GVC Insurance & Data Protection — Questions and Answers
Question 1: Is third-party liability insurance mandatory for commercial drone operators in the UK?
- Yes — EU Regulation 785/2004 (retained in UK law) requires insurance for all UAS operations that could endanger third parties (Correct answer)
- No — insurance is recommended but not legally required for drones under 20 kg
- Yes — but only for drones over 25 kg MTOM
- No — public liability is only required for specific category operations
Correct answer: Yes — EU Regulation 785/2004 (retained in UK law) requires insurance for all UAS operations that could endanger third parties
EU Regulation 785/2004, retained in UK law post-Brexit, requires that all operators of aircraft (including drones) that can cause harm to third parties carry third-party liability insurance. The minimum required coverage level depends on the MTOM of the drone.
Question 2: What is the minimum third-party liability insurance coverage (in Special Drawing Rights, SDR) required for a drone with an MTOM between 500 g and 1 kg under EU Regulation 785/2004?
- 0.75 million SDR (Correct answer)
- 0.25 million SDR
- 1.5 million SDR
- No minimum is specified for this weight class
Correct answer: 0.75 million SDR
EU Regulation 785/2004 specifies minimum insurance coverage levels by aircraft MTOM. For drones between 500 g and 1 kg, the minimum is 0.75 million SDR. The SDR (Special Drawing Right) is an international monetary unit — operators must ensure their policy meets the SDR threshold applicable to their drone's weight class.
Question 3: A commercial drone operator collects aerial footage of a construction site containing workers' faces. What data protection obligation arises?
- The footage contains personal data — the operator must have a lawful basis, inform workers (transparency), and secure the footage appropriately under UK GDPR (Correct answer)
- Construction sites are exempt from GDPR because workers are employees of the site owner
- No obligation arises because workers are in a professional, not personal, setting
- The operator must obtain written consent from every worker before flying
Correct answer: The footage contains personal data — the operator must have a lawful basis, inform workers (transparency), and secure the footage appropriately under UK GDPR
Identifiable facial images of workers constitute personal data under UK GDPR, even in a commercial/professional context. The operator must have a lawful basis (often legitimate interests for site documentation), must be transparent about data collection (usually via site briefings or signage), and must store the footage securely.
Question 4: What should a commercial drone operator include in their privacy notice or information governance documentation?
- The types of data collected, purposes and lawful basis for processing, retention periods, data subject rights, and contact details for the data controller (Correct answer)
- Only the operator's name and CAA operator ID number
- A list of all flights conducted in the past 12 months
- The technical specifications of the drone camera sensor
Correct answer: The types of data collected, purposes and lawful basis for processing, retention periods, data subject rights, and contact details for the data controller
UK GDPR Article 13/14 requires data controllers to provide clear information to data subjects about how their personal data is processed. A privacy notice for aerial operations should address all required elements to demonstrate transparency and compliance — this is particularly important when footage is shared with commercial clients.
Question 5: A commercial client asks a drone operator to hand over all raw footage from a photographic survey, including footage of neighbouring properties. What data protection consideration applies?
- The operator should assess whether sharing footage of third-party properties is justified under UK GDPR and may need to redact or withhold footage of identifiable individuals not covered by the client's lawful basis (Correct answer)
- Raw footage belongs entirely to the client once the job is complete — no data protection consideration applies
- The client automatically becomes the data controller for all footage at the point of handover
- Footage of property is never personal data so no data protection consideration arises
Correct answer: The operator should assess whether sharing footage of third-party properties is justified under UK GDPR and may need to redact or withhold footage of identifiable individuals not covered by the client's lawful basis
When footage contains personal data (identifiable people or potentially even specific, identifiable vehicle registrations on private land), sharing it requires a lawful basis. The operator must consider whether the client's intended use is covered by their own lawful basis. A data processing agreement between operator and client is best practice.
Question 6: What is a Data Processing Agreement (DPA) and when should a commercial drone operator use one?
- A contract between the data controller and a data processor setting out how personal data will be handled; required when a drone operator processes data on behalf of a commercial client (Correct answer)
- A government form required for every commercial drone operation involving aerial photography
- An insurance document covering data breaches caused by drone operations
- A NOTAM variant used when drones collect surveillance data
Correct answer: A contract between the data controller and a data processor setting out how personal data will be handled; required when a drone operator processes data on behalf of a commercial client
Under UK GDPR Article 28, when a drone operator processes personal data on behalf of a client (acting as a data processor), a Data Processing Agreement must be in place. This document specifies the subject matter, duration, nature, purpose of processing, and the obligations of each party — protecting both the operator and the client.
GVC Insurance & Data Protection
Is third-party liability insurance mandatory for commercial drone operators in the UK?