Skip to main content
SpringerLink
Log in
Book cover

The Future of Drone Use pp 325–351Cite as

Making Drones More Acceptable with Privacy Impact Assessments

  • Chapter
  • First Online:

Part of the book series: Information Technology and Law Series ((ITLS,volume 27))

Abstract

This chapter contends that a credible privacy impact assessment (PIA) can help drone manufacturers and operators to meet their legal and ethical obligations. The new European Data Protection Regulation will make PIAs mandatory (The European Commission has coined the term “data protection impact assessment” (DPIA) which is like a PIA, but only covers one type of privacy, i.e., data protection.); so, companies should already be gaining some experience in the conduct of a PIA and, especially, be clear about the benefits of doing so. This chapter outlines the process for conducting a PIA and the benefits to be gained. Before doing so, it refers to some of the useful applications of drones, but makes the point that drones also present dangers, inter alia, they present privacy risks. That is one reason why drone manufacturers and operators must, of course, comply with privacy and data protection legislation, and there are various technologies and practices that can help them do so, one of which is a PIA. This chapter then discusses who should conduct a PIA and when, and the features of a PIA process and report. This chapter asks whether drones should be subject to a special PIA like those developed for RFID and smart meter applications by industry and supported by the European Commission. This chapter draws to a conclusion by citing some of the benefits of conducting a PIA, but then raises the question whether a PIA is sufficient to assess drones. While this chapter makes the case for a PIA, it concludes by posing the question whether a wider ranging societal impact assessment, incorporating a PIA, might be better.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Hardcover Book
USD   119.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    Drones are also known as remotely piloted aircraft systems (RPAS) or unmanned aircraft systems (UAS). However, the term drones is in common parlance, e.g., used by the European Aviation Safety Agency (EASA), the Article 29 Working Party and the European Data Protection Supervisor (EDPS), in the documents cited later in this chapter, and is the term used in this chapter too.

  2. 2.

    Koebler 2014. See also Inagaki 2015; Handwerk and Stonev 2013; Express 2014.

  3. 3.

    Wong 2014; McFarland 2015.

  4. 4.

    Carlson 2014; BBC News 2015a, b, c; Mackin 2014.

  5. 5.

    Woody 2014; Raval 2015.

  6. 6.

    Floreano 2013.

  7. 7.

    Thompson 2014.

  8. 8.

    Wingfield 2015; Kerr 2014; Allen 2015; Agence France-Presse 2015.

  9. 9.

    Engler 2014; Gannon 2014.

  10. 10.

    Handwerk and Stonev, op. cit.; Gorman 2014; Gammon 2014.

  11. 11.

    Ernst 2014.

  12. 12.

    Allen 2014. The Argentine government has also used drones for locating drug smuggling routes, monitoring farm crops and looking for archaeological sites.

  13. 13.

    Goel and Hardy 2015.

  14. 14.

    Farmer 2015.

  15. 15.

    For example, drone racing. Sky News 2015.

  16. 16.

    European Parliament 2015, p. 7; Article 29 WP 2015, p. 7.

  17. 17.

    Schlag 2013.

  18. 18.

    European Parliament 2015, p. 21.

  19. 19.

    Ahmed 2015.

  20. 20.

    Teal Group 2014.

  21. 21.

    European Aviation Safety Agency (EASA) 2015, pp. 6, 9.

  22. 22.

    Scott 2015.

  23. 23.

    Press Association 2015.

  24. 24.

    A drone has already wounded at least one celebrity, Spanish pop singer Enrique Iglesias, during a concert he was giving in Tijuana, Mexico, 30 May 2015. El Mundo 2015. Others have suffered mishaps too. See, for example, Grubb 2014; Griffin 2014.

  25. 25.

    In July 2015, a drone was in a near miss with an aircraft near Heathrow. The drone came within six metres of the aircraft. Murad, op. cit. See also Odell 2015.

  26. 26.

    Sanderson 2015.

  27. 27.

    Clarke and Moses 2014.

  28. 28.

    Wolf 2012. The European Commission has also recognised the possibility. See European Commission 2014, p. 7.

  29. 29.

    Miller and Mayko 2014.

  30. 30.

    de la Baume 2014.

  31. 31.

    Gayle and Thornhill 2015.

  32. 32.

    Chazan 2015.

  33. 33.

    Schmidt and Shear 2015.

  34. 34.

    The Japan Times 2015.

  35. 35.

    Anderson 2014. See also Schmidt 2015; BBC News 2015a, b, c.

  36. 36.

    Article 29 WP 2015, p. 5.

  37. 37.

    European Parliament 2015, pp. 21–22.

  38. 38.

    The US Defense Advanced Research Projects Agency (DARPA) is conducting research on tiny drones capable of flying through windows and navigating autonomously around a labyrinth of rooms, stairways and corridors. See Algar 2014.

  39. 39.

    EDPS 2014, p. 5.

  40. 40.

    Stanley and Crump 2011, p. 1.

  41. 41.

    Thielman 2015.

  42. 42.

    Article 29 WP 2015, p. 8.

  43. 43.

    Clarke 2014.

  44. 44.

    Benson 2015.

  45. 45.

    Stanley and Crump 2011.

  46. 46.

    Nevins 2012. See also Calo 2010; European RPAS Steering Group 2013, p. 44.

  47. 47.

    Article 29 WP 2015, p. 11.

  48. 48.

    Article 29 WP 2015, p. 11.

  49. 49.

    Ibid.

  50. 50.

    Finn and Wright 2012; Stanley and Crump 2011, p. 12.

  51. 51.

    Ibid.

  52. 52.

    EASA 2015. In addition to EASA’s harmonisation work, the International Civil Aviation Organization (ICAO) is producing Standards and Recommended Practices (SARPs) for drones (by 2018), and JARUS, a co-operative of 40 civil aviation authorities, also aims to produce harmonised rules for drones.

  53. 53.

    See, for example: BBC News 2015a, b, c.

  54. 54.

    Sanderson 2015.

  55. 55.

    The CJEU ruled that “the operation of a camera system… installed by an individual on his family home for the purposes of protecting the property, health and life of the home owners, but which also monitors a public space, does not amount to the processing of data in the course of a purely personal or household activity, for the purposes of that provision” [Article 3(2) of Directive 95/46/EC]. Court of Justice of the European Union, Judgment of 11 December 2014, Case C‑212/13.

  56. 56.

    This para has been adapted from Voisin 2015.

  57. 57.

    The European Court of Justice has stated in a ruling related to CCTV that the “household exception” does not apply when the personal data is gathered in public spaces. See Court of Justice of the European Union, Lindqvist, Judgment of 6 November 2003, Case C-101/01.

  58. 58.

    Article 29 WP 2015, p. 7.

  59. 59.

    EASA, op. cit.

  60. 60.

    Baroness O’Cathain, chairperson of the House of Lords committee that produced a report on the use of drones in the EU, has commented that “public understanding of how to use drones safely may not keep pace with people’s appetite to fly them”. Quoted in Gibbs 2015. EASA, p. 15, also considers that “those who are engaged in drone operations have low awareness of the applicable rules”. But manufacturers and operators can take measures, such as the following, to better protect consumers' privacy.

  61. 61.

    Information Commissioner’s Office 2015.

  62. 62.

    Aitken 2015.

  63. 63.

    The website is NoFlyZoneUK.org. See Griffiths 2015.

  64. 64.

    Gibbs 2015.

  65. 65.

    Ibid.

  66. 66.

    Sanderson 2015.

  67. 67.

    See also Chap. 3 in this volume.

  68. 68.

    ICO, op. cit.

  69. 69.

    Article 29 WP 2015, p. 17.

  70. 70.

    The Article 29 Working Party recommended “adopting the measures of privacy by design and privacy by default and suggests the data protection impact assessment as a suitable tool to assess the impact of the application of drone technology on the right to privacy and data protection.” Article 29 WP 2015, p. 3.

  71. 71.

    Ibid., p. 4.

  72. 72.

    “Guidelines for certain civil uses of RPAS would be based on a ‘privacy and data protection impact assessment’ and involve interested stakeholders.” Commission Staff Working Document 2012, p. 23.

  73. 73.

    “RPAS manufacturers and controllers … should implement privacy by design and by default and carry out data protection impact assessments … where processing operations present specific risks to the rights and freedoms of data subjects.” EDPS 2014, p. 10.

  74. 74.

    In its June 2015 Opinion, “the Article 29 Working Party (WP29) recommends … data protection impact assessment as a suitable tool to assess the impact of the application of drone technology on the right to privacy and data protection.” Article 29 WP 2015, p. 3.

  75. 75.

    The House of Lords agreed “with the principle of encouraging RPAS pilots to carry out Privacy Impact Assessments”, although it added that “care must be taken not to overburden regulators and emerging RPAS businesses”. House of Lords European Union Committee 2015, p. 69.

  76. 76.

    “Performing a robust privacy impact assessment will help you decide if using UAS is the most appropriate method to address the need that you have identified.” Information Commissioner’s Office 2015.

  77. 77.

    EASA 2015, p. 1.

  78. 78.

    ISO 2015, pp. 6–7.

  79. 79.

    The Article 29 WP also says manufacturers should carry out a PIA: “A privacy and data protection impact assessment should be envisaged for manufacturers in cases of drones ‘designed and produced’ for surveillance purposes and for operators using drones carrying on-board any kind of ‘audio-visual’ equipment, taking into account—as said before—the payloads and the purposes of the collection and the further processing of personal data.” Article 29 WP 2015, p. 15.

  80. 80.

    Stakeholders could include civil aviation authorities, aviation industry, general public, manufacturers and operators of drones, Air Navigation Service Providers (ANSPs), airspace users, data protection authorities and any one or more of EASA, EUROCONTROL, EUROCAE, SESAR JU, JARUS, ECAC, EDA, ESA, ASD, UVSI, EREA and ECA. Stakeholders interested in or affected by a proposed drone operation should be consulted or, at least, be given the opportunity to express their views and to have those views considered seriously.

  81. 81.

    We use the word project to signify a policy, programme, service, product, technology, legislation or other initiative that has privacy impacts.

  82. 82.

    For more detail on how to assess privacy risks, see CNIL 2015, p. 21. See also International Organization for Standardization (ISO) 2011.

  83. 83.

    Article 29 WP 2011.

  84. 84.

    Smart Meters Task Force 2014.

  85. 85.

    A friend has pointed out that the RFID template was dedicated to a too broad field (and it was even just a framework, not a template), but this is not true of the DPIA for smart grids and smart meters—that DPIA is far more restricted in its focus (i.e., energy management).

  86. 86.

    Article 29 WP 2015, p. 19.

  87. 87.

    Article 29 WP 2015, p. 8.

  88. 88.

    Article 29 WP 2015, p. 10.

  89. 89.

    SIA may also stand for surveillance impact assessment. For a description of a societal impact assessment, see Wadhwa et al. 2015.

References

Download references

Author information

Authors and Affiliations

  1. Trilateral Research, London, UK

    David Wright & Rachel Finn

Authors
  1. David Wright
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Rachel Finn
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to David Wright .

Editor information

Editors and Affiliations

  1. Faculty of Law, eLaw, Leiden University, Leiden, The Netherlands

    Bart Custers

Rights and permissions

Reprints and permissions

Copyright information

© 2016 T.M.C. Asser press and the authors

About this chapter

Cite this chapter

Wright, D., Finn, R. (2016). Making Drones More Acceptable with Privacy Impact Assessments. In: Custers, B. (eds) The Future of Drone Use. Information Technology and Law Series, vol 27. T.M.C. Asser Press, The Hague. https://doi.org/10.1007/978-94-6265-132-6_17

Download citation

  • DOI: https://doi.org/10.1007/978-94-6265-132-6_17

  • Published:

  • Publisher Name: T.M.C. Asser Press, The Hague

  • Print ISBN: 978-94-6265-131-9

  • Online ISBN: 978-94-6265-132-6

  • eBook Packages: Law and CriminologyLaw and Criminology (R0)

Publish with us

Policies and ethics

Societies and partnerships

Search

Navigation