You are organising an outdoor concert and decide to use your drone to fly above the concert for promotion of future events. After you have acquired the proper authorisation to fly above crowds of people (this is typically required in most EU countries), you take footage of people in the crowd enjoying themselves. Some people are dancing, drinking alcohol; others are hanging out in crowds with friends, colleagues, and loved ones. After the event you want to upload images to your social media accounts.
Below you will see some of the main privacy and data protection issues that could arise in this situation and tips/ safeguards for how to avoid them. Keep in mind the detailed information provided in the Handbook.
Privacy and Data Protection
-
PRIVACY
Transparency, visibility and accountability: Individuals on
the ground may not know a drone is in operation. They should be aware who,
when and how is using the drone and for what purpose. This allows them to
adjust their privacy expectations, be prepared and keep control over their
privacy by acting accordingly.Privacy of association: The footage collected by the drone
may directly link individuals to their preferences, such as type of music they
listen to and the company they keep, their relationships and friendships. This
may infringe their right to freely associate with other persons of their
choice without detection.Privacy of behaviour and action: People have the right to
act freely, in public and in private spaces, without being subjected to
systematic recording, monitoring or controlling by others. There may be an
issue if they are specifically targeted and observed while they enjoy the
concert. -
DATA PROTECTION
Remember that there are special requirements that apply whenever people
whose images you collected can be identified. Keep in mind that sometimes it
may be possible to identify people also from the context.Lawfulness, fairness, transparency: Your collection and
processing of personal data must be lawful, based on one of the options laid
down by EU law. It must be fair, meaning that it must not cause any harm
to the individuals. It must also be transparent – people have to know if their
images have been captured and by whom.Purpose limitation: People have the right to know exactly
for what purpose their data is collected and, once you inform them of the
reason (promotion of the concert, the band, record sales), you cannot use
their data for a different incompatible purpose without informing them again
and ensuring your actions are lawful (see above).Data minimisation: You should strive to collect as little
footage of identifiable people as possible. Only collect data which is
necessary for your activity (purpose) and/or which is unavoidable.Accountability: Remember that, if you collect personal data
and can choose what to do with it, you will be accountable if you don’t follow
the relevant data protection rules. -
SAFEGUARDS
TIPS - Inform attendees of the event of the filming,
e.g., via a notification in the terms and conditions statement when they buy
their tickets, display signs at the entrance to the concert, or on the
posters and other promotional material of the event. Make sure to include
contact information so people can express any concerns and receive answers
to their questions.TIPS - Consider flying at a higher altitude to ensure
less focussed data is collected. This can make the identification of
individuals more difficult and can help minimise the impact of your
activities on their privacy. Remember to also observe the maximum allowed
flight altitudes.TIPS - Do not engage in discriminatory targeting – e.g.,
recording is focused on a particular group of people (e.g., women,
minorities).TIPS – Ask people for their permission before taking any
pictures or videos of them specifically. This could be included in the Terms
and Conditions of their ticket purchase for the concert, for example.
TIPS - Individuals recorded have a right to access the
material in which they can be identified and can request the data controller
to delete that material. You should inform them of that right.TIPS – Be aware who the data controller and the data
processor is in this case, especially if you are carrying out this activity
together with another company. Remember that data controllers and data
processors are subject to various legal obligations in the EU.