Security, Privacy and Insurance – LBA – OpenUAV (2024)

Security and safety are important issues in aviation and are present at all times. Numerous incidents in recent years have made it clear that remote pilots must be aware of the safety risks of unmanned aircraft.

First of all, it is important to distinguish between the two terms:

Security means protection against deliberate interferences, for example:

• Terrorism
• Intentional offences
• Misuse of UAS for criminal purposes.

Safety, on the other hand, means protection against accidental and unwanted sources of danger, for example:

• Engine failure
• Loss of orientation
• Control failure
• Failure of the energy source.

Sometimes remote pilots are completely unaware that they pose a threat to others. At the same time, unmanned aircraft can also get used specifically for criminal purposes.

To ensure the safety of all affected persons, as a remote pilot you should ask yourself the following questions before every flight::

• Am I flying for a legal, permissible purpose?
• Will I endanger anyone with my flight, including other pilots?
• Is it possible for me to invade the privacy of others through my flight?
• Is it possible for me to interfere with the work of the authorities, police or rescue services through my flight?

Crimes involving unmanned aircraft will be judged according to the criminal laws of the states in which they take place.

Taking part in criminal offences, stalking, endangering aviation or similar acts are punishable in all European countries. These punishments range from fines to several years in prison, depending on the level of injustice and harm.

The registration of UAS operators, as well as technical barriers such as geo-fencing or geo-awareness systems, helps to minimise the risks associated with UAS operation. Nonetheless, ultimately it is always the responsibility of the remote pilot whether an unmanned aircraft is used for a legitimate or illegal purpose.

Due to numerous negative reports, the public is sensitive when it comes to flights by unmanned aircraft. When people see a UAS over their heads, they often feel scared or intimidated.

Remote pilots can actively help to reduce these fears and reservations:

• Actively inform people that you are flying and why you are flying at that location.
• Notify other remote pilots if you discover rule violations.
• Report any misuse of UAS to the competent authorities.

An important point that should go without saying: it is forbidden to fly with a UAS into or approach areas in which an emergency response is taking place – unless the responsible emergency service has given explicit permission.

While curiosity or journalistic work may often be a personal reason to use an unmanned aircraft to get the best footage of an accident, fire, police operation or other such occurrence, it is always important to remember that the police, fire brigade, rescue workers or other organisations could also be operating UAS (e.g., to determine the extent of a disaster in order to localise the source of fire, etc.). These services must be sure that they are the only UAS operator in the respective area in order for them to help effectively.

The right of data protection is a fundamental right that every citizen in the EU has. Data protection is mainly regulated in the EU General Data Protection Regulation (GDPR) and applies to everyone in the European Union as well as to companies that do business with Euro­pean companies. Individual countries may have made additional regulations on this subject at national level.

Unmanned aircraft offer many new ways to collect data but also to break into the privacy of others or to misuse data.

Some states use UAS for surveillance purposes, for warfare or other comparable purposes. It is easy to attach sensors, cameras or payloads to unmanned aircraft; thus they provide a platform that can easily be abused or used for criminal purposes.

For this reason, the UAS operator must always register whether the UAS is equipped with sensors that can record personal data.

Such sensors are, for example:

• Video cameras
• Photo cameras
• Microphones
• Infrared cameras
• Thermal imaging cameras.

Data protection only affects “personal data”, i.e., only a small part of all available information. This is all information that relates to an identified or identifiable natural person.

A natural person is regarded as identifiable by means of features such as name, an identification number, location data, an online identifier and one or more special features.

This also includes data that expresses a physical, physiological, genetic, economic, cultural or social identity of this natural person.

This means that all video, audio and image recordings that show people are, in principle, covered and protected by data protection laws.

There are some basic principles for handling personal data:

• It must be handled transparently: the data subjects must at least be informed or be aware that their data is being processed (e.g., that they are being photographed, filmed or recorded).
• The principle of “data saving” applies whenever possible: no personal data should be processed or recorded.

The processing of personal data is permitted in accordance with the GDPR if at least one of the following reasons applies:

• The person concerned has agreed.
• There is necessary processing to fulfil a contract with the data subject.
• There is necessary processing to comply with a legal regulation.
• There is necessary processing to protect vital interests.
• There is necessary processing for carrying out a public task.
• There is necessary processing to safeguard the legitimate interests of the processor or a third party.

Filming, taking photos or making sound recordings is prohibited if:

• it trespasses into the privacy of others,
• the recordings are used for face recognition or other automated processes,
• the recordings contain references to specially protected personal data,
• the person(s) concerned has/have withdrawn their consent. The withdrawal of consent can, for example, also happen after a photo has already been taken; this must then be deleted immediately.

In any case, as a remote pilot, you must carefully consider which overflights and which shots are really necessary. When in doubt, play it safe and fully respect other people’s privacy.

The operation of aircraft – whether manned or unmanned – always involves risks. If there are accidents or incidents, the question of liability always arises::

• Who caused the accident?
• Who pays for the damage caused?

In the event of an accident with an unmanned aircraft, the UAS operator or the remote pilot is usually liable for the damage incurred. This can be very expensive, especially in the case of personal injury.

Most states, therefore, require UAS operators to obtain indemnity insurance, which also covers damage caused by the unmanned aircraft. Such insurance usually covers the damage:

• of third parties (other people and their things) on the ground
• that affects other aircraft (manned or unmanned).

Damages that affect the insured persons themselves are not covered.

Caution is advised with existing indemnity insurance; this often does not cover the damage caused by an unmanned aircraft. In any case, this must be clarified with the insurance company before the UAS is operated and, if necessary, additional insurance must be concluded.

The insurance provisions can be found in national regulations: make yourself familiar with the insurance regulations of the country in which you specifically want to fly your UAS. Many insurance policies cover flights in several or all European countries; therefore, it is usually worth taking a look at the insurance policy.

In any case, it should be noted that insurance companies usually only cover damage that has occurred in compliance with all regulations. If you operate the unmanned aircraft outside the line of sight (BVLOS), for example, existing insurance will not be effective.

For the operation of unmanned aircraft, the same insurance regulations apply in Austria as for the operation of manned aircraft. For a maximum take-off mass (MTOM) of less than 500 kg, you must have valid liability insurance for at least 750,000 SDR. SDR stands for “special drawing right” and is a fictitious currency that is used internationally in insurance.

In Germany, too, the conclusion of a liability insurance policy is mandatory on the basis of §43 LuftVG before a UAS may be operated (cf. also §1 LuftVG and §102 LuftVZO). For the operation of aircraft with a maximum take-off mass of less than 500 kg, a valid liability insurance policy must also be in place in the amount of at least 750,000 units of account (cf. §37 LuftVG). Proof of existing insurance must also be carried by the remote pilot during operation in accordance with §106 LuftVZO.