Drone Regulations

14. Is there a specific Data & Privacy Protection regulation applicable to UAS operations?

Bahamas

There are no specific Data & Privacy Protection regulations applicable to RPA operations.

Bolivia

This is not yet detailed in the regulation project.

Brazil

Data & Privacy Protection of UAS follows general rules for data and privacy protection in Brazil applicable to all types of data and privacy information. ANAC has not issued any specific rule. It will be from manufacturer’s own criteria to protect such information.

Canada

There is no privacy regulation specific to UAS operation; their use is subject to existing federal, provincial, and municipal privacy laws.

Colombia

No there is not specific regulation, but even when the register is available for public consult UAEAC must fulfill with current legislation about data bases and must give the correct treatment to all the information that collect during the registration process according to that legislation

Costa Rica

According to Article 11 of the Operational Directive, the owners and operators must comply with data protection and privacy laws in force in Costa Rica. If a complaint for the capture and diffusion of images without consent is filed, DGAC must initiate an investigation and the CE can be revoked.

El Salvador

There is not an express regulation regarding data protection in RAC-VANT. However, there are laws regarding privacy protection, so in order to operate above private property, the operator must have a written authorization from the owner. UAS cannot be operated in a radius of 2 km from authorized private runways.

Germany

In Germany there is no specific Data & Privacy Protection regulation applicable to UAS operations. However, the operation of UAS might have an impact on data protection and the Federal Data Protection Act does apply.

Data Protection and the Right to Control the Use of One’s image are special codifications of the General Right of Personality, which is derived from article 2 (1) in conjunction with article 1 of the German Constitution. Hence, flying over a neighbor’s property for example might be an intrusion into someone’s private sphere of life and violate the General Right of Personality.

“Personal Data” is defined as “any information concerning the personal or material circumstances of an identified or identifiable individual”. The act does not apply to the processing of personal data effected solely for personal or family activities.

For UAS equipped with a video camera, the requirements of section 6b of the Federal Data Protection Act apply. Video surveillance of public places may only be conducted to fulfill public tasks, to exercise the right to determine who shall be allowed or denied access to a property, or to pursue rightful interests for precisely defined purposes. According to section 4(1) of the act, special rules apply to the surveilling of a non-public area. In such case, any collection, processing, and use of personal data is only admissible if permitted by law or if the person has consented. In addition, the person has to be informed of the identity of the data collector, purposes of collection, processing, or use of the personal data and of possible recipients.

Taking videos by UAS might also violate the right to control the use of one’s image. According to section 22 (1) of the Copyright Arts Domain Act, images can only be disseminated with the express consent of the person concerned.

Guatemala

There is not an express regulation on this matter.

India

There is no specific Data & Privacy Protection regulation applicable to UAS operations in India but the CAR makes the UAS operator liable to ensure that privacy norms of any entity are not compromised in any manner while operating the UAS.

Israel

There is no sector-specific data and privacy protection regulation applicable to UAS operations. However, in March 2020, the Israeli Privacy Protection Authority (a unit within the Ministry of Justice tasked with regulating, supervising and enforcing the provisions of the Protection of Privacy Law, 1981) (respectively, the “PPA” and the “PPL”)), published a document setting out recommendations regarding the privacy aspects of operating UAS for the purpose of collecting and processing personal information.

According to the PPA, UAS pose a significant potential threat to privacy, given that they are devices that can be easily installed with technology that can make them become effective and intrusive tracking means, capable of collecting, storing and transmitting sensitive information over time.

According to the PPA, the provisions of the PPL apply to the collection of personal information using UAS. Nevertheless, the PPA believes that traditional information protection laws should be adapted to address current technological-related developments and problems posed by UAS, such as intrusive monitoring from the air.

According to the PPA, the operation of UAS whose sole purpose is to photograph or collect other data about an identified or identifiable person, which data is then captured by sensors installed on the UAS and stored in computerized digital format, would be deemed to create a “database”, within the meaning of the term in Section 7 of the PPL, to which various rules apply, including the obligation to register the database with the Registrar of Databases. It should be noted that the definition of “database” in the PPL excludes the collection of data intended for personal use. However, the PPA believes that an amendment to the definition of “database” should be considered, so that the provisions of the PPL regulating the operation of databases, will apply also to individuals who operate UAS for the purpose of collecting large amounts of sensitive information about others, even if not for commercial purposes.

Italy

No, there is not. The rules laid down in the Italian Privacy Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018) and in Regulation (EU) 2016/679 (GDPR) apply to the flight operations with UAS. However, the Italian Personal Data Protection Authority has recently published guidelines regarding the use of UAS, according to which: (i) UAS must not violate personal spaces and privacy; (ii) the use of photos and videos is permitted only with the prior written consent of the subjects, or, without such authorization, if the subjects cannot be recognized; (iii) personal data (such as home addresses and car license plates) cannot be reproduced.

Kenya

Under the Draft Regulations, any person who will be conducting operations using UAS fitted with cameras or other sensing equipment shall operate them in a responsible way to respect the privacy of other persons and their property. No person shall use a UAS to do any of the following-

(a)     Conduct surveillance of-

(i)     a person without the person’s consent; and

(ii)     private real property without the consent of the owner;

(b)     Photograph or film an individual, without the individual’s consent, for the purpose of publishing or otherwise publicly disseminating the photograph or film.

Infrared or other similar thermal imaging technology equipment fitted on UAS shall only be for the sole purpose of-

(a)     mapping and evaluating the earth’s surface, including terrain and surface water bodies and other features;

(b)     investigation of forests and forest management;

(c)     search and rescue; and

(d)     other similar investigations of vegetation or wildlife.[18]

[18] Regulation 41 of the Draft Civil Aviation (Unmanned Aircraft Systems) Regulations,2019

Mexico

Yes, there is the Electronic Registry of RPAS (Registro Electrónico de RPAS) at the Mexican Aeronautic Registry, regulated through the Law on Transparency and Access to Information (Ley de Transparencia y Acceso a la Información).

Nicaragua

There is not an express regulation on this matter.

Norway

There is no specific Data & Privacy Protection regulation focused on UAS operations. More general rules on privacy and data protection may apply to the specific use of the UAS, such as the Personal Data Act.

The Norwegian Data Protection Authority has made its own instruction manual on the use of drones.

Pakistan

No. However, under the local laws it is an offence to access or transmit an information system or data without first obtaining authorization from the person(s) whose information system or data is being accessed or transmitted.

Panama

The non-consensual photography or video recording of third parties or their property or belongings, interference, annoyance or observation, performed by a drone, which are not for sports or recreational purposes, is prohibited by local regulations.

Philippines

Presently, the PCAR does not provide for specific Data & Privacy Protection regulation applicable to UAS operations. The applicable provisions of the general law, The Data Privacy Act of 2012, and its implementing rules and regulations, shall govern. 

Portugal

No. General data & Privacy Protection rules are applicable.

Puerto Rico

There is no current state legislation in Puerto Rico covering this. Proposed legislation PC 402 provides for privacy protection.

Romania

There are no specific data and privacy protection regulations applicable to UAS operations. However, it is to be noted that for photography, movies or topo geodesic measurements at a scale bigger than 1:20000 it is required to have a permit from the Ministry of National Defense. The general rules apply in this field as well.

South Africa

No.

Spain

Article 7 of the RD 1036/2017 introduced applicability of data protection regulations during UAS operations and the operator shall be responsible to comply with said regulations. The foregoing is aligned with the provisions of EU Regulation 2019/947, hence is still applicable.

Furthermore, it enables the Spanish Data Protection Agency to proceed with the corresponding disciplinary and inspection files to confirm if drone operations are carried out in accordance with the applicable regulations in data protection matters. The regulations concerning data protection applicable to UAS operations are the same as for any other activities only if the relevant UAS is collecting and recording personal details, a person is identified or can be identified.

If this is the case, the requirements, obligations, rights, and fines provided in the Spanish Data Protection Act and the regulations of the European Union (General Data Protection Regulation (EU) 2016/679) will be applicable, and the Spanish Data Protection Agency could initiate administrative proceedings against it. In addition, those UAS which activity could pose a risk to privacy and data protection, will be obliged to register their UAS and themselves in the EU interoperable Registry through AESA.

Switzerland

The general Federal Act on Data Protection and the general civil rights in relation to the protection of individual privacy are applicable to UAS operations. However, specific regulations in relation to data protection and UAS operations are currently discussed in Switzerland.

Turkey

No, But UAS operator has the responsibility to give importance and take care of privacy.

United Kingdom

United States of America

There are no FAA-promulgated data or privacy protection regulations specifically directed at UAS operations. However, generally applicable federal laws (such as the Fourth Amendment’s protection against unreasonable searches) may affect UAS operations in connection with data and privacy protection. Additionally, local government entities may promulgate laws aimed at data and privacy protection.