4.1.1 Identifying applicable rules and regulations

Authors: RIMA project

Guidance on identifying applicable rules and regulations for unmanned aircraft systems for inspection and maintenance

Though usage of drones in everyday life has been a relatively recent development, language in the Paris Convention of 1919 [1], which was then incorporated into the Convention on International Civil Aviation (also known as the Chicago Convention) that was signed in 1944, refers to the flying of aircraft without pilots. Today, all UN Member States are signatories of the Chicago Convention; consequently, all EU Member States are bound by the Convention [2].

Article 8 of the Convention forbids an ‘aircraft capable of being flown without a pilot’ from operating without state authorisation and requires states to take necessary safety measures to prevent accidents resulting from pilotless aircraft.

It is now important to consider the legislation and policy that is applicable to the use of drone technology. First, the relevant international regime will be considered briefly. Second is a discussion of relevant EU policy and regulation. Third, liability issues which could arise through the use of drone technology will be outlined. Last, focus will be placed on inspection and maintenance drones in relation to data protection.

International regime

The Chicago Convention led to the establishment of the International Civil Aviation Organization (‘ICAO’), which is a UN body that aims to achieve uniformity in international civil aviation regulation [3]. ICAO considers drones to be aircraft, and existing references to aircraft in its documents are applicable to drones [4]. Nonetheless, ICAO has established a remotely piloted aircraft system (‘RPAS’) panel to systemically amend the Annexes to the Chicago Convention to reflect the reality of the widespread use of unmanned aerial vehicles (‘UAVs’) [5]. The approach to not segregate the regulatory frameworks for manned and unmanned aircraft means that there is not a total lack of regulations to accommodate the newly developed technology because existing regulations on manned aviation would also be applicable to drones [6]. However, there remain gaps to be filled. Importantly, the lack of harmonisation may cause difficulties even if drones were to operate within domestic airspace or on the high seas, as they may be in the vicinity of aircraft registered in other states [7].

The EU position

The EU has taken the development and regulation of drones very seriously. As far back as 2002, the Joint Aviation Authorities (‘JAA’), the predecessor of the European Union Aviation Safety Agency (‘EASA’), cooperated with the European Organization for the Safety of Air Navigation (‘EUROCONTROL’) to form a UAV Task Force [8]. Its aim was to develop guidelines for regulating drones for civil use [9]. Consultation meetings were held on this subject. One such meeting, the Riga Conference, resulted in the Riga Declaration on remotely piloted aircraft (drones) in 2015, which included five guiding principles for the development of a European regulatory framework [10]:

1. Drones should be treated as new types of aircraft with risk-based regulation;
2. safety measures governing drone use must be developed forthwith
3. investment in technological advances is necessary to achieve full integration of drones into the European airspace
4. public acceptance of drone usage is a key consideration
5. the drone operator is ultimately responsible for its usage

Subsequently, in 2019, the EU adopted two regulations that provide rules governing the safe operation of drones in European airspace, Regulation 2019/945 and Regulation 2019/947 [11].

Liability issues

Liability issues regarding the operation of drone technology were highlighted as early as 2014. A communication from the European Commission outlined that ‘progressive integration of RPAS into the airspace from 2016 onwards must be accompanied by adequate public debate on the development of measures which address societal concerns including safety, privacy and data protection, third-party liability and insurance or security’ [12]. Importantly, it was acknowledged that ‘even with the highest safety standards, accidents may happen and victims need to be compensated for any injury or damage’ [13]. This would require ‘that those liable can be easily identified and are able to meet their financial obligations’ [14].

In addition, it was also outlined that the third-party insurance regime that was in place would be in need of amendment on the basis that mass (or total weight) of the aircraft in question determined the minimum level required with respect to insurance. This was set at 500kg, a problematic level, as many RPAS would weigh well below that threshold [15]. With that in mind, there was a need to update the approach in order to accommodate and regulate a rapidly developing and increasingly widespread area of technology.

Subsequently, in the risk-based approach reflected in Regulation 2019/945 and Regulation 2019/947, the EU does not differentiate between leisure and commercial civil drone activities. It has opted to spread the risks by making insurance mandatory for drones heavier than 20kg. National regulations may stipulate that insurance is also mandatory for drones weighing less than this [16]. Neither Regulation 2019/945 nor Regulation 2019/947 provides specific rules on allocating liability in relation to drones.

Registration

Certain UAVs and operators must be registered with the relevant authority. The EU requires Member States to establish a system of registry, to keep track of the drones being operated within their jurisdictions that are subject to certification and ‘operators whose operation may present a risk to safety, security, privacy, and protection of personal data or environment’ [17]. Operators need to register when they operate within the specific category or when they operate, within an open category, a drone ‘with a MTOM of 250 g or more, or, which in the case of an impact can transfer to a human kinetic energy above 80 Joules’ or one that is ‘equipped with a sensor able to capture personal data’ [18]. Operators are exempt from registration for the latter if the drone complies with Directive 2009/48/EC and is considered a toy [19].

While drones or operators of drones in the open category do not have to be registered, operators in the specific category must provide their full name and date of birth (or identification number if the operator is a legal person), address, email address, telephone number, insurance policy number for the UAV if applicable, a declaration of competence, and the operational authorisations, light UAV operator certificates issued, and the confirmation of receipt and completeness for submitting a declaration for ‘an operation complying with a standard scenario’ [20]. The regulations also mandate a registration system for drones ‘whose design is subject to certification’ [21]. The operators must submit the name of the drone manufacturer, the manufacturer designation of the drone, its serial number, and the details and contact information of the person, natural or legal, to which the drone is registered [22].

Data protection

Drones must operate within the confines of the General Data Protection Regulation (‘GDPR’), which came into force in May 2018. As a result, although the main purpose of inspection and maintenance drones is not to collect personal data, compliance with the GDPR is still necessary should data, where a person is identified or identifiable, be captured in the course of its work [23]. However, if the captured data are, for example, power lines or oil rigs, operators need not worry as there are no personal data involved [24]. Care must still be taken to ensure that the drone is not inadvertently capturing personal data on its way or back from inspections, otherwise GDPR obligations would be triggered and the data would need to be secure and regularly deleted [25]. Such data should also not be used for other purposes that are unrelated to the operation of the drone [26]. The DroneRules PRO project, which is EU funded and focuses on privacy issues regarding drones, has published the Privacy Code of Conduct: a practical guide to privacy and data protection requirements for drone operators and pilots, which serves as guidance for compliance with the GDPR by drone operators [27].

Summary of applicable guidance

• The ICAO considers drones to be aircraft and treats them accordingly in its regulatory frameworks.
• EU Regulations 2019/945 and 2019/947 provide rules governing the safe operation of drones in European airspace.
• Under EU Regulation 2019/947, insurance is mandatory for drones heavier than 20kg, whilst national regulations may stipulate that insurance is also mandatory for drones weighing less than this.
• EU Regulation 2019/947 requires Member States to establish a system of registry, to keep track of the drones being operated within their jurisdictions that are subject to certification and ‘operators whose operation may present a risk to safety, security, privacy, and protection of personal data or environment’.
• Inspection and maintenance drones must operate within the confines of the GDPR, and personal data captured by drones are to be processed according to GDPR provisions.

References

[1] Convention Relating to the Regulation of Aerial Navigation (signed on 13 October 1919) art 15.

[2] Convention on International Civil Aviation (signed on 7 December 1944).

[3] ‘The History of ICAO and the Chicago Convention’ (ICAO) <www.icao.int/about-icao/History/Pages/default.aspx> accessed 11 April 2022.

[4] ICAO ‘Unmanned Aircraft Systems (UAS)’ (2011) Cir 328-AN/190, para 2.5-2.6.

[5] Anna Masutti and Filippo Tomasello, International Regulation of Non-Military Drones (Edward Elgar 2018).

[6] Biljana M Cincurak Erceg, ‘Legal Regulation of Unmanned Aircraft Systems in the European Union with Reference to the Legislation of the Republic of Croatia’ (2019) 53 Zbornik Radova 327, 330.

[7] Kristian Bernauw, ‘Drones: The Emerging Era of Unmanned Civil Aviation’ (2016) 66 Collected Papers of Zagreb Law Faculty - Zbornik Pravnog Fakulteta U Zagrebu 223, 234.

[8] The Joint JAA/EUROCONTROL Initiative on UAVs, ‘UAV Task-Force Final Report: A Concept for European Regulations for Civil Unmanned Aerial Vehicles (UAVs)’ (11 May 2004).

[9] Claudia Stöcker et al, ‘Review of the Current State of UAV Regulations’ (2017) 9 Remote Sensing 459, 466.

[10] ‘Riga Declaration on Remotely Piloted Aircraft (drones): “Framing the Future of Aviation”’ (Riga Conference, Riga, March 2015).

[11] Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and on third-country operators of unmanned aircraft systems [2019] OJ L152/1; Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft [2019] OJ L152/45.

[12] European Commission, ‘A new era for aviation: Opening the aviation market to the civil use of remotely piloted aircraft systems in a safe and sustainable manner’ (Communication) COM (2014) 207 final, 5.

[13] European Commission, ‘A new era for aviation: Opening the aviation market to the civil use of remotely piloted aircraft systems in a safe and sustainable manner’ (Communication) COM (2014) 207 final, 8.

[14] European Commission, ‘A new era for aviation: Opening the aviation market to the civil use of remotely piloted aircraft systems in a safe and sustainable manner’ (Communication) COM (2014) 207 final, 8.

[15] European Commission, ‘A new era for aviation: Opening the aviation market to the civil use of remotely piloted aircraft systems in a safe and sustainable manner’ (Communication) COM (2014) 207 final, 8.

[16] Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft [2019] OJ L152/45, art 14(2)(d).

[17] Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft [2019] OJ L152/45, art 14(1).

[18] Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft [2019] OJ L152/45, art 14(5)(a).

[19] Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft [2019] OJ L152/45, art 14(5)(a)(ii).

[20] Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft [2019] OJ L152/45, arts 12(5)(b), 14(2).

[21] Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft [2019] OJ L152/45, art 14(3).

[22] Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft [2019] OJ L152/45, art 14(3)(a)-(d).

[23] DroneRules.euPro, ‘DroneRules PRO: Creating a Privacy Culture among Europe’s UA Professionals’ (DroneRules, 19 April 2018) <dronerules.eu/assets/covers/DroneRules_InfoSheet-vf.pdf> accessed 11 April 2022.

[24] Mahashreveta Choudhary, ‘Eight Points on How GDPR Will Affect Commercial Drone Industry’ (Geospatial World, 21 May 2018) accessed <www.geospatialworld.net/blogs/eight-points-on-how-gdpr-will-affect-commercial-drone-industry/> 11 April 2022.

[25] ‘Nosy Drones? Know the Rules Before You Fly’ (Trilateral Research, 4 April 2019)

<trilateralresearch.co.uk/nosy-drones-know-the-rules-before-you-fly/> accessed 11 April 2022; Grigorios Tsolias, 'Data Protection Risks From The Use of Remotely Piloted Aircraft Systems (RPAS) under Vague Legal and Regulatory Framework' (2016) 2 Eur Data Prot LRev 399, 399-400.

[26] Jordan M Cash, ‘Droning On and On: A Tort Approach to Regulating Hobbyist Drones’ (2016) 46 University of Memphis Law Review 695, 707.

[27] DroneRules.euPro, ‘Privacy Code of Conduct: A practical guide to privacy and data protection requirements for drone operators and pilots’ (DroneRules, 9 November 2018) <dronerules.eu/assets/files/PCC_DR_final-for-printing_9-November-2018.pdf> accessed 11 April 2022.