Drones have become essential tools in modern photography and videography, gaining widespread popularity for capturing images and videos. These devices collect various data types—including images, videos, audio, biometric data, geospatial data, geographical coordinates, and telecommunication data—serving multiple purposes. However, this collected data frequently identifies individuals, directly threatening personal data protection rights. Operators who use drones carelessly risk violating data subjects' rights and freedoms under data protection regulations.
Drones, or Unmanned Aerial Vehicles (UAVs), are aircraft operated without a pilot, either remotely within a limited range or autonomously via pre-programmed flight systems. The latter method is increasingly popular, especially among content creators. Drones equipped with cameras, sensors, or infrared devices may unintentionally collect personal data without the data subject's knowledge. Therefore, drone operators must comply with PDPA regulations to avoid infringing on privacy or personal rights.
The types of data collected by drones generally depend on their intended purpose, which can be classified into the following categories:
• For the purpose of recording images and videos of individuals, such as filming for social media content, behavioral surveillance, or security monitoring, drones often capture clear images of individuals’ faces, record voices or conversations, or collect visual or infrared footage that reveals information about a person’s private life, behavior, or physical characteristics. In some cases, drones may also detect and record heat signatures emitted from individuals, which may reveal the individual’s behavior
• For the purpose of geographic surveying, such as the inspection of infrastructure, terrain mapping, or the monitoring of agricultural areas, drones may be used to capture images of specific locations, natural resources, or geographic coordinates. Such data generally does not directly identify individuals.
However, even when the primary purpose of drone usage does not involve the collection of personal data, there remains a significant risk that such data may be incidentally captured. This includes the unintentional recording of surrounding information or environmental details that may identify an individual, such as a person appearing in the background of an image or video. It may also involve other types of identifiable data, such as personal belongings, residential properties, vehicles, GPS coordinates, license plate numbers, or nearby public areas. In particular, the use of drones in community areas may result in the recording of imagery that infringes upon individuals’ privacy or discloses aspects of their private domestic lives.
In addition, it is important to consider the risk that drones may collect “sensitive data,” which is highly delicate in nature and may be subject to misuse or discrimination under Section 26 of the PDPA. For example, one risk involves facial recognition technology that uses algorithms to analyze and identify individuals based on their unique facial features. This may also include recording behavior in locations that reflect political opinions, religious or philosophical beliefs, or other sensitive data that could impact the rights and freedoms of the data subject.
For instance, during the recent Songkran festival, AI-powered cameras were reportedly used to scan faces in the crowd to identify individuals with arrest warrants by matching them against police databases. This type of image recording may involve sensitive data under the PDPA, and thus requires heightened caution to avoid unlawful data processing or rights violations.
In Thailand, drone operations are regulated by the Civil Aviation Authority of Thailand (CAAT) and the National Broadcasting and Telecommunications Commission (NBTC). The 2015 Ministry of Transport regulations require drone operators to register, obtain frequency authorization, and comply with no-fly zones—explicitly prohibiting the use of drones to infringe on individuals’ privacy through image or data capture. While PDPA does not explicitly address drone-related data collection, operators may refer to international best practices, such as the Spanish Data Protection Agency’s Drones and Data Protection manual and Ireland’s Data Protection Commission’s Guidance on the Use of Drones.
In addition to the legal considerations for drone use mentioned above, the use of drones must also comply with the PDPA. The drone operator may be classified as a "Data Controller" if they determine the purpose and methods of data processing, and must comply with the law and demonstrate adherence to it. Alternatively, the operator may be a "Data Processor" if they collect data as directed by another entity. In some cases, drone use may qualify for exemption from personal data protection requirements if conducted for personal benefit or family activities, such as photography or videography as a hobby. While the law does not prohibit photography in public spaces, drone operators must still adhere to drone flight regulations, or at minimum, should inform individuals who are “intentionally” being photographed or recorded about such data collection. This includes the obligation to implement security measures to prevent any leakage of data recorded by the drone.
Drones collect personal data, and operators should consider the legal basis for this, whether as data controllers or processors. This may include fulfilling contracts, complying with legal obligations, or protecting life, safety, or health. If no legal basis exists, operators should obtain consent from data subjects, especially when collecting sensitive data. Additionally, operators should inform data subjects about data processing details. In practice, operators should ensure that data subject understand where and why the drone is being used. If a standard Privacy Notice is not feasible, operators should consider alternative methods to inform individuals, depending on the situation.
When drones are flown in public or open spaces where individuals cannot be directly identified or contacted, meeting the notification requirements under Section 23 of the PDPA may be challenging. To promote transparency, operators may consider the following approaches:
• Display signs in the area noting drone use and the purpose of data collection
• Provide leaflets or posters in the area where drones are active
• Publish relevant details online, including purpose, retention period, data subject rights, and contact information
• Share advance notice through social media or local news outlets
• Use brightly colored drones, flashing lights, or sound alerts to make them easily noticeable
• Wear clear identification to help people recognize who is responsible
In summary, under personal data protection laws, drone operators acting as data controllers or processors should fulfill their legal obligations. These include informing data subjects about data processing activities, implementing appropriate security measures, and having a valid legal basis for collecting both general and sensitive data. They should also ensure mechanisms are in place for data subjects to exercise their rights. Therefore, drone operators are encouraged to study and comply with the PDPA to avoid legal risks and, above all, to respect individual privacy rights.
Source : https://rta.mi.th/ep-1-โดรนติดอาวุธพลิกโฉม/ (last visited Apr 9, 2025).
drones-and-data-protection.pdf, https://www.aepd.es/guides/drones-and-data-protection.pdf (last visited Apr 2, 2025).
EDUARDO USTARAN, EUROPEAN DATA PROTECTION LAW AND PRACTICE.
