9th January 2025
“Take-up of commercial opportunities afforded by drone innovation is increasing. Drone law and regulation is developing to keep pace. In this article, we highlight some of the key drone laws and legal issues (including GDPR/data protection) impacting drone operators in the UK today.”
Sustainability, technological advances and innovation in ‘last-mile’ strategies are fuelling a rise in drone usage – in particular, so far, in retail and medical-supply delivery. But, increasingly, drones offer other, wide-ranging, opportunities in today’s commercial world. For example:
The commercial and sustainability drivers for an increase in drone usage are clear, and the legal and regulatory environment is developing to keep pace.
Drone law is primarily governed by section 60 of the Civil Aviation Act 1982 and the Air Navigation Order 2016 SI 2016/765 (as amended) (the ANO), which regulate and place obligations on drone operators and pilots. Key provisions are:
Drone operations in the UK are generally categorised as ‘open’, ‘specific’ or ‘certified’, according to increasing levels of risk, size/weight and, correspondingly, regulation. Many UK commercial drone operations will fall within the ‘open’ or ‘specific’ categories. Most will require compliance with registration and identification rules, some will require pilot licensing, and the latter will also require risk assessment and operational approval from the CAA.
Detailed application of the ANO to drone operations is explained in guidance from the UK Civil Aviation Authority (CAA): Unmanned Aircraft System Operations in UK Airspace (CAP722). So far, CAP 722 focuses mainly on visual line of sight (or VLOS) drone operations and requires that the operator must always be able to see the drone during flight, sufficiently to be able to maintain control of it. (The maximum distance at which this can be safely achieved depends on various factors, and may change from flight to flight.)
The CAA is responding to market opportunities and challenges all the time, however, and has recently published a roadmap for a major increase in drone use. The plan involves drones flying regularly and routinely beyond visual line of sight (BVLOS). That can enable a faster, more efficient flight network, capable of reaching more remote and hard-to-access areas. The CAA is currently focused on establishing routine BVLOS operations by 2027.
Apart from CAA/aircraft drone rules, breach of which could result in criminal liability and/or civil liability and damages, commercial drone use can prompt other legal issues of which operators should be aware. For example:
Across various sectors, drone use for surveying purposes, in particular, is on the rise. But taking aerial images of sites risks the capture of personal data in the form of images and, sometimes, audio recordings. Regardless of whether that capture is inadvertent, there will likely be UK GDPR [3]/data protection implications. Because using drones can result in the collection, use, or sharing of personal data (including information about individuals who are not the intended focus of the recordings), data controllers must be able to ensure they can comply with UK GDPR.
There are several factors to consider in relation to GDPR compliance. A key issue is whether drone operators/data controllers can use technology to blur images of individuals or other identifying factors (such as car number plates, for example) at the point of capture. If so, that can achieve privacy by design. Others non-exhaustively include whether the drone use can be strongly justified; whether the operator/data controller can demonstrate that any recording and/or streaming can be switched off; that data is not retained or shared unnecessarily; and that data is disposed of safely. The Information Commissioner’s Office (ICO) has published guidance on UK GDPR compliance in the context of drone use and inadvertent data capture.
If the proposed use is for surveillance purposes where capture of personal data may not be inadvertent, the ICO’s wider surveillance guidance should help data controllers with compliance.
Undertaking a data protection impact assessment (for which the ICO has a helpful template), can help operators/data controllers to map out ways in which drone use can be designed and monitored to minimise or avoid personal data collection. That can then inform the updating of privacy policies, data retention protocols, staff training programmes and drone use contracts and practices.
And there are other legal and practical considerations for supply chain operators/logistics professionals:
Innovations and advances in drone services, capabilities and regulation have the potential to revolutionise operations across retail, healthcare, infrastructure and energy, manufacturing, supply chain and logistics. However, the legal issues surrounding drone operations can be complex and multifaceted. Walker Morris’ Regulatory, Commercial and Technology specialists can provide legal and practice support as you navigate this evolving landscape. We can help you:
We can also provide upfront, comprehensive commercial and risk management advice on policies, procedures and contractual arrangements to ensure your drone delivery projects fly! If or when any issues do arise, our dispute resolution specialists can offer straightforward, strategic solutions.
Proactively addressing legal challenges will enable responsible businesses to reap the benefits of this transformative innovation, while maintaining compliance with drone laws and GDPR, and safeguarding their reputations. Please contact Jeanette Burgess, James Crayton or Jack Heward for further information or advice.
[1] [2023] UKSC 4 – see our briefing.
[2] Section 76 of the Civil Aviation Act 1982 does, however, provide a statutory defence to trespass or nuisance if the drone flight is at a reasonable or ordinary height and is carried out in accordance with the ANO.
[3] Data Protection Act 2018 (also known as UK GDPR). For more information on the UK’s data protection regime, see Walker Morris’ briefings: Impact of Brexit on UK data protection; and Data reform on the horizon.