A2 CofC Privacy Law & GDPR

Question 1

Under UK GDPR, drone footage containing identifiable individuals is classified as what type of data?

Accepted Answer

Personal data requiring a lawful basis for processing

Answer

Images and footage of identifiable people constitute personal data under UK GDPR. The drone operator (as data controller) must have a lawful basis for capturing, storing, and using this data. For commercial operations, this typically means a legitimate interest assessment or obtaining explicit consent.

Question 2

Which UK legislation, alongside UK GDPR, governs the use of personal data collected by drones?

Accepted Answer

The Data Protection Act 2018

Answer

The Data Protection Act 2018 supplements UK GDPR in domestic law. Together they form the primary data protection framework in post-Brexit UK. Drone operators conducting aerial photography of people must comply with both pieces of legislation.

Question 3

What is the 'legitimate interests' lawful basis and how might it apply to commercial drone photography?

Accepted Answer

Processing is justified by the genuine business need of the operator, provided it does not override individuals' rights — e.g., property photography where people are incidentally captured

Answer

Legitimate interests can justify processing personal data where the operator has a genuine, proportionate business purpose and a Legitimate Interests Assessment (LIA) shows that the individuals' rights are not overridden. Aerial property photography where passers-by are incidentally captured may qualify, but the operator must document their assessment.

Question 4

A drone pilot captures footage of a private garden while filming an aerial property shoot. What privacy consideration applies?

Accepted Answer

The footage may intrude on reasonable expectation of privacy; the operator should minimise capture of private spaces and consider whether processing is justified

Answer

People have a reasonable expectation of privacy in their gardens even though they are visible from above. Drone operators should plan flights to minimise capture of private spaces, consider the necessity and proportionality of the footage, and be prepared to justify their processing under UK GDPR if challenged.

Question 5

How long may a drone operator retain footage containing identifiable individuals under UK GDPR principles?

Accepted Answer

Only for as long as necessary for the specified purpose, then it must be securely deleted

Answer

The UK GDPR storage limitation principle requires that personal data is kept only for as long as necessary for the purpose for which it was collected. Once the purpose is fulfilled, footage containing personal data must be securely deleted or anonymised.

A2 CofC Drone Practice Test

A2 CofC Drone Practice Test

A2 CofC Privacy Law & GDPR