A2 CofC Privacy and Data Protection

Question 1

Under the UK GDPR, what is considered personal data in the context of drone operations?

Accepted Answer

Any information that can identify a living individual, including images, video, vehicle registration plates, and location data

Answer

Under UK GDPR, personal data is any information relating to an identified or identifiable living individual. In drone operations, this includes photographs, video footage showing recognisable individuals, vehicle registration plates, and location data that could identify someone.

Question 2

Who is the data controller when a commercial drone operator collects personal data during a survey flight commissioned by a client?

Accepted Answer

Both the client and the drone operator may be joint controllers or have a controller-processor relationship depending on the arrangement

Answer

The data controller is determined by who decides the purposes and means of processing personal data. In a commissioned drone survey, the client typically determines why the data is collected, while the operator may have discretion over how. This may create joint controllership or a controller-processor relationship, which should be documented.

Question 3

What is the lawful basis most commonly relied upon by drone operators for incidental capture of personal data during legitimate operations?

Accepted Answer

Legitimate interests, balanced against the rights and freedoms of data subjects

Answer

For incidental capture of personal data during legitimate drone operations (such as property surveys or infrastructure inspections), legitimate interests is the most practical lawful basis. The operator must conduct a Legitimate Interests Assessment (LIA) to balance their interests against the privacy rights of individuals.

Question 4

What rights do members of the public have if they are captured in drone footage under UK GDPR?

Accepted Answer

They have the right to access, erasure, and objection to processing of their personal data

Answer

Under UK GDPR, individuals have several rights including the right to be informed about data collection, right of access to their data, right to erasure ('right to be forgotten'), right to object to processing, and right to lodge a complaint with the ICO. These apply to identifiable individuals captured in drone footage.

Question 5

Under what circumstances is a Data Protection Impact Assessment (DPIA) required for drone operations?

Accepted Answer

When the processing is likely to result in a high risk to individuals' rights and freedoms, such as systematic surveillance of public areas

Answer

A DPIA is required under UK GDPR when processing is likely to result in a high risk to individuals' rights and freedoms. For drone operations, this includes systematic monitoring of public areas, large-scale processing of personal data, or operations involving vulnerable individuals.

A2 CofC Drone Practice Test

A2 CofC Drone Practice Test

A2 CofC Privacy and Data Protection