Introduction
Drones, also known as unmanned aerial vehicles (UAVs) or remotely piloted aircraft systems (RPAS), are airborne vehicles which are remotely controlled by a human pilot on the ground. In the future, this process may be entirely automated. Drones have long been used in military settings but have seen increased commercial use since the 2010s with the arrival of small, consumer priced models used primarily for videography and photography. The technology has also seen rapid adoption across a wide range of new uses, including policing and security, search and rescue, and in the creative fields.
Today, more sectors are showing an interest in embedding drone technology, seeing them as tools that may help carry out tasks in a faster, safer and cheaper manner. In the future, as wider regulatory barriers to deployment are overcome and the broader potential of the technology is realised, drones could be rolled out more widely. This could significantly impact our cities and streets, and with it our concept of what constitutes public and private spaces. Increased privacy concerns are a natural byproduct of this increased proliferation.
About drones
Drones can come in sizes ranging from the very small (under 250 grams), with rotary wings allowing for vertical take offs and landings, to large vehicles that are similar in size, look and operation to small aircraft. Future commercial drone uses are likely to include industries such as health, construction and transportation and therefore they will become more present in people’s daily lives. They are likely to be able to fly in higher airspaces, able to cover further distances for longer amounts of time, with the ability to carry cargo of varying weights.
State of development
While we have seen growing use in the UK, the scaling up of the commercial use of drones has so far been restricted by aviation regulatory requirements. These limit the widescale use of drones flying beyond the visual line of sight (BVLOS) of the operator, in addition to other regulations about environmental health and safety. The readiness and maturity of drone technology and operations has also needed to advance to prepare for meeting these new regulatory requirements.
The government’s drone ambition statement, released in 2022, publicly commits them to delivering an enabling regulatory framework. This will safely and efficiently support the drone industry as it develops and work with the Civil Aviation Authority (CAA) to ensure it has the capability and capacity to provide guidance in areas such as BVLOS. In recent months a number of high-profile pilot projects about BVLOS have begun across the UK. This includes the Royal Mail delivering post in the Scottish Highlands and RNLI & Royal Life Saving Society UK’s pilot on Cornish beaches to test the use of a new emergency response drone pilot rescue service.
There are a huge range of potential use cases for commercial drones, from moving goods and people to air advertisements and flying QR codes, to more timely and accurate weather forecasting. However, the future trajectory of drone use will heavily rely on the advancements in the technology and public perception in years to come.
At present, beyond the use of drones for search and rescue and emergency services, industry research shows high levels of support for drone use in infrastructure, agriculture and for the tracking of criminals.
In contrast, there appears to be limited public support for Advanced Air Mobility (AAM) programmes, such as flying taxi drones. Notably, there also appears to be a discrepancy between consumer and industry interest in drones for delivering packages, with industry viewing this more positively than consumers.
Despite public wariness, drone technology is beginning to be used for this purpose internationally, including for expedited deliveries and food deliveries. It remains unclear if drone deliveries would be economically viable for routine business-to-consumer deliveries in the near future. However, they have been successfully trialled in the UK for business deliveries, including during the Covid-19 pandemic to deliver vaccines and test kits to rural areas and shore-to-ship deliveries, as well as internationally for a broad range of uses.
As drones become more widespread and more present in our day-to-day lives, concerns around their privacy and data protection implications are likely to become more prominent.
Fictional future scenario
Priya is attending her first music festival with a group of friends and will be camping onsite for the weekend. The festival organiser has decided to use drones for crowd monitoring and health and safety during the event. They procure the services of a third-party drone operator which will provide real-time images and monitoring to help manage crowd patterns and improve safety. This also enables the organisers to make better-informed decisions about provisions and festival staff allocations. Furthermore, the drones are equipped with heat sensors that they use to monitor attendees who have wandered into out-of-bounds areas on the site (especially helpful late at night).
The organisers are happy with the services provided, but not all attendees feel the same way. Priya sees one of the drones hovering low over the camping area of the festival site. This feels very intrusive, especially as she and her friends had deliberately pitched their tents closely together, to provide a more private area in the centre. She’s not sure if a fellow attendee is using the drone to capture photo or video content, or if the drone is being used in an official capacity by the organisers. Priya uses the Remote ID app on her phone to identify the drone operator, but it’s not clear that they are acting on behalf of the festival organisers as they aren’t mentioned on the Remote ID app. This leaves Priya concerned about who has recorded her friend group, and what the footage may have captured before they realised they were being monitored.
Data protection and privacy implications
- Surveillance: One of the key concerns about drones is their discreet nature and potential use for surveillance. We have already addressed this in our guidance on video surveillance and we continue to monitor for advancements in this market area. Where the primary purpose of the drone is for surveillance, is therefore out of scope for this exploration
- Inadvertent and mass data collection: Drones are likely to collect personal information during their operations. This includes:
- personal information programmed into the drone prior to operational flight;
- audio, video or photos of people, captured either when on the ground or in flight; and
- information that may point to an identifiable person, such as their number plates or address details.
Some of these activities may involve capturing personal information of employees working in the vicinity of the drone, people in public spaces, or people within the boundary of their private property.
Due to their bird’s eye nature and wide aspect, drones also have the potential to collect large volumes of information, some of which may be personal information. This raises further concerns about transparency and facilitating people’s rights, including the right to be informed if their personal information is being processed. Our guidance on video surveillance clarifies that organisations should consider switching on and off any recording system when appropriate, and unless necessary and proportionate any recording should not be continuous.
Where organisations cannot avoid collecting and processing personal information, they could consider obfuscation or blurring solutions as a proactive mitigation. Similar obscuring filters are already used by a number of street view and map applications to selectively blur out people or spaces and could be expanded to drone captured imagery and video.
- Transparency requirements and privacy information: Broader concerns remain for the use of drones by commercial organisations. These cover a variety of purposes, including aerial imaging, inspection, deliveries and other capabilities which may inadvertently collect personal information as part of their operations. Complying with transparency requirements and conveying appropriate privacy information to people at the right time may be challenging due to the mobile nature of the drones themselves.
- Drone IDs: One option may be linked to a remote ID programme for drones. This solution allows people on the ground to remotely identify airborne drones. This type of identification system would not be dissimilar to car number plates. However, the information would be wirelessly broadcast from the drone to someone on the ground seeking to identify the vehicle through a mobile application. This information could be received by people or authorised organisations, such as aviation safety bodies, law enforcement or national security agencies.
Countries such as the US, Japan and Switzerland have already implemented remote ID programmes. While their core aim is generally linked to safety and security, they may also be used to support compliance with data protection legislation. They do this by providing people with the ability to verify a drone’s operator and potentially link them to the relevant organisation’s privacy policy. Remote IDs could also include information about a drone’s location and altitude, their take-off and intended landing location, and the type of sensors in operation on the drone.
Some jurisdictions have chosen to implement a “tiered access” remote ID system. This provides minimal information to the general public, but authorised organisations, such as law enforcement agencies and safety inspectors, are able to access more detailed information about a drone’s specifics. The UK is currently exploring whether and how to implement a remote ID programme.35
Recommendations and next steps
- It will be critical that regulators and industry engage to establish policies and standards about personal information collected by drones as they become more prominent in our everyday lives. This will provide commercial operators with regulatory certainty and increase consumer trust in commercial drone operations. We are committed to take part in these discussions and to continuously monitor developments in the rapidly evolving drone space
- Embedding privacy by design into the hardware and applications of drones will be critical in supporting organisations and drone operators to evidence their compliance with data protection legislation. We are committed to supporting innovators to proactively embed privacy-enhancing mechanisms into their solutions through our array of innovation services.
35 Civil Aviation Authority (CAA) update on Remote ID (RID) system in the UK