The GDPR applied to aerial filming
A drone that films does two things at once: an aerial operation, and a processing of personal data. The two regimes are independent, and being in order with one says nothing about the other.
Key points
- Article 4(1) of the GDPR defines personal data as any information relating to an identified or identifiable natural person, directly or indirectly. A face, a number plate, a silhouette in a known place is enough.
- It is not your intention to identify that triggers the GDPR, it is the objective possibility of identification. Reasoning by intention is the most frequent trap in this subject.
- The purely personal or household activity exemption (Art. 2(2)(c)) is real but narrow: recital 18 states that such activity has no connection to a professional or commercial activity. The criterion is the nature of the ACTIVITY, not the status of the person nor the mass of the aircraft.
- The Court of Justice closed that exemption for filming directed at public space: in the Ryneš case it held that surveillance extending, even partially, to a public space is directed outwards from the private setting of the person carrying it out.
- Consent is not the only legal basis: Article 6(1) offers six: consent, contract, legal obligation, vital interests, public interest task, legitimate interests. The last requires a balancing exercise, and the text expressly mentions the case where the data subject is a child.
- Data minimisation (Art. 5(1)(c)) plays out at COLLECTION, not in editing: filming continuously on the way out and back when a few shots of the roof would have done exceeds the stated purpose.
- Images revealing political opinions or religious beliefs fall under Article 9(1), which lays down a prohibition in principle that only the exceptions in paragraph 2 can lift. The public character of a gathering changes nothing.
- The controller is the one who determines the purposes and means (Art. 4(7)): that is you when you film with your own drone, on your own account. Article 5(2) adds the obligation to be able to DEMONSTRATE compliance.
The trap. The two texts do not overlap, but they cross: Article 15(1) of Regulation 2019/947 lets a State create a UAS geographical zone for privacy reasons, and Article 2(4), which defines those zones, adds the protection of personal data to them. An aeronautical map can therefore express a constraint that has nothing aeronautical about it.
Source
Regulation (EU) 2016/679 (CELEX 02016R0679, consolidated on 04/05/2016) (GDPR), art. 2, paragraph 2, point c) and recital 18, art. 4, points 1) and 7), art. 5, paragraph 1, point c) and paragraph 2, art. 6, paragraph 1, and art. 9, paragraph 1 and paragraph 2; CJEU, 11 December 2014, Ryneš, C-212/13, para. 33 (CELEX 62013CJ0212); Implementing Regulation (EU) 2019/947 (CELEX 02019R0947, consolidated on 01/05/2025), art. 15, paragraph 1