While unmanned aerial vehicles or unmanned aerial systems, otherwise known as drones, have existed and been used, in various incarnations, for quite some time, we have recently seen a significant increase in the commercial and non-commercial use of drones. While use of drones for military and intelligence-gathering purposes is well established (and well publicised), drones use has taken off in the toy/hobby market and drones are increasingly seen as having commercial application. Estimates of drone use outside of military use vary, but estimates include a 60% plus increase in drone sales between 2014 and 2016 and approximately 400,000 drones purchased in the USA over Christmas 2015. The US Federal Aviation Authority has seen over 180,000 drone registrations since December 2015, when registration began.[1] There are currently between 4,000-5,000 drones registered in Ireland.[2]
The increased use of drones brings up a range of legal and commercial issues, including public safety. The UK Airprox Board recently published information on six near-miss incidents between drones and aircraft between February and March 2016.[3] In Ireland, there have been reports of six proximity incidents between drones and aircrafts in the past 12 months.[4]
Air safety regulators, including in the US, Ireland and a number of European countries, have recently turned their attention to the development of legislation around the use of ‘unmanned aerial vehicles‘. In the Irish context the recent introduction of new regulations tightens the use and operation of drones in Irish airspace and introduces a requirement to have certain drones registered. In addition, a Bill is in preparation to address the area in a thoroughgoing fashion and the data protection regulator has issued data protection related guidelines. Thus, we have a flurry of legislative and regulatory activity in the drone area.
This article discusses two recently implemented statutory instruments, the Regulation of Drones Bill and the guidelines issued by the Data Protection Commissioner regarding the use of drones in compliance with the General Data Protection Regulation.
Tighter Regulations
New regulatory requirements are set out in two new statutory instruments, both made under the Irish Aviation Authority Act 1993:
> Small Unmanned Aircraft and Rockets Order 2015 (SI 563 of 2015) (the Drones Order); and
> Irish Aviation Authority (Nationality and Registration of Aircraft) Order 2015 (SI 107 of 2015) (the Registration Order).
The Drones Order
The Drones Order came into effect on 21 December 2015 and was introduced in an attempt to address public safety concerns surrounding the use of drones. Under the Drones Order, drones are defined as unmanned aircraft having a mass of 150 kgs or less.
A new registration requirement was introduced by the Drones Order. Drones weighing between 1kg and 25kg are required to register in a manner established with the Irish Aviation Authority (the IAA). This involves completing an application form on the IAA’s website and paying the nominal registration fee of €5. Due to the introduction of the registration requirement, drone users who fly their drone in contravention of the Aviation Authority Act will be readily identifiable.
In order to decrease the number of accidents involving drones, the Drones Order imposes restrictions on use of drones without the permission of the IAA in certain circumstances, including where doing so would cause hazard to another aircraft, in a prohibited area and within 30 metres of a person, vessel, vehicle or structure not under the direct control of the operator. It is important to note that ‘aircraft’ is defined as ‘any machine that can derive support in the atmosphere from the reactions of the air other than the reactions of the air against the earth’s surface’ and thus includes drones.
In addition, the Drones Order introduces the requirement for those operating drones which have a mass of 4kgs or more to complete a safety training course that is approved by the IAA.
The Drones Order also increases the powers of the IAA by allowing it to launch investigations or inspections as it considers appropriate where an incident has caused or could have caused a hazardous effect on the operation of an aircraft.
If it appears that a drone user intends to fly a drone in contravention of the Act, the IAA or an authorised officer of the company may take such steps as are necessary to detain the drone and conduct investigations or inspections in respect of an incident or other occurrence that caused or could have caused danger to an aircraft.
The Registration Order
While the Drones Order imposes various requirements on drone users, the Registration Order focuses on the nationality mark of aircraft registered in Ireland. Aircraft has the same meaning under the Registration Order and the Drones Order. The Registration Order came into effect on 1 June 2015 and was introduced to comply with the Standards in Annex 7 of the Chicago Convention on International Civil Aviation. The current nationality mark of aircraft registered in Ireland is ‘EI’. The Registration Order introduces a provision to permit the use of the nationality mark ‘EJ’ for aircraft registered in Ireland. The Registration Order provides that the nationality mark ‘EJ’ shall be followed by a group of four capital letters (e.g. EJ-ABCD). The ‘EJ’ mark is an internationally recognised mark and drone users will have the option as to whether they want the ‘EJ’ mark or the ‘EI’ mark on their drone.
The Regulation of Drones Bill 2016
Although the Drones Order did address immediate concerns, there was a view that it did not go far enough to protect the rights of individuals. Due to these concerns, the Bill was introduced by Fergal Quinn to the Seanad (the upper house of Parliament) on 28th January 2016. The Bill sets out specific principles on the safe operation of drones and aims to further regulate the use of drones having regard to public safety and the rights of individuals.
Amongst other prohibitions, the Bill prohibits the use of a drone to photograph, video or conduct surveillance of another person’s home.
In addition, the Bill makes it an offence for drone users to use drones in certain areas, including within 200 meters of certain events such as sporting events, outdoor concerts or festivals, schools prisons or places of detention.
Furthermore, The Bill prohibits the flying of drones during hours of darkness – ie the period commencing one half-hour after sunset on any day and expiring one half-hour before sunrise on the next day.
It is important to note that the Bill has not yet progressed to the Oireachtas (the lower house of Parliament) and may be subject to amendments as it winds its way through the legislative process.
Drone Users and the GDPR
The General Data Protection Regulation will come into effect on the 25th May 2018 and will have an impact on the data captured by drones. The Data Protection Commissioner has issued non-binding guidance on the use of drones in order to comply with the GDPR.
The DPC noted that the processing of personal data kept by an individual concerned solely with the management of his/her personal, family or household affairs or kept by an individual for recreational purposes, is exempt from the provisions of data protection legislation.
The Guidance provides a number of helpful steps to ensure that drone users comply with the GDPR. While the Guidance is formally non-binding, like many DPC guidance documents its contents should be noted as reflecting DPC views on data protection.
The Guidance provides that drone users should:
(a) ensure they have the consent of the individuals whose personal data they will capture, by making timely use of notifications, signage, media, or publicity;
(b) ensure that drones are operated only with the sensor equipment necessary to achieve the purposes for which they are intended, and only record the personal data required to achieve the purposes intended and for which consent has been obtained;
(c) have robust security and access controls in place to ensure that only authorised persons have access to any images that are captured by the drone;
(d) consider mechanisms that automatically blur faces when they are inadvertently filmed during a data collection, or other means to ensure that unintended capture of personal data is avoided, or removed before further processing occurs; and
(e) use a software programme that automatically deletes the remaining personal data collected once the task is completed.
The DPC provides separate guidelines for drones that are being used for commercial purposes. The DPC recommends that the user:
(a) ensures that a Privacy Impact Assessment is completed prior to the use of a drone;
(b) if required, ensures appropriate contracts are in place with the person from whom the data is being obtained;
(c) puts a written Drone Usage Policy in place, which includes reference to the uses that may be made of the data processed, together with the retention and security of personal data being processed; and
(d) ensures that he or she complies with the proportionality and transparency rules under section 2(1)(c)(iii) of the Data Protection Acts, which stipulate that data shall be ‘adequate, relevant and not excessive for the purpose for which they are collected‘.
Conclusion
The number of drones in operation in Ireland will continue to increase given their modest entry cost, current popularity with the public and the range of uses to which they can be put, whether private or commercial, socially desirable or undesirable. It is now a requirement that drone users register their drones and comply in the use of drones with the requirements inserted into the Aviation Authority Act by the Drones Order and the Registration Order. In addition the DPC Guidelines must be complied with insofar as applicable to drone operation. Finally, the Bill will impact on drone use once implemented.
Overall, the area of drone use has moved from a standing start to a regulated area, both in terms of drone operation and with reference to personal data gleaned from drone operation. The Bill will further increase the requirements on drone operation.
Pearse Ryan is a Partner in the Technology & Innovation Group at Arthur Cox, Dublin.
Sorcha Ní Loinsigh is a Trainee in the Technology & Innovation Group
Tom Browne is an Associate in the Litigation & Dispute Resolution Group at Arthur Cox.
[1] http://blogs.wsj.com/digits/2016/01/06/u-s-drone-users-number-at-least-181000/
[2] IAA Report, Drone Registration to commence 21 December 2015, https://www.google.ie/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwif_qno5vzNAhWmC8AKHR9qCEAQFggbMAA&url=https%3A%2F%2Fwww.iaa.ie%2Fnews%2F2015%2F12%2F17%2Fdrone-registration-to-commence-on-21st-december-2015&usg=AFQjCNHISdiI3fepVcsPMn7cLacr45a10g&bvm=bv.127178174,d.ZGg
[3] https://www.airproxboard.org.uk/Reports-and-analysis/Monthly-summaries/2016/Monthly-meeting-April-2016/
[4] http://www.independent.ie/business/technology/news/aer-lingus-had-six-proximity-incidents-with-drones-in-past-12-months-34641930.html
