This document summarizes a report on privacy and data protection issues related to the use of remotely piloted aircraft systems (RPAS). The report found that most RPAS operators may be collecting personal data without realizing it or knowing how to comply with privacy laws. It provides recommendations for practical guidance on privacy and data protection to help both professional and recreational RPAS users operate responsibly. This includes templates, guidelines, and educational materials on reducing privacy risks in different operational contexts.

1. RPAS RELATED PRIVACY
AND DATA PROTECTION:
PRACTICAL ADVICE FOR
RPAS USERS
Rachel Finn, Trilateral Research Ltd.

2. TRILATERAL COMPANY PROFILE
2
Privacy and data
protection
Security
and
surveillance
Data Science
Crisis and
disaster
management
Research
Technology assessment
Policy and regulatory advice
Impact assessment
Training
Trilateral Services

3. • Recently led a project for DG
ENTR on the privacy, data
protection and ethical issues
associated with civil RPAS
• Legislation analysis in 7 MS
allowing civil RPAS operations
+ the US and Switzerland
• Surveys with 149 stakeholders:
94 industry, 11 CAAs, 27 DPA
and 17 CSO reps
• Workshops with 85
stakeholders
• 385 page report
MOTIVATION FOR DRONERULES.EU

4. • Professional users WANT to be responsible, but they
do not know enough about privacy, data protection and
ethics
• Private, recreational users are the least regulated
category of user
• Commercial users are judged to be “medium risk”
• Not nearly enough practical information for those using
RPAS in civil contexts
KEY FINDINGS

5. • Most RPAS operators may be collecting personal data
• In a survey of 91 RPAS designers, manufacturers and
operators:
DETAILED FINDINGS
stated that their
systems either
captured members of
the public, or that they
did not know whether
they captured members
of the public
indicated that
the data
captured by
the RPAS
was recorded
indicated that
the data
recorded by the
RPAS was
stored

6. • The most common application in Europe
• Focused on infrastructure, not people
• Footage of people limited to the “tops of their heads”
DRONES FOR INFRASTRUCTURE INSPECTION
6
• The “tops of their heads”
≠ anonymisation
• Employers, colleagues,
etc. might recognise
individuals on film

7. • Drones have diverse:
– Capabilities
– Payloads
– Operational contexts
RISKS TO PRIVACY & DATA PROTECTION
ARE CONTEXTUAL
7
Using the same drone in with the same payload in a
different context can raise new and different
privacy and data protection impacts.

8. • Most are small organisations or sole proprietorships
• Most report only “basic” knowledge of European and
national privacy and data protection law
• They will need to assess almost every operation to
ensure that they adequately consider privacy and data
protection impacts
RPAS OPERATORS NEED SUPPORT
8

9. Data protection, privacy and ethical issues content
including:
– Legal information for professional users
– Case studies in professional RPAS use
– Privacy impact assessment template
– Good practice guidelines
– FAQs document
FOR PROFESSIONAL/COMMERCIAL USERS
9

10. Data protection, privacy and ethical issues content
including:
– Basics of RPAS privacy handbook
– Case studies in private RPAS use
– RPAS code of conduct on easy to carry card
– Slideshow and quiz on the “do’s and don’ts” of RPAS
use
FOR RECREATIONAL / PRIVATE USERS
10
FOR PRIVATE/RECREATIONAL USERS

11. • Reduce the presence of people in footage1
• Only record when necessary2
• Anonymise images3
• Ensure transparency and consent4
• Ensure purpose limitation5
• Ensure the security of data collected6
• Avoid storing unnecessary information7
• Decide who is the data controller prior to the mission8
PRACTICAL ADVICE (IN THE MEAN TIME)
11

12. RACHEL FINN
RACHEL.FINN@TRILATERALRESEARCH.COM
WWW.TRILATERALRESEARCH.COM