Low-altitude Economy | A Study of Unmanned Aerial Vehicle Privacy Legal Issues

Common situations in which drones infringe on privacy mainly include: Peeping into others' privacy: Drones take close-range aerial photographs of others' residences, bathrooms, bedrooms, and other places, obtaining scenes of others' private lives. For example, the incident of a woman in Changchun being photographed in her underwear after showering by a drone, as reported by the media, has attracted public attention. Tracking and surveillance: Using drones to track and monitor targets for extended periods, infringing on personal whereabouts information. Drones are highly covert and can hover above targets for extended periods to collect dynamic data. Data collection: The videos, photos, and remote sensing data collected by drones often contain personal information (such as portraits, voices, habits, vehicle information, etc.), and may be used for analysis or dissemination, leading to privacy leaks. For example, plant protection drones repeatedly scan faces or three-dimensional data of surrounding residences; Logistics drones The trajectory data and take-off and landing point correlation analysis of can infer the daily activity patterns of ground users. Interference with residential peace: Drones flying low and repeatedly circling over residential areas directly interfere with residents' private lives, such as night-time thermal imaging penetrating curtains to peek into indoor situations.

The main reasons for the occurrence of the above-mentioned infringement behaviors are: Weak legal awareness of operators: Some drone operators lack awareness of privacy protection and regard drones as novel tools, taking pictures at will regardless of the wishes of others; there are also illegal elements who deliberately use drones to infringe on privacy. Lagging legislation and regulation: Current legal systems for drones mainly focus on flight safety and airspace control, with a clear gap in the regulation of privacy infringement. Drone technology is developing rapidly, while legal regulations are slow to follow, lacking targeted legal provisions (such as the lack of explicit provisions prohibiting drones from infringing on privacy in the Civil Aviation Law and departmental regulations). Difficulties in law enforcement and evidence gathering: Drones can be remotely controlled and are easy to conceal, making it difficult to secure evidence and identify the subject. The cost of violations is low, the existing penalties are limited, and victims often find it difficult to discover and provide evidence in a timely manner, making it difficult to punish infringement behaviors promptly.

China's legal documents on drone management mainly focus on safety supervision and pay relatively little attention to privacy protection. Relevant laws and regulations currently include: the Civil Aviation Law, the Interim Regulations on the Administration of Unmanned Aircraft Flight, the Regulations on the Management of Real-Name Registration of Unmanned Aircraft, and the Personal Information Protection Law and the Cybersecurity Law.

Interim Regulations on the Administration of Unmanned Aircraft Flight As China's first administrative regulation on drones, it makes detailed provisions on the management, registration, and flight management of drones classified by weight. For example, Article 10 of the Regulations stipulates that "owners of civil unmanned aircraft shall register in accordance with the law", and requires that flight activities comply with real-name registration, flight area restrictions, and network information security regulations. The Regulations enhance the traceability of drone identity and trajectory through measures such as requiring drones to automatically broadcast identification information during flight, which helps to find the subject of illegal flight behavior. However, the Regulations mainly focus on aviation safety and airspace control and do not make explicit requirements for privacy protection. Although regulations on the free flight of drones in suitable airspace and classified flight permits have improved flight efficiency, they have not set restrictions on flight content (such as photography).

Civil Aviation Law Mainly regulates the operation and management of manned aircraft, and drones are only generally referred to as "civil aircraft", without clear legislation on their particularity. For example, the Civil Aviation Law does not specifically prohibit the privacy behavior of drones, only stipulating that "civil aircraft shall comply with flight rules". Therefore, it lacks a legal basis to determine that drones infringe on privacy based solely on current civil aviation regulations.

Personal Information Protection Law and Cybersecurity Law Provide a legal basis for the processing of personal information, but their applicable objects are mainly network and data processing behaviors, not drones themselves. The Personal Information Protection Law stipulates that the processing of personal information must be legal and legitimate and must not illegally collect or use it; Article 44 of the Cybersecurity Law prohibits the illegal acquisition of personal information. If the aerial photography by drones obtains video information that can identify individuals and involves private content, it can be constrained according to personal information processing, but how to determine the "sensitivity" and "legality" of aerial photography data still requires specific analysis. Overall, China's current legal system has a relatively complete regulatory system for drone flight and data collection (such as real-name registration and airspace division), but lacks specific provisions and details for privacy protection, making it difficult to fully address the privacy risks of the drone era.

Developed countries and regions are also constantly improving drone regulations to balance technological development and privacy protection. Below is an analysis of representative countries:

United States: There is a lack of specific drone privacy laws at the federal level, but the Federal Aviation Administration (FAA) has established rules for safe drone flights, and various states have also enacted relevant laws (such as prohibiting drones from secretly filming private residences). The 2018 FAA Reauthorization Act requires the Department of Transportation to assess potential privacy violations caused by drones and report to Congress. The industry has also proposed several bills, such as the "Drone Privacy and Transparency Act," to explore privacy constraints on drone flights and data usage. Overall, the United States emphasizes the balance between drone management and privacy rights, advocating the principle of "necessary restriction," and attempting to find a reasonable boundary between encouraging innovation and protecting personal privacy.

European Union: The EU's strict "General Data Protection Regulation" GDPR "applies to any personally identifiable data collected by drones, requiring drone operators to obtain explicit consent before filming or meet other lawful processing conditions. In addition, the European Union Aviation Safety Agency (EASA) has issued guidelines such as the "Drone Privacy Handbook," requiring drone operators to comply with local privacy laws, such as avoiding filming people or private property without permission. EU member states may also develop detailed regulations, such as Germany's restrictions on aerial photography of personal images under the Federal Data Protection Act, and France's data protection law and aviation law have specific provisions for civil drone photography.

Japan: According to Japan's Civil Aeronautics Act, micro-flying devices (over 100g) must be registered with the Ministry of Land, Infrastructure, Transport and Tourism, and must maintain visual distance during flight, avoiding flying over crowded areas or private residences. In addition, relevant judicial interpretations and the Personal Information Protection Act in Japan also apply to personal data collected by drones. As shown in the journalist's guide, drones must maintain a distance of at least 30 meters from others and private property, and respect portrait rights and privacy rights.

Other countries: Many countries incorporate drones into existing airspace management systems and use multiple channels such as civil aviation regulations and data protection laws to constrain them. Overall, foreign countries generally do not have specific criminal provisions targeting drone privacy violations, but they regulate privacy risks in drone use through a combination of civil tort law, data protection law, and aviation regulations. In the process of low-altitude airspace development and drone commercialization, legal systems in various countries face new privacy challenges and gradually improve supervision through continuous legislation and guidance documents.

"Low-altitude economy," as an emerging economic form, has given drone technology applications "intelligent" wings, and has also made privacy risks more diverse. In this context, data transmission, cross-border flow, and artificial intelligence algorithm-assisted data collection have brought new challenges:

Algorithms and large-scale data collection: With the integration of drones and AI technology, drones can be equipped with high-precision cameras, multispectral sensors, LiDAR, etc., for automated data acquisition. For example, in the agricultural field, plant protection drones can collect terabytes of farmland data in a single operation, and may include facial information of pedestrians on the roadside; power inspection drones use LiDAR scanning to obtain three-dimensional building data in residential areas. The rich data collected by drones, after AI processing, can push personalized advertisements or economic analysis; for example, by linking drone takeoff and landing points with shop data, it is possible to infer the regularity of people's commercial activities and assist marketing. The application of such algorithms and big data technologies blurs the boundaries of privacy protection, challenging the scope of "movement information" and "private space" protected by Article 1034 of the Civil Code.

Data transmission and cross-border flow: Drone operations often involve cloud data transmission and multi-national system docking. A large amount of aerial photography data and operational information may be transmitted across borders to overseas servers or algorithm platforms, forming a data enclave "model. This type of cross-border data flow accelerates services and R&D, but it can also easily lead to the uncontrolled circulation of key data (such as precise map data and personal trajectory information) overseas, violating Article 37 of the National Security Law regarding data sovereignty. Countries are increasingly strict in their requirements for cross-border data protection, and drone operators need to pay attention to international data protection regulations (such as the EU GDPR, US cloud privacy regulations, etc.), otherwise they may face legal risks.

Technical superposition effect of privacy risks: Drone applications promoted by the low-altitude economy, such as air taxis and instant logistics, have higher data requirements and privacy risks are more difficult to detect. For example, networked drone clusters cooperate in flight to collect environmental data, but may also collect information about ground personnel; if there are deviations in the algorithm's automatic decision-making for flight control, it may also infringe on the rights and interests of the crowd. In the era of the low-altitude economy, traditional aviation regulations are often difficult to cover these emerging privacy infringement scenarios. In summary, in the context of the low-altitude economy, the new technologies and models of drones combined with AI, big data, and cross-border networks are forming new threats to personal privacy rights, and putting higher demands on legislation and regulation.

To address the privacy risks of the drone age, relevant legislation and regulatory mechanisms should be improved. Suggestions include:

Improving the legal regulatory framework: Add special provisions on drone privacy infringement within the existing legal system. We can draw lessons from the proposals of the academic community: establish a special tort liability system for intelligent drones infringing on privacy rights in the Civil Code; add special provisions on privacy protection in the Civil Aviation Law or supporting regulations; at the level of administrative regulations or departmental rules, formulate privacy protection standards and requirements for the entire life cycle of drones (design, production, operation, maintenance, etc.). This highlights the particularity of drone infringement and provides a clear legal basis for privacy protection.

Strengthening real-name registration and technical supervision: Implement real-name registration for drones and real-name flight system, and increase law enforcement efforts. The newly promulgated "Regulations on the Management of Drone Flights" by the State Council has required drone owners to register with their real names. It is recommended to strictly enforce and expand the coverage (including models below 250g), establish a drone operation platform, and receive and analyze the broadcast location information of drones in real time. Promote technical means such as electronic fences, flight restricted areas, and aerial photography range restrictions, and prohibit drones from collecting images in sensitive areas and private airspace. A blacklist system should be established for drones, and disciplinary measures such as flight restrictions and license revocation should be taken against high-frequency violators.

Improving data processing and compliance requirements: Clearly define the legal boundaries of data collection by drones. Legislation could stipulate that drone-collected image information, if it involves identifiable individuals, must comply with personal information protection laws and regulations; penalties should be imposed for malicious filming and illegal dissemination. Strengthen data security supervision of the drone industry, requiring producers and operators to securely store and encrypt the transmission of collected data. Research and develop an industry self-regulatory convention, similar to "GDPR for drones," to guide companies to disable unnecessary personal information collection functions by default in product design.

Establish a professional regulatory body and collaborative mechanism: It is recommended to establish or designate a specialized drone regulatory department (or a specialized agency within the existing aviation management department) to coordinate drone flight permits, license examinations, accident investigations, and privacy infringement handling. Strengthen collaboration among public security, cyberspace administration, and market regulation departments to establish a drone monitoring, early warning, and case handling mechanism. Implement special approvals and post-audit for frequently violating or technically complex drone activities, such as commercial aerial photography and logistics delivery, to ensure that operating entities fulfill their privacy protection obligations.

In summary, improving drone privacy legislation requires a multi-pronged approach, from clarifying legal provisions and strengthening technical control to coordinating regulatory agencies, to form a systematic institutional guarantee.