The Office for Personal Data Protection


International


Find


Important links

 

Path: Home Page > Main menu > Positions > Position No. 1/2013 - Processing of personal data via recordings from cameras on unmanned aircraft

 

Position No. 1/2013 - Processing of personal data via recordings from cameras on unmanned aircraft

 
 
 
January 2013

Introduction

It is possible, via camera devices placed on unmanned aircraft, to systematically capture and further process shots of identified or identifiable natural persons, including the purely private environment in which these persons are present or abide (gardens, flats, etc.). It is thus possible to acquire personal data in a relatively easy manner from an environment that would otherwise be very difficult to access. As the use of the equipment in question in no way constitutes grounds to exempt it from application of Act No. 101/2000 Coll., on the Protection of Personal Data and on Amendment to Some Acts (hereinafter the "Personal Data Protection Act"), it shall be necessary to follow the obligations laid down by this act when collecting and processing personal data via unmanned aircraft equipped with camera devices.

   At the same time it will also be necessary to respect the framework of applicability of the Personal Data Protection Act. It is evident that this act will not be applicable if no targeted recording of identified or identifiable natural persons takes place, but the given case rather involves monitoring of the landscape, agricultural or industrial complexes or the movement of wild animals [Section 3 (4) of the Personal Data Protection Act]. This act is also not applied if the cameras merely transmit shots of identified or identifiable natural persons without making a recording thereof. Likewise it shall be necessary to respect the exemptions laid down in the provisions of Section 3 (3) of the act concerning the processing of personal data exclusively for the personal needs of a natural person. In the case that the Personal Data Protection Act is not applicable, another legal regulation that is not the subject of this position shall then primarily be applied. This refers above all to Section 81 et seq. of Act No. 89/2012 Coll., the Civil Code, which deals with the protection of one's personal identity.

Basic rules

The operator of an unmanned aircraft equipped with a recording camera system will be in the position of a "controller" [Section 4 (j) of the Personal Data Protection Act] or "processor" [Section 4 (k) of the Personal Data Protection Act] in the case that shots of identified or identifiable shots are made with the goal of using them to identify specific persons [2] , regardless of whether the unmanned aircraft is subject to the provisions of Act No. 49/1997 Coll., on Civil Aviation, or not.

   The operator of an unmanned aircraft in the position of a controller or processor must therefore respect the following basic rules.

   Above all, in accordance with Section 10 of the Personal Data Protection Act, such an entity may not make recordings of purely personal activities (in particular within a residence and adjacent areas) or recordings that would primarily serve to lower human dignity.

  Furthermore, recording must be based on at least one of the legal grounds under the Personal Data Act [see Section 5 (2)], above all:

-           consent of the data subject;

-           executing tasks required by law;

-           protection of the rights of the controller or other persons;

-           protection of the vitally important interests of the data subject.

   If the legal grounds for such processing of personal data is to be the consent of the data subject, this consent must be obtained in advance and fulfilment of the other conditions laid down by Section 4 (n), Section 5 (4) and potentially Section 9 (a) of the Personal Data Protection Act must necessarily be heeded. [3] Potential recordings or parts thereof containing personal data recorded beyond the framework of the consent (i.e. if the shots also capture persons who did not provide consent) must be destroyed without undue delay following recording.  Fulfilment of the obligation to inform the data subject in accordance with Section 11 of the act can in this case be combined with the acquisition of consent.

   An unmanned aircraft equipped with a recording camera device may also be used if it is in accordance with specific legislation. In this case it shall be necessary to strictly respect this specific legislation, for example Act No. 273/2008 Coll., on the Police of the Czech Republic, in particular Section 62 thereof, which allows the police to make audio, visual or other recordings of persons and things found in publicly accessible places and audio, visual and other recordings of the course of a legal act if it is necessary for the fulfilment of their tasks.

   For the case of personal data processing for the purposes of protecting the rights of the controller or other persons [Section 5 (2e) of the Personal Data Protection Act], the controller or processor must ensure that only the personal data essential for the protection of the specific rights is collected and that the privacy of the monitored persons is respected. In essence it is thus possible to allow for the monitoring of public spaces, which must be understood as areas serving for general use, i.e. physically accessible to anyone without restriction (also see Section 34 of Act No. 128/2000, on Municipalities). Access to an area must therefore in this regard be viewed two-dimensionally, in terms of horizontal access. Thus the surface of a public square accessible to anyone in the above manner shall be public space, but not a private garden that is visually accessible from the air. It is furthermore possible to make a recording on the grounds of Section 5 (2e) of the act for the purposes of protecting one's property (for example large fields or an open-pit mine, etc.). Immediately following the recording it will be necessary to determine whether all shots containing personal data serve the stipulated purpose corresponding to the specific need to protect the relevant rights or interests and ensure that excess recordings (or parts thereof) are destroyed. It will also be necessary to inform the data subjects of this processing in such a case [Section 11 (5) of the Personal Data Protection Act].

   An unmanned aircraft equipped with a recording camera device may also be used if it is essential for the protection of vitally important interests of the data subject [Section 5 (2c) and Section 9 (b) of the Personal Data Protection Act]. This however applies only to very exceptional situations; for instance, it would be legal to make recordings that include recordings of injured persons at a remote location in order to organise rescue measures.

   In all the above cases the controller or processor must also ensure in the standard manner that all the obligations laid down by the Personal Data Protection Act are fulfilled. This primarily concerns the obligations in securing personal data according to Section 13 of the act. Also worth emphasising is the obligation of a controller to register as per Section 16 et seq. of the act, unless one of the exemptions under Section 18 (1) applies.

   The data subject (monitored party) may, if they believe their rights have been breached, request an explanation from the controller or that the situation be remedied according to Section 21 of the Personal Data Protection Act, or they may appeal to the Personal Data Protection Office. In order to be able to identify an unmanned aircraft and its operator, the best recommendation is, if possible, to note the machine's registration number [Section 4 (6) of Act No. 49/1997 Coll.].

   It is also possible that audio recordings concerning identified or identifiable persons are made via a device on an unmanned aircraft along with a video recording. In such a case the same shall apply accordingly as with video recordings, though the making of an audio recording significantly increases the level of encroachment into the privacy of the monitored persons, which rules out the permissibility of such processing in the majority of cases.

Conclusion

If shots of identified or identifiable natural persons from cameras mounted on unmanned aircraft are purposely captured and further processed in order to identify these persons in connection with certain behaviour, such activities shall be subject to the application of the Personal Data Protection Act as laid out above. This applies regardless of whether the recordings of natural persons were made in private or public spaces.

   If the operator of an unmanned aircraft equipped with a camera device fails to fulfil the responsibilities laid down by the Personal Data Protection Act, they shall face the risk of recourse, in particular under Chapter VII of the Personal Data Protection Act (and potentially the risk of civil court actions for the protection of personal identity). Each operator of such an aircraft should therefore check immediately following the completion of a flight whether the recording did not violate the applicable obligations and destroy any illegally recorded shots. This naturally also applies if the original intention of the conducted monitoring was not to process personal data but was a case of, for instance, the aforementioned monitoring of wild animal movements, but the recordings captured identified or identifiable natural persons.



[1] Legal situation as of 1 January 2014.

[2] For more information see Position of the Office for Personal Data Protection No. 1/2006.

[3] For more information see Position of the Personal Data Protection Office No. 2/2008.

 

Context

Placing: Document folders > Site map > Main menu > Positions > Position No. 1/2013 - Processing of personal data via recordings from cameras on unmanned aircraft

Display up to date documents | document archive | documents including archive

 
 

Mode No graphics is currently switched on. Therefore you see the web page with no decorative graphics as well as any advanced formatting. If your browser supports CSS2, you can switch a graphic mode on.


Copyright © 2013 The Office for Personal Data Protection. All rights reserved.
web & design , editorial system