A2 CofC Privacy Law & GDPR

Question 1

Under UK GDPR, drone footage containing identifiable individuals is classified as what type of data?

Accepted Answer

Personal data requiring a lawful basis for processing

Answer

Public domain data freely usable without restriction

Answer

Anonymised data exempt from GDPR

Answer

Sensitive biometric data always requiring explicit consent

Question 2

Which UK legislation, alongside UK GDPR, governs the use of personal data collected by drones?

Accepted Answer

The Data Protection Act 2018

Answer

The Human Rights Act 1998 only

Answer

The Surveillance Camera Code of Practice only

Answer

The Computer Misuse Act 1990

Question 3

What is the 'legitimate interests' lawful basis and how might it apply to commercial drone photography?

Accepted Answer

Processing is justified by the genuine business need of the operator, provided it does not override individuals' rights — e.g., property photography where people are incidentally captured

Answer

Any commercial activity automatically qualifies as a legitimate interest

Answer

It only applies to law enforcement bodies

Answer

Legitimate interests cannot be used for aerial photography under any circumstances

Question 4

A drone pilot captures footage of a private garden while filming an aerial property shoot. What privacy consideration applies?

Accepted Answer

The footage may intrude on reasonable expectation of privacy; the operator should minimise capture of private spaces and consider whether processing is justified

Answer

Private gardens are publicly visible from the air so no privacy law applies

Answer

Only footage taken below the garden fence height triggers privacy law

Answer

The garden owner must be identified and billed for the footage

Question 5

How long may a drone operator retain footage containing identifiable individuals under UK GDPR principles?

Accepted Answer

Only for as long as necessary for the specified purpose, then it must be securely deleted

Answer

Indefinitely, provided it is stored securely

Answer

For a maximum of 12 months regardless of purpose

Answer

For as long as the operator holds an ICO registration

Question 6

What should a commercial drone operator do if a member of the public requests access to footage in which they appear?

Accepted Answer

Respond to the Subject Access Request (SAR) within one calendar month, providing the footage or an explanation if an exemption applies

Answer

Refuse the request as aerial footage is not covered by UK GDPR

Answer

Delete the footage immediately to avoid compliance issues

Answer

Only comply if the individual can prove they are in the footage