“Don’t pry when you fly!” | New Guidelines for Drone Privacy and what they could mean for you.

“Don’t pry when you fly!”
New Guidelines for Drone Privacy and what they could mean for you.

25 July 2023

James Patto

_{Share this article}

Background

The use of drones are now becoming commonplace within our community, with individuals and companies using them for leisure and commercial purposes. However, as the use of drones grow, there is also growing concern of how these devices interact with our privacy. These concerns are being seen amongst the general public and drone users.

• General Public Concerns: there is a rising awareness and concern about how their privacy may be affected by the use of drones over public and private spaces. This is because the data that drones collect can include ‘personal information’, being information that can be used to identify individuals and including information collected from private activities (e.g. your conversations at home). This has led to a push to understand how privacy rights can be maintained. 
• Drone Users’ Concerns: there is a concern on how to ensure there is compliance. Users are currently expected to know and comply with wide ranging regulations, such as safety, trespassing, harassment or privacy requirements. This can make it difficult for users to know what exactly is expected of them and how to comply. 

In response to this, the Department of Infrastructure, Transport, Regional Development, Communications and the Arts has proposed ‘Drone Privacy Guidelines’ (“Guidelines”). These Guidelines are aimed at providing drone users a consolidated list of principles they should aim to follow to protect privacy. These principles aim to bring together the various regulations which relate to drone usage. 

The Proposed Drone Privacy Guidelines

Importantly, the proposed Guidelines do not introduce any new obligations and are not an APP Code. Instead, it is a list of six principles, called the ‘Drone Privacy Principles’, to guide drone users. For this same reason, the principles themselves are not enforceable, and in cases where the underlying legislation may not apply to the user, the principles may instead be best practice. 

These principles are mainly based on obligations in the Privacy Act 1988 (Cth) and applying these to the context of drones. The Guidelines also rely upon the meaning of ‘personal information’ as it is found in the Privacy Act. 

Notably, there is also a difference drawn between ‘commercial’ and ‘recreational’ drones users. Commercial users generally have more obligations placed on them, and are expected to take more steps to follow and implement the principles. 

1. Informing Others or Obtaining Consent

The user should seek to inform individuals that their information may be obtained and aim to gain their consent for this collection. 

Commercial User Considerations: Commercial operators should look to implement strategies so that individuals are aware of the collection and the purpose, and where they can go if they have questions or complaints. 

 2. Minimise Collection of PI

There should be a general attempt to minimise the collection of personal information where it is possible. Where personal information is collected inadvertently, the user should seek to de-identify or destroy this. Where the collection of personal information is required, then consent should be sought. 

3. Use Data only for the Primary Purpose

Where personal information has been collected for a specific purpose, it should not be used for another purpose.

Recreational users: should aim to gain consent before sharing personal information or deidentify it. 

Commercial User Considerations: where commercial users collect personal information for the provision of their services, they should aim to only share the personal information necessary for this purpose.

4. Data is Handled Securely

Where personal information is collected, reasonable efforts must be taken so that it is handled and stored securely. Furthermore, where this information is no longer required, it should be destroyed or de-identified.

Commercial User Considerations: Commercial users have a greater responsibility to have a data management system in place to achieve this. 

5. Know the Relevant Laws and Rules

Drone users should look to get advice on what the relevant laws and rules are. Users, for example, will need to comply with the Civil Aviation Safety Authority rules and consult the relevant government agency before their operation to receive this advice. 

6. Know the Australian Privacy Principles

The Australian Privacy Principles (APPs) are general standards and obligations surrounding privacy. They generally will not apply to individuals acting in a private capacity.

Commercial User Considerations: the APPs may apply to your business and users should determine whether their organisation is required to comply. 

Effects

The proposed Guidelines are still at consultation phase. This means that the Drone Privacy Principles and the approach taken by the Government can still be changed. 

However, there are three key takeaways that can be understood from the principles as they exist now. 

1. The Government is looking to make it easier to comply with existing regulations instead of introducing new obligations. 
2. Commercial uses of drones have a higher expectation placed on them to protect individual privacy. 
3. The creation of principles still require drone users to proactively understand the regulations which apply to them. 

The principles provide a starting point for individuals and organisations to ensure they are turning their minds to the key considerations. 

However, users are still actively encouraged to seek advice on what regulations are relevant to them and what obligations they have.