Drones and privacy

GDPR and Drone Flying

All drones with cameras can capture personal data in the form of images and video. Drone flying with a camera is therefore subject to the Personal Data Act and GDPR (the EU’s General Data Protection Regulation).

As a drone operator, you are the data controller for the information you collect. This means that you are responsible for complying with privacy rules.

When do you need consent?

Photography rules

Norwegian law distinguishes between taking pictures and publishing them.

• You can generally photograph from public airspace, but should avoid filming into private gardens and through windows.
• The Copyright Act requires consent for publishing images where individuals are the main subject.
• Photos of crowds where no one is highlighted can be published without consent.
• Photography near military facilities and other security objects may be prohibited regardless of privacy.

Measures to protect privacy

• Fly at a sufficient height so that individuals are not recognizable.
• Use blurring of faces and license plates before you publish.
• Inform people in the area that you are filming, for example with signs on the ground.
• Delete footage you do not need and store material securely.
• For commercial use, you must have a privacy policy and procedures for handling access requests.

The role of the Data Protection Authority

The Data Protection Authority is the supervisory authority for privacy in Norway. They can impose penalty fines for violations of the GDPR. The level of the fine depends on the severity and whether the violation was intentional.

Further reading

• Read about drone flight safety for a complete checklist.
• See drone categories for requirements in your category.
• Understand insurance requirements for commercial use.
• Practice with free theory test to test your knowledge.