CCTV vs Drone Surveillance in the UK

Two Technologies, Two Regulatory Paths

Surveillance cameras and drones both capture images and video in public and private spaces. However, UK law treats them through overlapping but distinct frameworks. Understanding where these frameworks diverge is essential for anyone operating a drone equipped with a camera, whether for commercial or recreational purposes.

CCTV has been part of British life for decades. The UK has one of the highest densities of surveillance cameras in the world. The legal framework surrounding CCTV is relatively mature, anchored by the Protection of Freedoms Act 2012 and the Surveillance Camera Code of Practice issued under section 29 of that Act. This code sets out 12 guiding principles for the appropriate use of surveillance camera systems by relevant authorities.

Drones, by contrast, are newer entrants to the surveillance landscape. While the same underlying data protection legislation applies, drones introduce unique challenges: they are mobile, can operate at altitude, and can access vantage points that fixed CCTV cameras cannot. This mobility is precisely what makes drone surveillance a more complex privacy question.

The Shared Legal Foundation: UK GDPR and DPA 2018

Both CCTV and drone footage fall within the scope of the UK General Data Protection Regulation and the Data Protection Act 2018 whenever the footage captures identifiable individuals. Under these laws, capturing images of people constitutes processing personal data, and the operator becomes a data controller with corresponding obligations.

Key obligations that apply equally to both technologies include:

• Having a lawful basis for processing under Article 6 of the UK GDPR, most commonly legitimate interests for security purposes
• Providing transparency about data collection through privacy notices
• Limiting data retention to what is necessary
• Ensuring appropriate security of the footage
• Responding to subject access requests under Article 15
• Conducting a Data Protection Impact Assessment where processing is likely to result in high risk to individuals

Where CCTV and Drone Rules Diverge

Signage and Notice Requirements

CCTV operators are expected to display clear signage informing the public that surveillance is taking place. The ICO guidance on CCTV specifically recommends that signs include the name and contact details of the data controller. This is a well-established practice and a practical means of meeting transparency obligations.

Drone operators have no equivalent signage mechanism. A drone flying overhead cannot carry a visible notice. This means drone operators must find alternative ways to meet their transparency obligations, such as publishing privacy notices online, distributing leaflets in the area of operation, or posting notices at entry points to the surveyed area.

The Surveillance Camera Code

The Surveillance Camera Code of Practice applies to relevant authorities as defined in section 33 of the Protection of Freedoms Act 2012, including local authorities and police forces. Private CCTV operators are encouraged, but not legally required, to follow the code.

The Biometrics and Surveillance Camera Commissioner oversees compliance. Drones operated by public authorities for surveillance purposes would fall within the scope of this code. Private drone operators, while not bound by the code, should be aware that the ICO may reference its principles when assessing complaints.

The Proportionality Test

Both CCTV and drone surveillance must pass a proportionality test: whether the surveillance is proportionate to the aim pursued. However, drones face a higher threshold in practice. A fixed CCTV camera monitoring the entrance to a business premises is generally considered proportionate. A drone hovering over residential gardens to achieve the same aim would likely be considered disproportionate, given the greater level of intrusion.

The ICO has consistently emphasised that the intrusiveness of the technology is a factor in assessing proportionality. Drones, by their nature, are capable of capturing footage in places where people have a reasonable expectation of privacy, such as rear gardens, upper-floor windows, and secluded areas.

Airspace Regulation Adds a Layer

Drone operators face an additional regulatory layer that CCTV operators do not: aviation law. The Air Navigation Order 2016 and the CAA drone regulations impose restrictions on where and how drones can fly. Article 241 prohibits reckless or negligent use of aircraft in a manner likely to endanger persons or property. Article 94A onwards sets out specific restrictions on small unmanned aircraft, including distance requirements from people, buildings, and controlled airspace.

These aviation rules operate independently of data protection law. A drone flight that is legally compliant from an aviation perspective may still breach data protection requirements, and vice versa. Operators must satisfy both sets of rules simultaneously.

Local Authority vs Private Operator Distinctions

When a local authority operates CCTV, it must comply with the Surveillance Camera Code, maintain a register of camera locations, and appoint a designated officer. When a private individual operates a home CCTV system, the domestic purposes exemption under section 2 of the DPA 2018 may apply, provided the cameras only cover the individual's own property.

No equivalent domestic exemption exists for drones in a practical sense. Even recreational drone flights with cameras are likely to capture footage beyond the operator's own property, bringing the flights within the scope of data protection law. The ICO has confirmed that the domestic purposes exemption is interpreted narrowly and does not extend to surveillance that captures images of neighbours, passers-by, or adjacent properties.

Enforcement and Complaints

The ICO handles complaints about both CCTV and drone surveillance. However, drone complaints often involve additional regulatory bodies. The CAA may investigate if the drone was flown in breach of aviation rules. The police may become involved if the drone operation constitutes harassment under the Protection from Harassment Act 1997, or if it amounts to voyeurism under section 67A of the Sexual Offences Act 2003.

Penalties under the UK GDPR can reach up to 17.5 million GBP or 4 percent of annual global turnover, whichever is higher. CAA enforcement can result in fines and criminal prosecution. The overlapping jurisdiction means that a single act of drone surveillance could trigger multiple investigations and sanctions.

Practical Compliance Steps for Drone Operators

If you operate a drone with a camera in the UK, consider the following steps to manage your privacy obligations:

1. Conduct a Data Protection Impact Assessment before beginning any systematic surveillance from a drone
2. Establish a lawful basis for processing, typically a legitimate interests assessment under Article 6(1)(f) of the UK GDPR
3. Publish a privacy notice that explains what footage you capture, why, how long you retain it, and how individuals can exercise their rights
4. Minimise data capture by avoiding areas where individuals have a reasonable expectation of privacy
5. Set clear retention periods and delete footage that is no longer needed
6. Secure your footage with encryption and access controls
7. Be prepared to respond to subject access requests within 30 calendar days

The Bottom Line

CCTV and drone surveillance share a common data protection foundation, but drones face additional scrutiny due to their mobility, altitude capability, and the absence of equivalent signage conventions. Drone operators should not assume that the rules governing CCTV automatically translate to their operations. The higher intrusion potential of drones demands a more rigorous approach to privacy compliance, proportionality assessment, and transparency.