Privacy and Data Protection Flashcards
6 cards from real A2 COFC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Privacy and Data Protection flashcards as text
Under the UK GDPR, what is considered personal data in the context of drone operations?
Answer: Any information that can identify a living individual, including images, video, vehicle registration plates, and location data
Under UK GDPR, personal data is any information relating to an identified or identifiable living individual. In drone operations, this includes photographs, video footage showing recognisable individuals, vehicle registration plates, and location data that could identify someone.
Who is the data controller when a commercial drone operator collects personal data during a survey flight commissioned by a client?
Answer: Both the client and the drone operator may be joint controllers or have a controller-processor relationship depending on the arrangement
The data controller is determined by who decides the purposes and means of processing personal data. In a commissioned drone survey, the client typically determines why the data is collected, while the operator may have discretion over how. This may create joint controllership or a controller-processor relationship, which should be documented.
What is the lawful basis most commonly relied upon by drone operators for incidental capture of personal data during legitimate operations?
Answer: Legitimate interests, balanced against the rights and freedoms of data subjects
For incidental capture of personal data during legitimate drone operations (such as property surveys or infrastructure inspections), legitimate interests is the most practical lawful basis. The operator must conduct a Legitimate Interests Assessment (LIA) to balance their interests against the privacy rights of individuals.
What rights do members of the public have if they are captured in drone footage under UK GDPR?
Answer: They have the right to access, erasure, and objection to processing of their personal data
Under UK GDPR, individuals have several rights including the right to be informed about data collection, right of access to their data, right to erasure ('right to be forgotten'), right to object to processing, and right to lodge a complaint with the ICO. These apply to identifiable individuals captured in drone footage.
Under what circumstances is a Data Protection Impact Assessment (DPIA) required for drone operations?
Answer: When the processing is likely to result in a high risk to individuals' rights and freedoms, such as systematic surveillance of public areas
A DPIA is required under UK GDPR when processing is likely to result in a high risk to individuals' rights and freedoms. For drone operations, this includes systematic monitoring of public areas, large-scale processing of personal data, or operations involving vulnerable individuals.
What should a drone operator do to comply with the transparency principle of UK GDPR when flying in a public area?
Answer: Where practicable, provide notice of the drone operation, such as signs in the area, and have a privacy policy available explaining how personal data will be handled
The transparency principle requires data controllers to inform individuals about the collection and use of their personal data. For drone operations, this can include posting notices in the operating area, wearing identification, and maintaining a publicly available privacy policy that covers drone data collection.