Updates to the Personal Data Protection Commission's Advisory Guidelines on Photography, Video and Audio Recordings – Drones

11 January 2017

Dharma Sadasivan

On 20 December 2016, the Personal Data Protection Commission (“PDPC”) released updated advisory guidelines (the “Guidelines”) in relation to Photography, Video and Audio Recordings, including where such photographs and recordings are made with the use of drones.

The updates do not stray from the PDPC’s established positions relating to the interpretation of the Personal Data Protection Act 2012 (“PDPA”). Briefly, these positions are:

1. Photographs, videos and audio recordings that can identify an individual are personal data.
   
   
2. Employees taking photographs or making recordings in the course of their employment are not personally liable for complying with the PDPA. Rather it is the employer who is responsible for complying with the PDPA and obtaining the necessary consent.             
   
   
3. Third parties engaged by an organization to take photographs or make recordings do not need to obtain consent if they are taking the photographs or making the recordings on behalf of the organization and pursuant to a contract evidenced in writing. Rather it is the organization which is responsible for complying with the PDPA and obtaining the necessary consent.    
   
   
4. Photographs and recordings of individuals may be taken in public spaces without consent as there is an exception under the PDPA that permits the collection, use and disclosure of personal data that is publicly available. However it is possible for there to be private spaces within public spaces, and in such instances, the exception may not be applicable. Whether a space is public or private will depend on the facts.  
   
   
5. There is no prescribed way to obtain consent, but generally consent should be in writing or recorded in a way that can be accessed for future reference. Consent may also be deemed to have been given if the individual voluntarily provided the personal data for a purpose, and it would have been reasonable for the individual to have done so in the circumstances.
   
   
6. Consent is required from individuals in the background of a photo or recording if those individuals are identifiable. If they are not identifiable, the data is not personal data, and does not fall within the scope of the PDPA.  
   
   
7. There is no requirement under the PDPA for photographers or videographers to enter into contracts with organizations engaging them for services. However such contracts can help clarify whether the photographer or videographer is acting as a data intermediary, and thereby clarify the photographer or videographer’s scope of obligations under the PDPA.
   
   
8. An organization (which, under the PDPA, can also include individuals such as photographers) may collect personal data without the individual’s consent for “artistic or literary purposes” pursuant to an exception under the PDPA. However the PDPC recognizes that “artistic or literary purposes” is not defined under the PDPA, and that its ordinary meaning remains strongly subjective. The PDPC advises that, where feasible, consent should be obtained from the individual as a best practice, even if the organization thinks it may be able to rely on this exception.
   
   
9. An individual may at any time withdraw their consent to the collection, use or disclosure of their photographs and recordings. The organization must, accordingly, cease (and cause its data intermediaries and agents to cease) collecting, using and disclosing the photographs and recordings unless an exception applies. Where an organization has already collected the data, the withdrawal of consent applies only to its continued use or future disclosure of the personal data.
   
   
10. An individual does not have a right to request an organization to cease retaining personal data. Organizations are not required to comply with such requests from individuals. However organizations remain liable for complying with the Retention obligation under the PDPA, and the PDPC may direct an organization to, amongst other things, cease retaining personal data in the event of a breach of the PDPA.
    
    
11. The PDPA does not affect any right conferred or obligation imposed under other laws.

 
Updates relating to drones
The salient points of the updates relating to drones are as follows:

• use of drones for photography and video or audio recordings of personal data is subject to the PDPA and any other laws applicable to the operation of drones (e.g. Air Navigation Act). As such, consent must be obtained for the collection, use and disclosure of personal data obtained using drones, unless an exception applies; and

 

• Drone operators should also be cognizant that personal data may be unintentionally collected if a drone veers off course. Drone operators should therefore adhere to pre-determined flight paths and have policies in place for restricting or prohibiting the use of unintentionally collected personal data.

 
Commentary
Where a drone is flown in a public space such as an open field, compliance with the PDPA is a non-issue because any personal data captured would be publicly available information and therefore exempt from consent requirements.

Where a drone is flown in a private space, compliance with the PDPA is trickier.

If all persons in the private space are guests at the event and have given their consent to the event organizers for photographs and videos to be taken, photographers and videographers working for the event organizers may document the event without worry.

However if consent has not been obtained, or if there are persons in the private space who are not guests of the event and therefore have not had an opportunity to provide consent (e.g. a wedding reception in which a portion of a venue is reserved for guests and the remaining space is open to other patrons), it may be difficult for a drone operator to prevent the unintentional collection of personal data from such persons.

Drone operators will therefore need to employ other ways of managing this personal data, such as promptly deleting footage or photographs containing personal data of non-guests, or designating certain areas as spaces where photography/videography will be conducted.
 
 
Dharma Sadasivan
Associate Director, BR Law Corporation
[email protected]