Privacy and GDPR in drone detection

Drone detection feels technical, but there is a privacy question inside it that you would rather answer in advance than during an audit. What exactly are you picking up, and when is it personal data?

What is in the signal

A Remote ID message contains the drone’s serial number, its position and altitude, the pilot’s position, a timestamp and, in Europe, the operator registration number. See what Remote ID is for the full contents.

• The aircraft serial number is not personal data in itself, but becomes so once it is traceable to a person.
• The operator registration number often is: it sits in a register that can be linked to a natural person.
• The pilot position is location data about an identifiable person as soon as you combine the two.

In short: you are processing personal data, even though it feels like radio traffic. That is not a problem, it only means you have to set it up properly.

On what basis do you process it?

In practice this is usually legitimate interest: the safety of visitors or of an installation. You have to be able to name that interest and weigh it against the pilot’s privacy. At an event with tens of thousands of visitors and a permit condition prohibiting drones, that balance is straightforward. At a site with no identifiable risk it is harder.

The four things you write down

1. The purpose. Why are you detecting, and what measure follows an observation.
2. The retention period. How long do observations stay, and why that period.
3. Who has access. Your control room, your security team and temporarily the police is a different matter from everyone in the organisation.
4. The data processing agreement, where a supplier processes the data for you.

Retention in practice

For an event, a period running until after the debrief with the municipality is usually defensible. For a permanent installation it is different: there, building a pattern is the whole point, and you must be able to explain why you keep a year rather than a month. In the platform you set the period yourself.

Where the data sits

On the hosted option, platform and storage run inside the European Union. If you want nothing at all to leave your network, the same software runs offline on your own server. There is then no outbound connection and we have no access to your observations. The deployment models describe exactly what that means.

What we do not do

• We do not link registration numbers to names. That register is not public and querying it is for the competent authorities.
• We do not build profiles of pilots and share nothing between customers.
• There is no camera in the DRID. No imagery is recorded, of anyone.

More on how we handle data is in the privacy statement. If your data protection officer has specific questions, do ask.