Drones: Privacy implications across the EU

15 July 2013

Gabriel Voisin

A new article on this topic was published in March 2016: 

Unmanned Aerial Systems: Privacy and Regulatory Implications across Europe, the Middle East and Asia-Pacific


Drones have become notorious through their military use. However, industry has now started to look at the civilian applications of drones. While they come in a variety of shapes and sizes, the key element of a drone it that it is an unmanned aerial vehicle ("UAV").

Some of these are piloted remotely and are generally known as Remotely Piloted Air Systems ("RPAS"), whereas others fly autonomously following pre-programmed flight paths. They are generally cheaper to produce than conventional manned aircraft, can be kept airborne for extended periods of time, and do not risk the lives of the crew which pilots them. For the following article, we will collectively refer to them as "Drones".

The use of Drones is extending beyond the military into a number of other sectors, for instance:
  • Journalism – Drones can be used to capture footage (e.g. TV companies used Drones to film areas that were inaccessible to film crews after the passage of hurricane Katrina).
  • Scientific research – Drones can be fitted with a variety of sensory equipment and can be used to conduct research in conditions inhospitable to humans or for length periods which humans could not endure (see illustration);
  • Agriculture – Drones can be used to administer phytosanitary treatments on plantations;
  • Advertisement – Drones can be used to tow banners across the sky; or
  • Surveillance by law enforcement agencies or private companies – Surveillance is already a major use of Drones in the military and the same technology could be applied to commercial use. They are even being used by Paparazzi as this article on Der Spiegel demonstrates;
  • In 2012, the US passed a law allowing the Federal Aviation Administration (FAA) to authorise government agencies and law enforcement to use Drones, and it has to start allowing commercial use of Drones by 2015.
In the Europe Union, use of Drones raises legal questions. The following three possible legal issues can be identified:
  • Aviation regulations regarding the use of Drones;
  • Data protection implications where the Drone is capturing personal data; and
  • CCTV regulations where domestic law would regard video capture by Drones as equivalent to CCTV.

The table below briefly summarise the law in regard to each of these issues for the various European jurisdictions in which Bird & Bird are based.

Country Aviation Requirements Data Protection Requirements CCTV Requirements
Belgium YES – Drones used for recreational purposes are subject to the following provisions:
• Use of Drones: Decree of 15 September 1994 on air traffic rules; C.A.A. measure of 1 June 2005 (“Circulaire”) CIR/GDF-01.
• Manufacturing of Drones: no specific rule (possible application of the Toys Safety Act of 9 February 1994 to the manufacturing of Drones sold for recreational purposes).
The use of Drones in Belgian airspace is subject to an authorization being obtained from the Belgian C.A.A. and from the Belgian Telecommunications Institute (IBPT).
POSSIBLY – The use of a Drone to capture or record images of individuals for the purpose of surveillance in a public open space (e.g. a park) or in a private space open to the public (e.g. a shop) is prohibited, except if use by law enforcements bodies (Camera Surveillance Act of 21 March 2007).
Belgian data protection law applies to the capture of images with no surveillance purpose: a valid ground for processing data would be needed (e.g. legitimate interest of the controller), information should be given to the data subjects, and the Belgian Data Protection Agency would have to be notified of the data processing activity.
The use of Drones for CCTV purposes is prohibited except if use by law enforcements bodies.
France YES – Drones are subject to the following regulations:
• Use of Drones: Decree of 11 April 2012
• Manufacturing of Drones: Decree of 11 April 2012
If a device recording any type of data from outside the visible spectrum (e.g. radar, thermograph, infrared) is used by a Drone, authorisation is required. This authorisation is valid for no more than 3 years.
If a device recording any type of data from within the visible spectrum (e.g. photographs and videos taken from an image/video recording device/camera) is used by a Drone, then a declaration shall be done two weeks before the operations take place, unless the Drone is deployed for recreational use on an occasional basis.
POSSIBLY – If a Drone captures and records images of individuals, French data protection law would apply: a valid ground for processing data would be needed (e.g. legitimate interest of the controller), information should be given to the data subjects, and French Data Protection Agency would have to be notified of the data processing activity.
The notification requirement would be satisfied by way of a filing which specifies the purpose of the activity, the categories of personal data processed, the data subjects, the recipients to whom the personal data may be disclosed and the retention period of personal data. The notification is valid for an unlimited period of time. Note that the CNIL has issued a public statement on this issue which can be found here (in French).
POSSIBLY - If CCTV is used by a Drone to monitor places open to the public (e.g.: amusement park), an authorization from the police headquarters (“Prefecture de Police”) would also be needed.
The authorization is valid for 5 years and will have to be renewed before expiration. The above applies even if the images are not recorded. Note that we are not aware of any police authorisation having been issued in this respect. Like for the UK, the public notice requirement is likely to be difficult to satisfy.
Germany YES – Drones are subject to the following regulations:
German Air Trafic Act (“Luftverkehrsgesetz”); and
German Aviation Regulation (“Luftverkehrs-Ordnung” – “GAR”)
According to s. 15 a para.3 GAR the use of Drones which are not operated for sports or recreational purposes, is generally prohibited if the Drone is used: (i) out of sight of the controller; or (ii) the total mass of the device is more than 25 kilograms.
However, it is – as an exception to this rule – possible to obtain an authorization to use Drones from the competent local Aerial Authority. Such a license will only be granted if the intended use does not constitute a risk to public order and security (and in particular does not infringe on personal rights of individuals and, accordingly, German data protection law).

POSSIBLY - There are no specific data protection regulations which apply to Drones, nor any specific guidance on the subject.
However, it is conceivable that certain data gathered by Drones could be considered personal data (in particular if images of individuals are captured/recorded), in which case the data would have to be processed in accordance with the German Data Protection Act (“Bundesdatenschutzgesetz” – “GDPA”).
In this context it should also be noted that an authorization (cf. left column) will only be granted if the user declares that the use of Drones does not infringe data protection law.
YES – According to s. 6 b GDPA, CCTV, if used by a Drone to monitor places open to the public, is only lawful as far as: (1) necessary for: (i) public bodies to perform their duties; (ii) to exercise the right to determine who shall be allowed or denied access; or (iii) to pursue legitimate interests for specifically defined purposes; and (2) there are no indications of overriding legitimate interests on the part of the subject of the data.
The specific information obligations required by German data protection law (i.e. providing the public notice of the CCTV system) might be difficult to implement when Drones are being used.
The monitoring of dwellings and other spaces especially protected from view (e.g. a hedge-protected garden) is prohibited under section 201 a of the German Criminal Code (“Strafgesetzbuch”). Such monitoring requires the individual’s consent.
Spain POSSIBLY – Civil applications are yet
to be developed and currently Drones are only used for experimental purposes.
For the time being under Spanish legislation, Drones may only obtain authorisation from the Spanish Civil Aviation General Directorate to operate for experimental purposes under a Special Experimental Certificate of Airworthiness or (“Certificado de Aeronavegabilidad Especial Experimental”).
A regulatory framework for the civilian applications of Drones is expected to be developed in the near future, jointly by the Spanish Civil Aviation authority together with the Spanish National Security Aviation Agency (“AESA”).
POSSIBLY – Use of Drones are not foreseen in the Spanish Data Protection Act.
However, personal data collected through Drones would have to comply with Spanish data protections law: a valid ground for processing data would be needed (e.g. legitimate interest of the controller), information should be given to the data subjects and the Spanish Data Protection Agency would have to be notified of the data processing activity.
Please note that data protection regulations are not applicable to images obtained by the media.
POSSIBLY – CCTV requirements are regulated by Data Protection regulations. Certain obligations regarding information requirements would be difficult to comply with.
Images obtained by private entities must comply with the data quality principle and avoid all unnecessary images of public spaces. Images of public spaces obtained by the police need an administrative authorization.
Regarding sports events, there are specific regulations that foresee the use of mobile cameras (non-fixed) for security reasons. Drones are not mentioned specifically in these regulations, but they may serve as a legal ground to use them.
UK YES – The Civil Aviation Authority (the CAA) has published detailed guidance covering the regulation of Drones in the UK.
Drones operating in the UK must meet at least the same safety and operational standards as manned aircraft (the specific requirements vary with the size of the aircraft).
POSSIBLY - There are no specific data protection regulations which apply to Drones, nor any specific guidance on the subject.
However, personal data collected through Drones would have to comply with the Data Protection Act: a valid ground for processing data would be needed (e.g. legitimate interest of the controller), information should be given to the data subjects, and the UK Data Protection Agency would have to be notified of the data processing activity.
POSSIBLY - There is no specific legal regime relating to CCTV in the UK. However, the Data Protection Act does apply to CCTV systems. The ICO would have to be notified of the data processing. Certain obligations regarding providing the public notice of the CCTV system might be difficult to implement when Drones are being used.
This problem was mentioned by the ICO in their submission to the Joint Committee - pre-legislative scrutiny of the draft Communications Data Bill (at page 55).

As outlined above, each country concerned will have its own set of issues and legal restrictions to be considered before Drones can be used. One of the main difficulties is around the duty to inform individuals subject to Drone activities.

Theoretically, under EU and Member State laws, Drone controllers must provide individuals with information about data processing. However, this does not apply when individuals have already been informed, or when informing them proves impossible or would involve disproportionate efforts. Drone controllers could benefit from this exemption.

However, they will still have to engage in general information campaigns in an adequate way. As Google did with its Google Street View service, Drone controllers could arrange a dedicated and visible section of their websites to inform the public of their activities. The notice would have to contain the following information: details of the entity responsible for processing Drone data; purposes of processing; the type of data; the duration of processing; the rights of data subjects to access, rectify or erase their data and the right to object.

It should also be noted that Drones are being viewed as a growing concern by individuals and part of the civil society. As a result, industry and entrepreneurs have started looking at ways to circumvent Drone technologies. For example, recently a New York based entrepreneur introduced a line of ‘anti-drone’ clothing intended to thwart aerial surveillance, in particular thermal imaging. This work highlights the growing unease felt on the ground at the possibility of the sky swelling with new surveillance technologies, such as Drones.

Author: Gabriel Voisin, Associate, UK.

Contact us:

Cedrine Morliere, Senior Associate, Belgium

Vonnick Le Guillou, Partner, France

Lennart Schuessler, Associate, Germany

Jose Luis Llorente Howell, Senior Associate, Spain

Authors