Few judicial decisions exist on the intersection of privacy rights and drone use. However, a French court recently banned law enforcement from using surveillance drones in Paris to assist with enforcement of COVID-19 confinement measures, representing one of the first rulings on the intersection of drone use and privacy law. What does this mean for Canada and other countries?
Summary of the decision
Two human rights groups brought an application alleging that surveillance drones used by French police during their response to COVID-19 were inappropriately collecting personal data, in violation of France’s privacy laws (being The European Convention for the Protection of Human Rights and Fundamental Freedoms and the Charter of Fundamental Rights of the European Union). Law enforcement used drones to monitor the public’s compliance with COVID-19 confinement measures (which at that time, prevented Parisians from leaving their homes) so that police could deploy intervention resources and disperse or prevent gatherings. The drones flew between 80m and 100m AGL, with cameras operating on wide angle without zoom and without recording video or images.
An appeal decision of a French State Council Judge recently determined that the use of drones for surveillance was against French law (even though a lower court found that the drone use was permissible).
Was the information collected “personal information”?
Even though the drones were not used to identify individuals or prosecute offences and no video or images containing any personal information were recorded or retained, the court decried the use of the drones and ordered French police to cease monitoring by drones until laws were enacted to specifically permit this conduct.
The court found that even though the police drones were not using the zoom feature on the cameras equipped on the drones to ascertain the identity of individuals in public spaces, the drones would be “likely to collect identifying [personal] data”. The drones would have no means to “avoid” collecting identifying data about those subject to their gaze. On that basis, the data collected by French police was “personal in nature” and constituted a “serious and illegal infringement of the right to privacy.”
A detailed summary of the appeal decision (which we have only been able to obtain in French but summarized in English, with our commentary) is set out at the end of this post.
What does this mean for drone use in Canada where privacy rights are involved?
Low level drone flights for any purpose raise privacy concerns for individuals.
In Canada, like France, individuals are generally protected from having their personal data (information about an “identifiable individual”) from being collected, used or disclosed without their consent.
Different privacy laws apply in Canada based on the nature of the organization handling the information. For example, different rules apply to government agencies (the federal Privacy Act) than to businesses (the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”)) which handle personal data.
While this decision is not binding on courts in other countries like Canada, it represents one of the first judicial pronouncements about privacy rights when drones are used at low levels and specifically focused on the location and movement of people. The decision demonstrates that it is possible for a court to find that the mere collection of personal data by drone (even where data is not retained or stored in any way) is sufficient to breach certain privacy laws.
Canadians do have some guidance on the intersection of privacy laws and drone use from both Transport Canada in its “Privacy guidelines for drone users” and from the Office of the Privacy Commissioner (the “OPC”). The OPC prepared a research paper on drones in March 2013 that concluded that Canada’s privacy laws will apply to drones deployed by the public and the private sector, and discussed privacy issues in that context (footnotes omitted):
Where UAVs are used for commercial aims, their use would be covered by the Personal Information Protection Electronic Documents Act (PIPEDA), and subject to the same requirements as with any other data collection practice. It is a common misconception that a company does not require permission to take an individual’s photograph in a public place. The privacy protections in PIPEDA are there to ensure that people know when their image is being captured for commercial reasons – whether by photograph or video – and what it will be used for. PIPEDA requires consent as a general rule, subject to only limited and specific exceptions. Collection and use of personal information can only be for purposes that a reasonable person would consider appropriate in the circumstances and there should be a consideration for employing a less privacy-invasive means of obtaining the information.
The OPC was also of the view that its guidance in respect of video surveillance in public places would also be applicable to drone use.
Until a Canadian court decides on the impact of drone use on privacy rights, it remains unknown whether a Canadian court would conclude that using drones to monitor the movement of people during a public health crisis is legitimate and lawful, or that this use is a breach of the various fundamental freedoms and rights to privacy that Canadians enjoy.
For more information about drones and how privacy laws apply to their use, please contact Kathryn McCulloch, Alexandre Toupin or any other member of Dentons’ Aviation team.
For more information about Denton’s data expertise and how we can help your business manage privacy and information during the COVID-19 pandemic, please see our Transformative Technologies and Data Strategy page and our unique Dentons Data suite of data solutions for every business.
————–
Association La Quadrature Du Net et Ligue Des Droits de L’Homme v. République Francaise
(No. 440442, 440445), May 18, 2020*
* decision unofficially translated by Dentons Canada LLP
CASE HISTORY – overturned decision of the Paris Administrative Court
The association “La Quadrature du Net” (“LQN”) and the Human Rights League (“HRL”) brought an application before the Paris Administrative Court (the “Court”) to suspend the use of imaging drones by police which assisted in the enforcement of COVID-19 containment measures and to require the immediate cessation of the capture, recording, transmission and destruction of images by drones. On May 5, 2020, the Court rejected the application on the basis that there was no serious and illegal infringement of fundamental freedoms. LQN and HRL appealed that decision to a judge of the State Council for litigious matters (the “State Council”).
FACTS
The emergence of a new coronavirus (COVID-19) in France led the Minister of Solidarity and Health to implement measures on the basis of the provisions of the Public Health Code. The Prime Minister prohibited the movement of any person out of his or her home, subject to limited enumerated exceptions.
Since March 18, 2020, a drone of a fleet of 15 DJI Mavic drones (each equipped with optical zoom and a speaker) monitored compliance with containment measures enacted by the government on March 17, 2020. Only one drone was used at a time and did not film continuously (for only about two to three hours on average per day, while teams on site and at police headquarters supported the flights). The flights were carried out at a height of 80 to 100 meters, so as to give a general physiognomy of the monitored area, which was filmed using a wide angle without activating the zoom of the camera. The drones were not equipped with a memory card so that there was no recording or image retention. The police department continued to use these monitoring and control measures in the framework of the de-confinement plan implemented as of May 11, 2020.
The use of these drones was only intended to give to law enforcement tasked with enforcing containment measures a general profile of the population in Paris by helping to detect, in designated areas, public gatherings contrary to the restrictive measures in force during the period of de-confinement. The purpose behind the use of the drones was not to prosecute offences or to identify their perpetrator, but to inform the police department in assessing the deployment of an intervention unit to disperse public gatherings or evacuating premises closed to the public.
LEGAL CONTEXT
The right to privacy, which includes the protection of personal data, as well as the right to travel are fundamental freedoms in France.
In the current period of health emergency, it belongs to the different competent authorities to take, in order to safeguard the health of the population, measures likely to prevent or limit the effects of the epidemic. These measures, which may limit the exercise of fundamental rights and freedoms must, to that extent, be necessary, adapted, and proportionate to the objective of safeguarding public health.
If the State Council finds a serious and illegal infringement on fundamental freedoms by public actors, it must prescribe such necessary measures which are likely to eliminate the effects of the infringement. Those measures must, in principle, be provisional; however, if provisional corrective measures cannot safeguard the “effective exercise” of fundamental freedoms, the corrective measures may be permanent.
REASONING
The State Council considered the nature and purpose of the drone use and the applied France’s privacy laws to the scenario to conclude that it was a serious and illegitimate infringement on the privacy rights of French citizens. The reasoning of the State Council was as follows:
- The use of the drones, carried out in accordance with the doctrine of use set out in the note of May 14, 2020 (the “Note”) is not capable, by itself, of constituting a serious and illegal infringement of fundamental freedoms.
- In light of the purpose of the drones, it falls within the scope of the directive of April 27, 2016 (the “Directive”) on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data.
- Subsection 3(1) of the Directive defines “Personal Data” as any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- It was argued that (i) the use of the drones does not, in practice, lead to the identification of the persons filmed; and (ii) in the absence of any preservation of images, there can be no identification. However, the State Council found that the drones, which are nevertheless equipped with an optical zoom, are likely to collect identifying data and do not include any technical device capable of avoiding, in all cases, that the information collected may assist for the benefit of a use other than that currently practiced, to render persons to which they relate identifiable. Under these conditions, the data likely to be collected by the contested drones must be regarded as having a “personal nature”.
- Subsection 3(2) of the Directive defines “processing” as any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- It followed from these provisions that the contested drones, which collect data, through the capture of images by drone constituted “processing” within the meaning of the Directive because, in some cases, the drones transfer data to the police department for real-time viewing which helps with administrative policing missions.
- This processing, which is implemented on behalf of the State, therefore falls under the provisions of the Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (the “Data Protection Law”) that are applicable to “processing” falling within the scope of the Directive, including section 31 which imposes an authorization by order of the competent minister or ministers or by decree, as the case may be, taken after reasoned opinion and published by the Commission Nationale Informatique & Libertés (“CNIL”).
- Taking into account the risks related to the misuse of personal data, this “processing”, without the prior enactment of a regulatory text to authorize the creation and development of conditions of use, and implementation of relevant safeguards, constitutes a serious and illegal infringement of the right to privacy.
- It follows from the foregoing that the State should be ordered to cease to carry out the monitoring measures by drone until the technical impairment at the preceding point (see “f.” above) has been remedied by the intervention of a statutory instrument, taken after the opinion of the CNIL, authorizing, in compliance with the provisions of the Data Protection Law, the use of the drones. The State Council noted that this could be done by equipping the drones with technical devices which make it impossible, whatever the uses, to identify people.
CONCLUSION
The State Council overturned the Court’s May 5, 2020 decision and ordered French law enforcement to cease, without delay, further surveillance measures by drone to ensure compliance with the rules of health security applicable to the de-confinement period.
Find the full decision in French here.
