Privacy Law & GDPR Flashcards
6 cards from real A2 COFC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Privacy Law & GDPR flashcards as text
Under UK GDPR, drone footage containing identifiable individuals is classified as what type of data?
Answer: Personal data requiring a lawful basis for processing
Images and footage of identifiable people constitute personal data under UK GDPR. The drone operator (as data controller) must have a lawful basis for capturing, storing, and using this data. For commercial operations, this typically means a legitimate interest assessment or obtaining explicit consent.
Which UK legislation, alongside UK GDPR, governs the use of personal data collected by drones?
Answer: The Data Protection Act 2018
The Data Protection Act 2018 supplements UK GDPR in domestic law. Together they form the primary data protection framework in post-Brexit UK. Drone operators conducting aerial photography of people must comply with both pieces of legislation.
What is the 'legitimate interests' lawful basis and how might it apply to commercial drone photography?
Answer: Processing is justified by the genuine business need of the operator, provided it does not override individuals' rights — e.g., property photography where people are incidentally captured
Legitimate interests can justify processing personal data where the operator has a genuine, proportionate business purpose and a Legitimate Interests Assessment (LIA) shows that the individuals' rights are not overridden. Aerial property photography where passers-by are incidentally captured may qualify, but the operator must document their assessment.
A drone pilot captures footage of a private garden while filming an aerial property shoot. What privacy consideration applies?
Answer: The footage may intrude on reasonable expectation of privacy; the operator should minimise capture of private spaces and consider whether processing is justified
People have a reasonable expectation of privacy in their gardens even though they are visible from above. Drone operators should plan flights to minimise capture of private spaces, consider the necessity and proportionality of the footage, and be prepared to justify their processing under UK GDPR if challenged.
How long may a drone operator retain footage containing identifiable individuals under UK GDPR principles?
Answer: Only for as long as necessary for the specified purpose, then it must be securely deleted
The UK GDPR storage limitation principle requires that personal data is kept only for as long as necessary for the purpose for which it was collected. Once the purpose is fulfilled, footage containing personal data must be securely deleted or anonymised.
What should a commercial drone operator do if a member of the public requests access to footage in which they appear?
Answer: Respond to the Subject Access Request (SAR) within one calendar month, providing the footage or an explanation if an exemption applies
Under UK GDPR, any individual has the right to submit a Subject Access Request for their personal data. The data controller (drone operator) must respond within one month, providing a copy of relevant footage or explaining any applicable exemptions (e.g., if providing the footage would reveal personal data of a third party who cannot be redacted).