How White House Privacy Rules Will Impact Commercial Use of UAVs

There has been a great deal written recently about the Federal Aviation Administration’s (FAA) release of proposed regulation concerning the commercial use of Unmanned Aviation Vehicles (UAVs) – or drones. (An informative discussion of the proposed regulations can be found here.)  Much of what has been written has quite accurately pointed out that the proposed regulations are much more progressive than many had feared and could be the precursor of a budding commercial UAV industry in the United States. For example, under the proposed regulations an individual will not have to be a certified pilot to operate a UAV for commercial purposes. In addition, the ceiling for small UAV operations has been extended to 500 feet; previously the FAA has limited operations to 400 feet and below.  However, the proposed regulations are subject to change after a public comment period and likely will not become final until 2017.

Unfortunately, there has been much less attention paid to a memo released by the White House in conjunction with the proposed regulations. The document, titled “The Presidential Memorandum:Promoting Economic Competitiveness While Safeguarding Privacy, Civil Rights,and Civil Liberties in Domestic Use of Unmanned Aircraft Systems” (the “Memo”) will constrain the ability of federal agencies to use data that is collected from UAVs. In addition, the Memo may portend future limitations for commercial use.

For example, the Memo states that data collected from UAVs that “may" contain Personally Identifiable Information (PII) must be deleted after 180 days unless (i) necessary to an “authorized mission”, (ii) maintained in a system of records or (iii) required by law to be maintained longer. Six months is not much time to process, analyze and distribute data, particularly for a federal agency. Moreover, since the requirements associated with a “system of records” under the Privacy Act can be onerous and that there are few existing laws that pertain directly to the storage of UAV data, government agencies will likely struggle with trying to determine constitutes an “authorized mission.”

Similarly, the Memo provides that if data collected from a UAV is not stored in a “system of records” it may not be disseminated outside of an agency unless (i) required by law or (ii) it fulfills an “authorized purpose" and complies with agency requirements. This restriction will likely make it more difficult for federal agencies to share data with other federal agencies or with their state counterparts. As a result, federal agencies will find it difficult to use UAV data for important applications, such as disaster response, or to comply with stated federal objectives to readily share data with other agencies. 

Moreover, the Memo requires federal agencies to provide proper oversight for individuals who have access to “sensitive data”, including PII. This requirement could prove burdensome, given the ambiguity associated with what constitutes “sensitive data” and the changing nature of what constitutes PII. In addition, agencies must adopt rules of conduct for both federal government personnel and contractors as well as introduce procedures for misuse of such data.

The Memo will also have an impact on commercial enterprises that wish to use UAVs. The federal government should be a major consumer of UAV data.  Unfortunately some federal agencies may be unwilling to take advantage of the many potential benefits associated with UAVs due to the requirements imposed by the Memo, since data collected from sensors on other platforms (such as manned aircraft) are not subject to the same requirements. In addition, the Memo highlights the Obama Administration’s likely approach in the upcoming multi-stakeholder process to address concerns associated with commercial use of UAVs. For example, by specifically citing civil liberties and civil rights, the Administration is suggesting that its concerns go well beyond privacy. In addition, by requiring federal agencies to protect data that “might” contain PII or that is “sensitive”, the Obama Administration is suggesting that existing privacy constructs are not sufficient. This approach would be consistent with the conclusions of the White House Big Data report released by the President’s Council of Advisors on Science and Technology last May. The report highlighted the privacy challenges associated with rapid adoption of sensors that can collect a variety of data types.

As a result, while the FAA’s proposed regulations are a big step forward in the commercial adoption of UAVs, there are still significant hurdles that commercial operators will need to overcome. The ability of UAVs to collect high quality data in a timely manner for a reasonable price is one of the many benefits associated with this technology. However, as the Memo indicates, it will also be one of the challenges that industry will face.