Check: do you process personal data with drones?
Want to check whether you process personal data with a drone and, therefore, have to comply with the General Data Protection Regulation (GDPR)? And whether you are doing this on a correct legal basis? View the examples.
On this page
Example: drone does not process personal data
The police use a drone to record how a crowd of people moves during an event in a city centre. The camera films from such a height, without zooming in, that the people are not clearly depicted. The people cannot be identified in any other way, for example, by their clothing. In this case, no personal data is processed.
Example: drone does process personal data
A drone films the houses in a residential area. Usually, the images of the houses will be (indirectly) traceable to people, even if a resident is not filmed. After all, in principle, the drone operator (pilot) knows where the drone flies and makes recordings (location data). Location data is often also explicitly recorded by the drone. Camera images and location data make it relatively easy to find out who the residents of the houses in question are. In this case, personal data is processed.
Example: the use of drones is unjustified
A factory owner checks the inside of the factory’s chimneys with a camera attached to a drone. The camera makes video recordings throughout its flight. It also records people. In this case and for this purpose - checking the chimneys - it is not necessary for video recordings to be made throughout the flight. It would be sufficient to only make video recordings when the drone is above and in the chimneys. This prevents people from being unnecessarily recorded.
Example: no legal basis
A local authority wants to use camera surveillance using drones to maintain public order. However, the local council has not given the mayor the authority to do so by ordinance, as prescribed in Article 151c of the Municipalities Act, meaning that the mayor cannot use camera surveillance.
Example: incorrect legal basis
A local authority films the entrance to the town hall with a camera drone to protect visitors and the building. The legal basis used by the local authority for such camera surveillance is Article 151c of the Municipalities Act. However, by virtue of this article, camera surveillance may only be used in public places to maintain public order and not to protect own buildings and visitors thereto. This means that the local authority based the camera surveillance on an incorrect legal basis.
Example: safe, not GDPR-proof
Someone wants to fly a drone above a residential area and make recordings in a private capacity. According to aviation regulations, it is not prohibited to fly a drone over a residential area if the drone is lighter than 900 grams. That is safe enough according to aviation regulations. But when it comes to people’s privacy, in addition to aviation regulations, the General Data Protection Regulation (GDPR) also applies. It does not matter how heavy or light the drone is.
The GDPR requires that people are notified about the fact that they may be filmed by the drone. And that it is not permitted for people to be recognisable in the images without their consent. In practice, it will be difficult to comply with the GDPR in this situation.
A drone may not be recording, but that is probably difficult for people in the residential area to see. For them it may very well feel as if their privacy is being violated. This also applies if the drone does make recordings, but people are blurred. It is advisable to take this into account and avoid misunderstandings.