Informing, keeping, erasing
Once the images are on the memory card, the obligations do not stop: you have to know whom to inform, how long to keep them, and what to do when the card disappears. This is the half of the subject that revision neglects.
Key points
- The GDPR contains no provision on image rights: that notion belongs to the national law of each Member State. It is revised in the national module, not here.
- Where the data are not collected from the data subject (the very case of aerial filming) it is Article 14 that governs the information duty, and not Article 13.
- Article 14(5)(b) sets that information duty aside where providing the information proves impossible or would involve a disproportionate effort. It is an exception to be justified case by case; it is not presumed.
- Retention is governed by Article 5(1)(e): data are kept in a form which permits identification for no longer than is necessary for the purposes pursued. The GDPR sets NO number of days.
- Two symmetrical errors here: inventing a legal deadline that does not exist, or thinking that offline storage takes the data out of the regulation.
- Data subjects retain rights enforceable against the controller, including access to their data (Art. 15) and their erasure (Art. 17). Images must therefore be findable, and deletable.
- The theft or loss of a memory card is a personal data breach just as much as a hack is: Article 33(1) requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours. The recipient authority is the data protection one, never the aviation one.
- An impact assessment is required where the risk is high, and Article 35(3)(c) expressly cites systematic monitoring of a publicly accessible area on a large scale. The trigger is the nature and the scale of the processing, not the presence of a camera.
The trap. Blurring in editing comes after collection, and it is collection that the GDPR regulates. It repairs the exposure of the images, not the possible unlawfulness of recording them: especially against the prohibition in principle of Article 9.
Source
Regulation (EU) 2016/679 (CELEX 02016R0679, consolidated on 04/05/2016) (GDPR), art. 5, paragraph 1, point e), art. 14, paragraph 1 and paragraph 5, point b), art. 15, art. 17, art. 33, paragraph 1, and art. 35, paragraph 1 and paragraph 3, point c)