EN Official Journal of the European Union C 48/3

Executive summary of the Opinion of the European Data Protection Supervisor on the Communication from the Commission to the European Parliament and the Council on ‘A new era for aviation — Opening the aviation market to the civil use of remotely piloted aircraft systems in a safe and sustainable manner’

(The full text of this Opinion can be found in English, French and German on the EDPS website (www.edps.europa.eu))

(2015/C 48/04)

I. Introduction

I.1. Consultation of the EDPS

1. On 8 April 2014, the Commission adopted a Communication to the European Parliament and the Council on ‘A new era for aviation — Opening the aviation market to the civil use of remotely piloted aircraft systems in a safe and sustainable manner’ (hereinafter ‘the Communication’) (1).

2. RPAS are aircraft systems piloted from a distance or, in other words, aircrafts that can fly without requiring an onboard pilot. Most of the time, they are not used as a simple aircraft system, and include devices such as cameras, microphones, sensors, GPS, which may allow the processing of personal data.

3. As will be further developed in this Opinion, the rights to private and family life and to data protection, as guaranteed in Article 8 of the Council of Europe Convention on Human Rights and Articles 7 and 8 of the Charter of Fundamental Rights of the EU, apply to this emerging technology. Moreover, since remotely piloted aircraft systems have the same potential to seriously interfere with the rights to private and family life and to data protection as the online technologies considered by the Court of Justice of the European Union in the Digital Rights Ireland (2) and Google Spain v AEPD (3) rulings, they must be considered very carefully.

4. The EDPS therefore welcomes the fact that we have been consulted by the Commission on this Communication.

IV. Conclusions

65. The EDPS welcomes the fact that he has been consulted by the Commission on this Communication and highlights that civil uses of RPAS cover all areas not covered by military uses, thus not limited to commercial uses. He also welcomes that the Communication not only underlines the social and economic benefits of the civil use of RPAS but also identifies privacy, data protection and security as key elements with which to ensure compliance for their dissemination.

66. RPAS should be distinguished from aeroplanes and CCTV because their ‘mobility and discretion’ enable them to be used in many more circumstances. Besides, they can be combined with other technologies such as cameras devices, Wi-Fi sensors, microphones, biometric sensors, GPS systems, systems reading IP addresses, RFID tracking systems which all offer the possibility to process personal data and make same potentially powerful surveillance tools.

67. The EDPS would therefore underline that RPAS uses involving the processing of personal data constitute in most cases an interference with the right to the respect for private and family life guaranteed by Article 8 of the Council of Europe Convention on Human Rights (hereinafter ‘ECHR’) and Article 7 of the Charter of Fundamental Rights of the European Union (hereinafter ‘the Charter’) as they challenge the right to intimacy and privacy guaranteed to all individuals in the EU and can therefore be allowed only under specific conditions and safeguards. In any event, whenever personal data are processed by RPAS operated in the EU, which is common, the right to the protection of personal data enshrined in Article 8 of the Charter applies and the EU legal framework for data protection should be complied with.

68. In practice, therefore, RPAS uses by individuals, for private activities will normally be subject to Directive 95/46/EC requirements and will rarely benefit from the household exception. In any event, as a pre-condition for the data protection rules, the processing of personal data must be lawful in all respects. This means also complying with other relevant rules in areas such as civil or criminal law, intellectual property, aviation or environmental law.

69. The processing of personal data via an RPAS for commercial or professional purposes must comply with national legislation implementing Directive 95/46/EC.

70. Moreover, the EDPS would recall that the mere publication of data on the internet or in a newspaper, without any aim to disclose to the public information, opinions or ideas, is not sufficient for it to fall under the journalism exception of Article 9 of Directive 95/46/EC.

71. Law enforcement uses of RPAS also have to respect the fundamental right to privacy so that these activities should be based on a clear and accessible law, serve a legitimate goal and be necessary in a democratic society and proportionate to the purpose pursued. When they result in processing personal data, they are subject to the data protection safeguards laid down at EU and Council of Europe level.

72. The use of RPAS for intelligence purposes must respect the principles of necessity and proportionality.

73. In view of the imperative need to ensure respect for privacy, data protection and security requirements relating to this potentially highly intrusive new technology, the EDPS supports the Commission reconsidering its lack of competence for the regulation of RPAS under 150 kilos.

74. The EDPS also welcomes the initiatives and awareness raising projects that should accompany the introduction of RPAS on the EU civil market.

75. The EDPS recommends that the Commission encourages RPAS manufacturers to implement privacy by design and by default and data controllers to carry out data protection impact assessments where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, scope or purposes.

76. Further action is also needed to encourage measures that would facilitate identification of the controller of an RPAS.

Done at Brussels, 26 November 2014. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) COM(2014) 207 final, 8.4.2014.

(2) Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources, Minister for Justice, Equality and Law Reform, The Commissioner of the Garda Síochána, Ireland and the Attorney General, and Kärntner Landesregierung, Michael Seitlinger, Christof Tschohl and Others, judgment of the Court (Grand Chamber) of 8 April 2014 (requests for a preliminary ruling from the High Court of Ireland (Ireland) and the Verfassungsgerichtshof (Austria)).

(3) Case C-131/12, Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), judgment of the Court of 13 May 2014.