Hong Kong Privacy Commissioner for Personal Data Issues Guidance on the Use of Drones

Mark Parsons, Partner, and Peter Colegate, Associate, Hogan Lovells

On 29 March, the Hong Kong Privacy Commissioner for Personal Data (the "Commissioner") published a guidance note that for the first time addressed the increasing use of unmanned aircraft systems ("UAS", or, more popularly, "drones"). The Commissioner's guidance is the first significant regulatory engagement on the use of UAS by a Hong Kong regulator.

The guidance is timely. Hong Kong currently has an estimated 5,000 UAS and that number is predicted to increase as prices fall and people and businesses become more aware of the possibilities for their use. UAS technology is also improving. Manufacturers are experimenting with UAS that can collect thermal images, provide telecommunications services, take environmental measurements and even collect “big data” using a range of different sensors at the same time.

The possibilities for UAS raise significant regulatory concerns, but current regulations are very limited in their scope and do not yet address important issues of privacy. The Commissioner's guidance is a first step in Hong Kong towards a broader debate about UAS.

The Hong Kong Regulatory Regime for UAS

The Civil Aviation Department of Hong Kong ("CAD") is responsible for regulating non-recreational UAS weighing over seven kilograms. Flying a UAS weighing seven kilograms or less for purely recreational purposes is classified as model aircraft flying and no CAD oversight is required.

The expected increase in use of UAS calls the basic regulatory parameters into question. Hong Kong’s urban density and unique geographical features make safety a key concern. For commercial UAS flights in Hong Kong the CAD rules stipulate that no flights are permitted within five kilometres of an aerodrome, over 300 feet above ground and in visibility conditions of less than five kilometres. There is also a requirement that the pilot of the drone must have qualifications to show that he has the required training to fly the device. A flight plan must also be submitted to the CAD at least 28 days before take-off.

Privacy Concerns

The CAD's rules are clearly directed at pilot qualifications and safety concerns. It is not clear that the department is under any duty to consider privacy concerns when it issues its permits. In a blog entry he made last year concerning UAS, Hong Kong's Privacy Commissioner for Personal Data expressed his concern that the privacy rights of individuals in Hong Kong need to be better protected as the use of UAS increases. In the Commissioner's view, UAS present unique privacy challenges and their ability "to collect data with great resolution and granularity at distant vantage points, often for long periods, and on a continuous and covert basis, enables them to conduct effective aerial surveillance of persons of interest in a sustained and surreptitious manner."

The Commissioner's new guidance adds further force to these comments, and suggests some specific compliance measures that UAS operators should take, including carrying out privacy impact assessments as part of flight planning, minimising the amount and types of personal data collected by the drone to that which is essential and taking measures to ensure that data is secure should the drone be lost. The Commissioner also suggests means of alerting the public to the presence of UAS collecting personal data, such as incorporating flashing lights into the aircraft to signal that recording is taking place and pre-announcing through social media and other means that a UAS flight is taking place.

The Commissioner has separately appealed to technology providers to commit to building privacy and data protection into their products and services. As a keen advocate of the "privacy by design" concept, the Commissioner considers it vital to maintaining a privacy-assuring ecosystem.

Blue Sky Thinking About UAS Regulation

The Commissioner's guidance on the use of UAS in Hong Kong adds some helpful discussion to what will likely be an important but complex area of regulation in the coming years. The capacity for UAS to impact personal space in high density urbanised regions such as Hong Kong is clear. The means of ensuring that UAS flights in Hong Kong are compliant with the PDPO will be a matter requiring attention.