A2 CofC Privacy Law & GDPR 5 — Questions and Answers
Question 1: Which statement best describes how identifiable people appear in drone footage under UK GDPR?
- Only names count as personal data
- Images of identifiable people are personal data (Correct answer)
- Footage is exempt if taken in a public place
- Only footage with audio is personal data
Correct answer: Images of identifiable people are personal data
Any information relating to an identified or identifiable living person, including their image, is personal data.
Question 2: Under section 76 of the Civil Aviation Act 1982, what generally protects aircraft overflight from claims of trespass?
- Flying at a height that is reasonable in all the circumstances and in compliance with regulations (Correct answer)
- Flying only at night
- Holding a GVC
- Flying under 50 m
Correct answer: Flying at a height that is reasonable in all the circumstances and in compliance with regulations
Section 76 bars trespass and nuisance actions for flight at a reasonable height that complies with the rules, but not take-off or landing on private land.
Question 3: Your client wants to rely on consent to film participants at an event. What must valid UK GDPR consent be?
- Implied by attending
- Given verbally to the pilot only
- Bundled into general ticket terms
- Freely given, specific, informed and unambiguous, with a clear affirmative action (Correct answer)
Correct answer: Freely given, specific, informed and unambiguous, with a clear affirmative action
UK GDPR requires consent to be freely given, specific, informed, unambiguous and given by a clear affirmative act.
Question 4: What is the best way to meet transparency obligations when filming identifiable people at a commercial event?
- Fly quietly so no one notices
- Tell people only if they ask
- Provide privacy information, for example signage and a privacy notice explaining who is filming and why (Correct answer)
- Publish nothing until a complaint is made
Correct answer: Provide privacy information, for example signage and a privacy notice explaining who is filming and why
The transparency principle requires individuals to be told who is processing their data, why, and how to exercise their rights.
Question 5: Which principle is breached if footage collected for a roof inspection is later sold to a marketing company without a compatible basis?
- Purpose limitation (Correct answer)
- Accuracy
- Storage limitation
- Accountability only
Correct answer: Purpose limitation
Purpose limitation requires data collected for specified purposes not to be processed later in an incompatible way.
Question 6: Under UK GDPR, which document helps a controller show compliance with the accountability principle?
- A CAA Operational Authorisation
- A drone insurance certificate
- A flight log only
- Records of processing activities and data protection policies (Correct answer)
Correct answer: Records of processing activities and data protection policies
Accountability means a controller must be able to demonstrate compliance, for example through records of processing, policies and DPIAs.
Question 7: A data breach involving drone footage is likely to pose a high risk to the people filmed. Beyond the ICO, who must normally be told without undue delay?
- The CAA
- The affected individuals (Correct answer)
- The drone manufacturer
- The local council
Correct answer: The affected individuals
Article 34 requires controllers to inform affected data subjects without undue delay when a breach is likely to pose a high risk to their rights and freedoms.
