handles aviation safety and regulation, not data protection.

Which of the following is the clearest example of 'personal data' that could be captured by a drone, according to the definitions used by the Information Commissioner's Office (ICO)?

Answer: A clear image of a car's registration plate parked on a public street.

Personal data is any information that can be used to identify a living person. A vehicle registration plate can be used to identify the registered keeper of the vehicle and is therefore considered personal data under UK GDPR. The other options do not contain information that directly identifies an individual.

A drone operator regularly conducts commercial flights that may inadvertently capture images of people. To comply with the 'accountability' principle under UK GDPR, which of the following actions is most important?

Answer: Maintaining documented records of their data processing activities and privacy policies.

The accountability principle requires data controllers not only to comply with the UK GDPR but also to be able to demonstrate that compliance. This is achieved through measures like maintaining records of processing activities (ROPAs), having clear data protection policies, and documenting decisions, such as conducting a Data Protection Impact Assessment (DPIA).

A remote pilot has completed a roof inspection and the captured video contains incidental footage of identifiable people walking in the street below. According to the principle of 'data minimisation', what should the pilot do with this incidental footage?

Answer: Blur or anonymise the faces of the identifiable individuals before storing or sharing the video.

Data minimisation means only processing the personal data that is necessary for the specific purpose. Since the people in the street are not relevant to the roof inspection, their personal data should not be processed unnecessarily. The best practice is to anonymise this data (e.g., by blurring faces) to protect their privacy while retaining the necessary footage for the client.