*4.2. Parallel Application of International and European Union Law on the Protection of Privacy and Personal Data*

Apart from the above mentioned specific legislation on remote sensing technologies, it is important to assess the parallel application of International and European Union Law on the protection of privacy and personal data when using remote sensing technologies.

Protection of privacy on international level is ruled by Article 8 of the European Convention on Human Rights (ECHR): "Everyone has the right to respect for his private and family life, his home and his correspondence". According to Paragraph 2 of the Article 8 ECHR "There shall be no interference by a public authority with the exercise of this right

<sup>13</sup> Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018 on common rules in the field of civil aviation and establishing a European Union Aviation Safety Agency, and amending Regulations (EC) No. 2111/2005, (EC) No. 1008/2008, (EU) No. 996/2010, (EU) No. 376/2014 and Directives 2014/30/EU and 2014/53/EU of the European Parliament and of the Council, and repealing Regulations (EC) No. 552/2004 and (EC) No. 216/2008 of the European Parliament and of the Council and Council Regulation (EEC) No. 3922/91 Preamble para 28.

<sup>14</sup> Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and on third-country operators of unmanned aircraft systems.

<sup>15</sup> Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and procedures for the operation of unmanned aircraft.

<sup>16</sup> In Article 35 GDPR data protection impact assessment is ruled in 11 paragraphs. In particular, it is ruled when and how a data protection impact assessment is conducted in Member States.

except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others". Therefore, the right to private life is not guaranteed in ECHR as an absolute right but it must be balanced against and reconciled with other legitimate interests, either private or public, while any interference with the right to privacy has to comply with the so—called "democracy test" (Mitrou 2009).

On European Union level, Article 16 of the Treaty on the Functioning of the European Union (TFEU) in accordance with Article 8 of the Charter of Fundamental Rights of the European Union, they rule together the protection of personal data. Article 7 of the Charter of Fundamental Rights of the European Union declares respect for private and family life. Furthermore, according to Article 52 (1) of the Charter of Fundamental Rights of the European Union, the principle of proportionality is introduced as a tool for balancing fundamental rights. According to the last Article, limitations on the exercise of the rights and freedoms recognized by the Charter must be necessary and appropriate.

In this sense, a limitation may be necessary if there is a need to adopt measures for the public interest objective pursued. If a limitation is proven to be strictly necessary, there must be also be assessed whether it is proportionate. Proportionality means that the advantages resulting from the limitation should outweigh the disadvantages the latter causes on the exercise of the fundamental rights at stake. To reduce disadvantages and risks to the enjoyment of the rights to privacy and data protection, it is important that limitations contain appropriate safeguards<sup>17</sup> .

Furthermore, Union Law contains since very early specialized legislation on the protection of personal data. The current basic legislative acts for the protection of personal data in the EU is GDPR<sup>18</sup> on one hand, and Police and Criminal Justice Authorities Directive<sup>19</sup> on the other hand.

GDPR' s territorial scope according to Article 3 par. 2 b covers the processing of data (which includes collection) both from satellites and drones, as long as they collect or process data of EU residents, even if they collect or process such data from satellites under the jurisdiction and control of a non-EU country provided that processing activities are related to the monitoring of the behavior of EU residents as far as their behavior takes place within the Union. Police and Criminal Justice Authorities Directive applies to the processing of personal data by competent authorities of member states for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. It also covers collected data both from satellites and drones, as long they are processed by competent authorities of member states.

Following the above mentioned legislation, and especially Article 52 (1) of the Charter and Article 8 (2) ECHR any limitation to the exercise of rights and freedoms recognized by the Charter must be provided for by law ("in accordance with the law"), made only if it is necessary and genuinely meets objective of general interest recognized by the Union or the need to protect the rights and freedoms of others ("in pursuit of one of the legitimate aims set out in Article 8 (2) of the ECHR and necessary in a democratic society")<sup>20</sup> .

As a result, the police and other environmental authorities when using remote sensing technologies should first assure themselves that they have a valid legal basis for processing personal data. This also stems directly from Article 8 of Police and Criminal Justice

<sup>17</sup> Handbook on European data protection law. 2018. Available online: https://fra.europa.eu/en/publication/2018/handbook-european-dataprotection-law-2018-edition (accessed on 5 April 2021).

<sup>18</sup> Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

<sup>19</sup> Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

<sup>20</sup> See also: Opinion 01/2015 on Privacy and Data Protection Issues relating to the Utilization of Drones. Available on line: https://ec.europa.eu/ newsroom/article29/item-detail.cfm?item\_id=640602 (accessed on 5 April 2021).

Authorities Directive as well as from Article 6 of GDPR. In this point, it is important to underline that Police and Criminal Justice Authorities Directive and GDPR supplement each other as they operate in different sectors but cooperate in the areas where they overlap (Pajunoja 2017). CJEU case law also identifies this relation between Police and Criminal Justice Authorities Directive and GDPR21. Therefore, police and the Criminal Justice Authorities Directive are applied when limitations to rights are imposed by the State for personal data collected directly by competent authorities only in order to serve their work (duty) for the prevention, investigation, detection or prosecution of environmental criminal offences. In cases when data are collected by third parties (private entities etc.) for other reasons but it happens them to be necessary also for the purposes of the prevention, investigation, detection or prosecution of environmental criminal offences, Article 23d of GDPR is applicable. Finally, Article 6e of GDPR is applicable, when administrative official authorities, such as forest services, environmental departments, environmental inspectors etc., that are authorized to protect the environment and impose administrative sanctions for law infringements, may according to a certain legal basis process personal data, for example inspect protected areas with drones.

Police and other environmental authorities when using remote sensing technologies should afterwards follow all principles stemming from Article 4 of Police and Criminal Justice Authorities Directive either from Article 5 of GDPR, namely their actions should comply with the principles of lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality (security), and accountability. This means that data subjects must be aware of the collection and processing of their personal data and therefore data controllers have the obligation to inform them according to the relevant Articles of Police and Criminal Justice Authorities Directive or of GDPR. Especially for drones, signposts or information sheets for an event could be easily used for drone operations in fixed locations, also social media, public display areas, flashing lights, buzzers and bright colors could be envisaged. Drone operators could also publish information on their website or on dedicated platforms in order to inform constantly about the different operations that take place22. In addition, remote sensing technologies shall be used from police and other environmental authorities when the necessity and appropriateness for the specific purposes is justified. A strict assessment of the necessity and proportionality of the processed data should take place.

Furthermore, data controllers and processors, where applicable, must implement the appropriate technical and organizational measures to protect personal data from accidental or unlawful destruction according to the security principle (Article 29 of Police and Criminal Justice Authorities Directive or Article 32 of GDPR). Finally, it seems that a data protection impact assessment of Article 35 of GDPR is necessary (only when GDPR is applicable because such an impact assessment is not included in Police and Criminal Justice Authorities Directive), since remote sensing technologies, especially the use of drones, in the environmental law enforcement sector are likely to result in a high risk to the rights and freedoms of natural persons as stated above. Simultaneously, decisions that produce legal effects concerning the natural person, such as imposition of environmental administrative fines, can be based on processed remote sensing data, making a data protection impact assessment in these cases absolutely essential.
