INTRODUCTION

Today drones have taken over our daily lives. Originally of military origin, they have been deployed in the civilian world and affect a wide variety of sectors ranging from entertainment, commercial and agricultural activities, not forgetting their use by rescue services or law enforcement agencies for surveillance purposes. They can be designed for different types of environment (land, sea or air) but it is mainly aerial drones that are booming in all sectors. Aerial drones concentrate many qualities both in terms of their mobile nature and from a technological point of view due to the connected objects with which they are equipped. Also, their miniaturisation has largely contributed to their introduction in national airspace. In particular, it makes them easier to handle, but also more discreet. In addition, this miniaturisation gives them a more attractive self-contained character that offers them the possibility of operating in areas that are otherwise difficult to access. However, it is undeniably that their most interesting features are the built-in and attached tools. In fact, the drone on its own is of little use, so it is the drone’s payloads or tools, often connected, that give it real value.¹ Drones also carry the advantage to be able to be equipped with cameras and other sensors. Finally, they offer the opportunity to limit the risks incurred by professionals engaged in high-risk activities such as fire-fighting. Consequently, drones have become an indispensable tool for the exercise of many activities, particularly in the context of security and rescue activities.

However useful they may be,drones present several legal and ethical challenges. On the one hand, they can cause concern about physical risks to people on the ground, other aircraft or sensitive areas or sites such as a nuclear power plant. In fact, many articles in the media regularly report events illustrating the risks and threats of the increasing use of aerial drones. The example of air safety is one of the most frequent examples where airports have several times had to deal with the unexpected presence of drones disrupting air traffic and causing risks of collision between drones and aircraft. ² Similarly, the risks associated with the numerous overflights of nuclear sites³ have prompted French legislators to quickly legislate on the use of civil drones. On the other hand, drones can also arouse suspicion among individuals when used for surveillance purposes. In France, law enforcement agencies already use drones in the public space. However, the use of drones for the purpose of monitoring compliance with health measures during the year 2020 has given rise to controversy fuelled by the media⁴ and by associations defending fundamental rights and freedoms, to the extent that they have been the subject of two summary proceedings demanding the immediate cessation of these practices.⁵ Thus, drones raise questions both of a general nature (design, use, liability for drones) and of a more specific nature, such as the protection of fundamental rights when the drone is equipped with a camera, or other personal data sensors or behavioural analysis algorithms.

Aerial drones therefore require a framework for their use, including a legal regime for each type of drone. In fact, all drones do not have the same characteristics and several qualifications are used to designate them (UAV, UAS, RPAS, etc.). Since “drone” is a generic term without a legal definition, the French legislature uses the terms “aircraft without a pilot on board” or “unmanned aircraft”. The terminology used is therefore essential as it makes it possible to determine the applicable legal regime. ⁶ The term will vary according to the context in which it is used or the purposes for which it is used.⁷ Therefore, European law will refer to UAV (Unmanned Aerial Vehicle) or UAS (Unmanned Air System) as any aerial drone capable of flying autonomously (pre-programmed or automated drones), in other words without the control of an unmanned pilot. In contrast, the term RPAS (Remotly Piloted Aircraft System) will be preferred for drones remaining under the control of the “distant pilot” (remotely piloted drones⁸) such as those used by law enforcement and rescue services. Both the European regulations and the regulations of several Member States have therefore endeavoured to establish a legal framework that takes account of the different types of aerial drones and their purposes of use. In order to meet the challenges posed by the rapid growth in the use of drones of all kinds, several regulatory texts governing their use have been issued at national and then European level (1). However, the use of aerial drones equipped with multiple data sensors still raises many questions about respect for Fundamental rights to privacy and the protection of personal data (2).

AIR SAFETY ISSUES: REGULATIONS APPLICABLE TO CIVIL AND STATE DRONES

The benefits linked to the use of drones have not escaped the notice of many players. In this sense, some players have quickly shown an interest in using these drones as a support in the context of their professional activity. This was the case for the fire brigade, which began using them in 2012 to fight forest fires.⁹ However, other players have used aerial drones, sometimes taking advantage of the legislative vacuum in this area, without necessarily showing malicious intent. The risks of accidents or invasion of privacy posed by these uses have created a regulatory and jurisprudential movement to regulate these practices. The French courts had the occasion to intervene in several cases relating to the use of civil drones on French territory. A first case arose when a drone flew over the city of Nancy in January 2014. The drone had flown over and captured images of the city without authorisation, which were then published on social networks. In this case, the Nancy Regional Court had simply fined the defendant. ¹⁰ Another case concerned the hindering of the take-off of a rescue helicopter by a drone flying over a Spanish cargo ship stranded on a sea wall. This case had led to a four-month suspended prison sentence for the pilot and his accomplice by the Bayonne criminal court on 4 July 2014.¹¹

Citing similar cases, several EU Member States have implemented regulations on drones. Belgium, Spain and France, for example, have enacted a number of laws to govern the use of drones according to the type of activity envisaged (leisure or professional) or the place of use. The possibilities for use are therefore limited because they are very tightly regulated, with regulations taking into account a large number of scenarios.¹² In France, the first regulatory framework providing for the flight of civil drones was introduced in 2012, making it one of the pioneers in terms of the legal framework for unmanned aircraft for civil use. Revised for the first time in 2015,¹³ the two main decrees governing the use of drones in national airspace set out in detail the design elements to be taken into account and the various procedures and obligations to be complied with in order to operate a drone in urban areas. Both decrees include a section on the use of drones in the context of professional activities. This framework comprises four flight scenarios taking into account the drone’s technical characteristics, its place of operation (populated or unpopulated area) and its mode of evolution (within or out of sight of the pilot). To mitigate the risks associated with the use of civil drones and to supplement the regulatory texts, the French legislature adopted a law on October 24, 2016¹⁴ aimed at making users of aerial drones responsible and punishing all illegal overflights. This law responds to the issues raised by the overflight of sensitive areas and sites by drones, and introduces a specific penalty system for the illegal use of civil drones. Among the new provisions, it introduces two new drone mass thresholds, meaning two categories of drones including a more flexible regime for the lightest drones. The law creates new obligations and sanctions based on five major points relating to the identification of the drone (registration or recording), alert mechanisms of its presence (light or sound), the training of drone pilots, the provision of information to users, and the sanctioning of illegal use. Further to this law, other regulatory texts¹⁵ have been adopted to describe the procedures linked to the training of drone pilots, including a theoretical examination and a practical examination. In regulating the soonest, France became the forerunner within the European Union of the rules that must be applied to ensure the physical integrity of people on the ground and guarantee compliance with the rules of the air issued by international and European treaties.

Drones must also be subject to the supranational framework regulating the use of aircraft. These texts describe a general framework for their use and are primarily aimed at civil aircraft. The international regulations constitute the first framework for unmanned aircraft on board and establish the main common rules to be operated in order to ensure the safety of flights by all types of aircraft. As of today, the Chicago Convention of December 7, 1944¹⁶ is the only international treaty that includes a section on the use of unmanned aircraft on board. However, its application is limited and cannot be applied to all drones. On the one hand, the text provides that drones which are not intended to cross borders will not be regulated by this treaty.¹⁷ Thus, the Convention does not introduce rules common to the signatory States concerning unmanned aircraft on board. Furthermore, in accordance with the principle of sovereignty, it does not apply to “State” drones described as “aircraft used in military, customs or police services”.¹⁸ However, the text specifies that the signatory States have the obligation to ensure that their military aviation complies with the safety and security measures applicable to civil aviation. Lastly, the article 8 of the Chicago Convention establishes the first rule on drones as unmanned aircraft and requires all signatory States to put in place regulations for unmanned aircrafts.

At the European level, there are two regulations applicable to drones. Firstly, the European regulation of September 26, 2012¹⁹ establishes air rules common to the entire European territory and essentially incorporates the various annexes to the Chicago Convention of December 7, 1944. This regulation applies to both civil and State drones, although it does contain derogations for activities in the public interest.²⁰ Secondly, the European Regulation on Civil Aviation of July 4, 2018²¹ unifies the framework for aircraft (including those with no crew on board) and repeals the previous European Regulation of 2008.²² This revision of the European text regulating unmanned aircraft on board was necessary in order to take into account their miniaturisation as well as their technological developments. Indeed, the 2008 regulation had the disadvantage of being applicable only to aerial drones weighing more than 150 kg. Consequently, this regulation was not adapted to the current framework in that it excluded certain categories of drones from its scope. This first regulation had the merit of establishing the European Aviation Safety Agency (EASA), the body responsible for regulating and implementing civil aviation safety in Europe. EASA is therefore the competent body for civil drones. Also, EASA has contributed to the edification of the new European regulation on civil drones. During a public consultation on July 31, 2015,²³ it presented thirty-three proposals suggesting in particular that drones be divided into three categories according to the risks they present. Subsequently, EASA published another document on May 4, 2017²⁴ proposing amendments to the 2008 regulation.

The European regulation of 2018 establishes general safety rules for all types of aircraft and includes a specific section dedicated to the use of drones.²⁵ With regard to aerial drones, the regulation takes into account developments in the field of unmanned aircraft and grants the legal framework accordingly by removing the weight limit for the application of civil aviation regulations.²⁶ In addition, it introduces new categories that differentiate between aerial drones no longer on the basis of their weight but on the basis of the risk they present.²⁷ This new categorisation will have made it possible to better take into account the specific characteristics of drones in relation to other aircraft and the type of operation planned. Like the Chicago Convention and the 2008 regulation, the 2018 regulation does not apply to military and State aircrafts. However, it does require them to comply with the provisions to ensure the safety objectives set out in the regulation.²⁸ The text also takes into account the issues relating to the use of civil unmanned aerial vehicles (UAVs) with regard to fundamental rights and freedoms²⁹ by mentioning in particular Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union (TFEU) and the European General Personal Data Protection Regulation of April 27, 2016³⁰ (GDPR). Finally, the regulation defines the obligations for designers and users of unmanned aircraft on board.³¹ Designers will be responsible for ensuring the adaptability of their unmanned aerial vehicles to the planned functionalities in order to minimise risks, and for providing the necessary information to operators guaranteeing the safe use of the unmanned aircraft on board. The regulation therefore requires operators and pilots of unmanned aerial drones to be familiar with both European and national rules that may apply to unmanned aircraft (such as those regarding the protection of privacy and personal data), as well as those on airworthiness, and to have the necessary skills (theoretical and practical training) to ensure the safety of their operations.

Unmanned aerial vehicles for use by law enforcement and rescue services belong to the category of aircraft with no personnel on board, both military and State-owned, and are intended to operate in general airspace.³² For this reason, European regulations do not apply to them. In France, the regime for these drones is based on provisions specific to civil aviation (regulations governing civil drones) and includes provisions relating to the national regulations governing military and State aircraft without persons on board. As a result, aerial drones used on behalf of the State have a hybrid legal framework. However, no specific regulations governing their use have been drawn up with a view to their integration into general airspace. They can, however, apply the 2015 decrees and benefit from their exemption measures. Police and rescue aerial drones, in their capacity as military and State drones, are also governed by the Decree of 29 April 2013,³³ the Decree of December 24, 2013³⁴ and a Military Instruction of 23 November 2017,³⁵ which allow drones and other aircraft to co-exist in flight. The various texts list several categories describing the criteria relating to their weight, their place of operation (indoor or outdoor) or the conditions under which the drone is piloted (such as flight in or out of sight of the pilot). They also define the different environments depending on whether or not the drones flies over an area close to a builtup area (populated area). Although this regulatory framework is consistent in terms of its operating environment, it could use a certain degree of unification, particularly since the introduction of the 2018 European regulation amending national regulations on civil drones.

Regulatory developments in the field of unmanned aerial drones demonstrate a desire to ensure the safety of flights by unmanned aerial vehicles and consequently to ensure the physical integrity of people and other aircraft. However, other issues must also be taken into consideration, such as the infringement of fundamental rights, in particular those relating to the protection of privacy and personal data. Indeed, aerial drones equipped with cameras or other data sensors may infringe the exercise of these rights. Furthermore, an infringement of other fundamental rights is to be feared when these drones are equipped with algorithms responsible for processing the data collected or even analysing it in real time.

IMPACT OF THE USE OF AERIAL DRONES ON FUNDAMENTAL RIGHTS: POTENTIAL INFRINGEMENTS ON PRIVACY AND PERSONAL DATA

The use of drones equipped with cameras presents risks of infringement of fundamental rights. They mainly raise issues concerning the privacy of individuals. For example, a person could be unlawfully photographed by a drone equipped with a camera. In France, the capture of images by drones is subject to regulation through Article D133-10 of the French Civil Aviation Code and its implementing decree of July 27, 2005,³⁶ which provides that “any person wishing to record images or data in the visible spectrum above the national territory must make a declaration no later than fifteen days before the date or the beginning of the period provided for the planned operation to the head of the territorial civil aviation department responsible for his or her place of residence”.³⁷ It thus provides for a penalty for its transgression but, given the miniaturisation of drones, which is proving difficult to detect, it no longer seems to meet all cases. Aware of the risks that the use of camera-equipped drones can entail, the French National Data Protection Authority (CNIL), which is responsible for monitoring the protection of personal data, is following developments concerning data capture and the invasion of privacy by aerial drones with the utmost attention. Already in 2013, the CNIL was concerned about the possibility of “indiscriminate mass capture by drones”³⁸ and has therefore set up a special group within its institution to deal with issues relating to the use of drones.³⁹ However, the CNIL had not published any other documents on this subject and remained rather discreet until recently. Similarly, both the European Commission and the G29 (European group for the protection of personal data), raised their concerned on the protection of personal data with regard to the use of drones. Thus, in November 2014,⁴⁰ the European Commission published a study that highlighted the difficulties in applying the regulation related to personal data given the specific nature of drones. Also, the risks of invasion of privacy could be amplified in the event of massive data acquisition by drones being associated with methods of processing large quantities of data (big data).⁴¹ The G29 also published a document on June 16, 2015⁴² containing guidelines that set out principles and recommendations. The G29 recommends, firstly, the application of the principle of transparency through the right to information (eg. of the presence of a drone) and underlines that data protection rules apply as soon as personal data is collected. Secondly, they put forward the need to apply a principle of minimising data collection. Furthermore, they stress the risk that the interconnection of data collected by drones could further facilitate the process of identifying individuals and therefore recommend “adopting technical measures to protect privacy by design and by default”⁴³ (eg. select the type of data collected, anonymisation processes...). Finally, the G29 insists on the primordial nature of the principle of security (eg. encryption processes, limitation of retention or suppression of certain data over time, notification of a breach or unauthorised access to the data).

The illegal capture of images thus infringes on people’s privacy. However, the right to privacy is a founding principle of the ethics of connected objects to which aerial drones belong and must therefore be at the heart of their design and use. It is difficult to define the notion of “private life” which, moreover, is not the subject of any legal definition. However, it is possible to describe the notion of “private life” as a necessity peculiar to human beings which guarantees their existence, thus “every person needs an intimate, inviolable sphere of privacy which belongs only to him and for which he is accountable to no one else”.⁴⁴ The right to privacy is protected at national, international and European level. This right is enshrined, first of all, in Article 12 of the Universal Declaration of Human Rights of December 10, 1948.⁴⁵ At European level, the European Convention on Human Rights of November 4, 1950⁴⁶ mentions it in its Article 8. Similarly, the Charter of Fundamental Rights of the European Union of December 7, 2000⁴⁷ includes it in Article 7. Also, the United Nations in its Declaration of 10 November 1975 states that

all States shall take measures to ensure that all sections of the population enjoy the benefits of science and technology and to protect them, both socially and materially, from the negative consequences that may result from the misuse of scientific and technological progress, including the improper use that may be made of it to infringe the rights of individuals or groups, in particular with regard to respect for private life [...].⁴⁸

Finally, the Riga Declaration of 6 March 2015⁴⁹ (which preceded the European Civil Aircraft Regulation) stressed the crucial importance of protecting the fundamental rights of individuals, including the right to privacy. In France, the protection of privacy is enshrined in Article 9 of the Civil Code, which creates a right of personality. Also, consistent case law recognises that an invasion of privacy “is characterised when the person is recognisable or identifiable”.⁵⁰

Privacy can also be seen as a set of actions or personal information. However, aerial drones equipped with cameras can collect a large amount of information, some of which will fall within the scope of private life. This information is to be distinguished from personal data that may be collected and processed by the drone.⁵¹ Indeed, the information collected by aerial drones may be of a diverse nature and certain information may be more closely linked to individuals. The notion of private life has sometimes been very broadly extended to include a right to identity such as the right not to reveal information about one’s habits. This right to identity also creates a right to privacy in the home or to secrecy. However, the extension of the notion of private life in no way hinders the intrusion of third parties into people’s private lives, which is exacerbated by the use of new technologies. Technological advances therefore bring opportunities as well as dangers. The challenge of camera equipped drones could be summed up as follows: the more people are observed, the more the sphere of their private life diminishes.⁵² The private sphere represents a person’s intimacy. Consequently, the protection and respect of privacy presupposes an individual’s freedom to choose his or her private life, in other words “the ability to freely determine one’s private life is the very manifestation of the existence of a private sphere free from State interference”.⁵³ Accordingly, both emotional and sentimental choices should not be subject to outside interference. Furthermore, the principle of respect for private life requires that a person should be able to keep secrets concerning his or her person, meaning a form of right to anonymity which cannot be interfered with by third parties.

The risks posed by aerial drones are all the more worrying when it comes to their use for surveillance by law enforcement agencies. Most countries have equipped themselves with surveillance cameras to film public roads and infrastructure. The increasing number of technologies for the surveillance of buildings, property and people is one of the risks to privacy. However, aerial drones have the disadvantage of being more intrusive due to their mobility but also due to the fact that they will not be limited to the simple capture of images and will be able to collect many data, including personal data. Thus, the intrusion into private life will be significantly more extensive and the feeling of being observed will be more palpable. Indeed, the sensors they contain may be able to identify and track a person through geolocation systems. In particular, drones will be able to determine a person’s actions or even words, the place where the data was collected and to store the information obtained by aggregating this data. It would therefore be advisable to minimise the amount of personal data collected by aerial drones, as recommended by the provisions of the General Data Protection Regulations (GDPR) and the G29.⁵⁴ However, technologies for use by law enforcement agencies are subject to the provisions of the European Directive of April 27 2016 on the processing of personal data by the competent authorities in the field of criminal law⁵⁵ (“Police-Justice” Directive), which is sometimes more flexible than the GDPR, thus acting to the detriment for the right to privacy.⁵⁶ Indeed, the data minimisation principle of the Directive differs significantly from that of the GDPR and states that the data collected must be “not excessive” (and no longer “limited”), thus providing greater latitude for law enforcement agencies to collect data. Therefore, the increased possibilities for data collection coupled with the mobility capabilities of drones create an amplifying effect on surveillance. This increase in the surveillance effect is not limited to issues relating to privacy or the protection of personal data but tends towards a study of the consequences on the behaviour of individuals, referred to by the term “behavioural privacy” that can be described as the freedom to act and the choice of behaviour in the exercise of one’s private life.⁵⁷

To this day, the French Internal Security Code, which governs the use of surveillance cameras, does not make any specific provision for the capture of images by drones. Currently, drones used by law enforcement and rescue services are subject to the general framework of video surveillance systems (or CCTV). However, this provisional regime has many limitations linked to an implementation dedicated solely to fixed cameras and does not take into account the specific characteristics of the mobile nature of drones. The regulations relating to video surveillance notably include provisions on the automated processing of personal data. This processing is therefore subject to the provisions of the European directive of April 27, 2016 relating to the protection of personal data in criminal matters and to Law of January 6, 1978 relating to information technology, files and liberties⁵⁸ revised by Law of June 20, 2018 relating to the protection of personal data.⁵⁹ Surveillance cameras and, consequently, surveillance drones are subject to the provisions of these texts when they collect and process personal data. Recently, the French Council of State had the opportunity to recall this when the Police Prefecture of Paris used drones during the coronavirus crisis of 2020. In its decision of May 18, 2020,⁶⁰ the Council of State recognised that the purpose of using drones in the context of the health crisis was not called into question and that it was not in itself of such a nature as to seriously and manifestly infringe fundamental freedoms. However, it emphasises that the contested measure constitutes processing of personal data which, consequently, requires an authorisation by decree following a reasoned opinion from the French National Data Protection Authority (CNIL). The Council of State thus pronounces a strict and immediate ban on the use of public security drones, not on the basis of the proportionality of the means used (in the context of a health emergency), but on the basis of lawfulness.⁶¹ The law enforcement authorities subsequently stopped using these surveillance drones, but only for a limited period of time, as a new application to stop their use was filed on October 26, 2020. On December 22, 2020,⁶² the Council of State once again responded favourably to the request, considering that the images collected, even if blurred, did not in any way remove the character of personal data and therefore ordered the Paris Police Prefecture to immediately stop using surveillance drones.

Recently, the legislator has undertaken to respond to the request made by the French National Data Protection Authority (CNIL) to implement a specific framework for the use of new video camera devices,⁶³ by introducing a bill on “Global Security”. Among these various provisions, this text develops a possible framework for the use of surveillance drones under Article 22 entitled “airborne cameras”. The regulation of surveillance drones was particularly awaited following the controversies that their use has aroused in recent years. The bill on “Global Security”⁶⁴ was adopted by the National Assembly on November 24, 2020 and should be examined by the Senate in January 2021.

Finally, drones used for surveillance purposes do not simply aim at the collection of personal data but also at the use of such data in real time during missions in order to assist law enforcement agencies in their decision-making process. Algorithms are thus gradually being incorporated into the video surveillance tools favoured by the introduction of drones. Among the functions resulting from the algorithms is facial recognition. However, this remains highly controversial in many countries and is the subject of considerable debate due to the many errors resulting from the biases of these algorithms. To this end, the CNIL issued a call to order concerning the use of facial recognition on November 15, 2019⁶⁵ and invited citizens to debate that subject in order to respond to the concerns raised by this technology. Today, algorithms based on the use of personal data are regulated by the GDPR and the “Police-Justice” Directive. However, it would be preferable to create a specific framework for the use of algorithms rather than simply linking it to the rules on the protection of personal data which tend to restrict the effectiveness of the regulation. A constitutional bill relating to the Charter of Artificial Intelligence and Algorithms⁶⁶ was issued in France on 15 January 2020, with a view to providing a framework for these technologies. Europe is also not to be outdone since the European institutions are actively organising themselves in the implementation of provisions and recommendations aimed at regulating the use of artificial intelligence (AI) and algorithms. Thus, the “White Paper on AI” issued by the European Commission on 19 February 202⁶⁷ or the Recommendation of the Council of Europe on the consequences of the use of algorithms on fundamental rights⁶⁸ offer a first step towards the regulation of algorithms and AI.