You are using a drone to map an area – this could be for an array of reasons such as:  missions related to construction planning, mining and geographical surveying to assist in mapping the path of a new road or the layout of a new housing estate. You are flying your drone 100m above houses and land, filming the buildings, the land and the immediate surrounding neighbourhoods. Citizens’ cars and items in their back garden are clearly visible, as are the persons walking to/from their houses, hanging out on the street or attending local services, places of worship and other facilities. After you are done filming, you download the recorded footage to your computer and share it with your company and third-party companies.

Below you will see some of the main privacy and data protection issues that could arise in this situation and tips/ safeguards for how to avoid them. Keep in mind the detailed information provided in the Handbook.

Privacy and Data Protection


    Transparency, visibility and accountability: Individuals on
    the ground may not know a drone is in operation. They should be aware who,
    when and how the drone is being used and for what purpose. This allows them to
    adjust their privacy expectations, be prepared and keep control over their
    privacy by acting accordingly.

    Chilling effect: Individuals who live in the immediate homes
    and streets may be unsure about whether the drone is filming, what it can see
    and the purpose for which it is being used. This could lead individuals to
    adjust their behaviour as though they are under surveillance, even when they
    are not being monitored.

    Privacy of location and space: Persons living in the
    neighbourhood have a right to move about freely in their own home (or garden,
    or car) without being identified, tracked or monitored. This right may be
    infringed as the individuals may feel they are being observed in their own
    homes or in their neighbourhoods.  

    Privacy of thoughts and feelings: Individuals have a right
    not to share their thoughts or feelings or to have them revealed. This
    includes their beliefs or religious views. This privacy may be infringed upon
    if the places of worship visible in your footage are being used, for example.


    Remember that there are special requirements that apply whenever people
    whose images you collected can be identified. Keep in mind that sometimes it
    may be possible to identify people also from the context – location, house
    numbers, car registration numbers, time of day, etc.

    Lawfulness, fairness, transparency:  Your collection
    and processing of personal data must be lawful, based on one of the options
    laid down by EU law. It must be fair, meaning that it must not cause any harm
    to the individuals. It must also be transparent – people have to know if their
    images have been captured, by whom and why. You must not do anything unlawful
    with the data.

    Purpose limitation: People have the right to know exactly
    for what purpose their data is collected and, once you inform them of the
    reason (mapping), you cannot use their data for a different incompatible
    purpose (e.g. profiling of the neighbourhood for marketing purposes) without
    informing them again and ensuring your actions are lawful (see above).

    Data minimisation:  You should collect as little
    personal data as possible to achieve your goals – the mapping of the area.
    Only collect what is necessary, directly related to your purpose and/or

    Storage limitation: You should not keep the footage of
    people in a manner that would allow their identification for longer than
    necessary for your planned purpose.

    Integrity and confidentiality: Where you have footage of
    identifiable people, you should make sure that that data is stored in a secure
    and protected manner. Unauthorized access must be prevented.

    Accountability: Remember that if you collect personal data
    and can choose what to do with it, you will be accountable if you don’t follow
    any of these principles.


    TIPS - If you think someone has a reasonable expectation
    of privacy, don’t violate that privacy by taking pictures, video, or
    otherwise gathering personal data, especially by targeting a specific

    TIPS - Engage in a public information campaign. Consider
    the use of advertisements, signs, leaflets and social media announcements
    that provide information about what the drone is doing, when it will be
    operating, what it may record, and what the footage will be used for. Don’t
    forget to include your contact information as well, so individuals could
    turn to you if they have any questions or requests. If someone does not wish
    to be filmed, you should comply with their wish.

    TIPSOnly collect and store data relevant for mapping.
    Collect the minimum amount of data necessary in relation to your legitimate
    course. Consider flying at a lower altitude above the space you wish to map
    to ensure less background data is collected. This also ensures that
    individuals are more aware of the drone and promotes transparency.

    TIPS - Individuals recorded should have a right to
    access the material where they can be identified and should be enabled to
    request the data controller to delete that material. You should inform them
    of that right.

    TIPS - Do not share data on identifiable persons with
    third parties without the agreement of the people in the images or without a
    legal obligation requiring you to do so.

    TIPSConsider taking anonymising steps whenever and as
    soon as possible, such as blurring, to minimise the amount of personal data
    collected. E.g., blur the images of people inadvertently caught on the
    footage, as well as all house numbers and car registration and plate

    TIPS - Store any personal data collected in a secure
    manner, and ensure that it is not stored longer than necessary for your
    planned purpose.

    TIPSBe aware who the data controller and the data
    processor is in this case, especially if you are carrying out this activity
    together with another company. Remember that data controllers and data
    processors are subject to various legal obligations in the EU.