Providing Internet or other wireless services

Remember there are special requirements that apply if you collect
personal data. The personal data you are most likely to collect in this
scenario includes the personal communication of the people on the ground
that passes through the drone, as well as their IP addresses. IP addresses
may also allow the identification of individuals and, therefore, are
considered personal data in the EU.

Lawfulness, fairness, transparency:  Your collection
and processing of personal data must be lawful, based on one of the options
laid down by EU law.  It must be fair, meaning that it must not cause any
harm to the individuals. It must also be transparent – people have to know
which of their personal data has been collected, by whom and what it will be
used for.

Purpose limitation: People have the right to know exactly
for what purpose their data is collected and, once you inform them of the
reason (wireless communication), you cannot use their data for a different
incompatible purpose (e.g. advertising) without informing them again and
ensuring your actions are lawful (see above).

Data minimisation:  You should collect the minimum
amount of personal data possible for your legitimate purpose.

Accuracy: You should ensure that the personal data that
passes through your platform is accurate and up-to-date. If there are
inaccuracies, they should be deleted or fixed without delay. Storage
limitation: You should not keep any personal data in a manner that would allow
a person’s identification for longer than necessary. IP addresses can lead to
the identification of people too.

Integrity and confidentiality: You should make sure that any
data on the drone platform is secured and protected both from unauthorised
access and from possible file corruption. The data should be protected both by
third parties and your own employees. Accountability: Remember that if you
collect personal data and can choose what to do with it, you will be
accountable if you don’t follow any of these principles.

TIPS - Consider informing the people living in the area
of the various channels or functions of the drone, what it can and cannot
do, the information it collects and what it uses it for. Give your own
contact information to answer any questions the people may have.

TIPS - Ensure that people are informed of the way their
data will be processed when they use the wireless network from the drone,
e.g. by showing them a message when they connect to the wireless services.
Also, inform them of their rights, including their right to receive access
to all their data and to request that it be deleted.

TIPS - Implement strong encryption systems in your drone
to ensure the security of communication that passes through it and to
protect the files from being corrupted. Store any data in a secure manner
and ensure that it is not stored for excessive lengths of time. TIPS – Only
collect and store data that is relevant or necessary for the purposes for
which it is being collected, for the task you are carrying out, e.g.
communication facilitation. Collect the minimum amount of data
possible.

TIPS - Consider taking anonymising steps as soon as
possible, e.g. giving users pseudonyms, scrambling and encrypting data
end-to-end, etc. to minimise the amount of personal data collected. Note
that pseudonyms may also be considered personal data if they may be linked
to identifiable persons.

TIPS - Do not share data on identifiable persons with
third parties without the persons’ consent.

TIPS - Be aware who the data controller and processor is
in this case, especially if you are carrying out this activity together with
another company. Remember that data controllers and data processors are
subject to various legal obligations in the EU.