Drone Footage Subject Access Requests in the UK

What Is a Subject Access Request?

A subject access request is the exercise of a data subject's right under Article 15 of the UK GDPR to obtain confirmation of whether their personal data is being processed and, if so, to receive a copy of that data along with supplementary information about the processing.

For drone operators, this right has practical implications that many do not anticipate. If your drone captures footage that includes identifiable individuals, each of those individuals has the right to request the footage in which they appear. This applies whether you are a commercial operator, a hobbyist, or a public authority.

Subject access requests do not need to be made in any particular form. They can be submitted verbally, by email, by letter, or through any other channel. The individual does not need to mention the UK GDPR, Article 15, or the phrase "subject access request" for their request to be valid. Any clear request for their own personal data triggers the obligation.

The 30-Day Response Deadline

Article 12(3) of the UK GDPR requires you to respond to a subject access request without undue delay and in any event within one calendar month of receiving the request. This period begins on the day after you receive the request, regardless of weekends or bank holidays, unless the final day falls on a weekend or public holiday, in which case the deadline extends to the next working day.

In complex cases or where you have received a large number of requests, you may extend the response period by a further two months. However, you must inform the individual of this extension within the initial 30-day period, explaining why the extension is necessary. For most drone footage requests, the standard 30-day deadline should be sufficient.

Failure to respond within the deadline is itself a breach of the UK GDPR, regardless of whether you ultimately provide the data. The ICO can take enforcement action for late responses, and the individual can lodge a complaint or pursue a claim in the courts.

The Cost: Free of Charge, With Exceptions

Under Article 12(5) of the UK GDPR, subject access requests are free of charge. You cannot charge the individual for searching through your footage, for the time spent identifying them, or for providing a copy of the data.

There are two narrow exceptions where you may charge a reasonable fee or refuse the request entirely:

• Manifestly unfounded requests: Where the individual clearly has no genuine interest in exercising their rights and is making the request to cause disruption or for purposes unrelated to data protection
• Excessive requests: Where the same individual makes repeated requests for the same data within a short period. Even here, the ICO expects controllers to consider whether the data has changed since the last request before concluding that a repeat request is excessive

The burden of demonstrating that a request is manifestly unfounded or excessive falls on the data controller. The ICO applies a high threshold, and refusing a valid request exposes you to enforcement action.

How to Handle a SAR for Drone Footage

Processing a subject access request for drone footage involves several practical steps that differ from handling SARs for text-based records.

Step 1: Verify the Identity of the Requester

Before disclosing any footage, you must verify that the person making the request is the individual who appears in the footage. Under Article 12(6), where you have reasonable doubts about the identity of the requester, you may request additional information to confirm their identity.

For drone footage, verification might involve the individual providing information about where and when they were present, what they were wearing, or a recent photograph for comparison. The level of verification should be proportionate. Do not request excessive personal data simply to verify identity.

Step 2: Locate the Relevant Footage

You must make reasonable efforts to search your footage for the individual. This requires maintaining organised records of when and where your drone flights took place. If the individual provides a specific date, time, and location, your search can be targeted. If they provide only vague information, you should search the footage you reasonably hold that could contain their image.

Good record-keeping practices, such as logging each flight with date, time, location, and footage file references, make this process significantly more manageable.

Step 3: Redact Third-Party Data

This is where drone footage SARs become particularly challenging. Your footage is unlikely to contain only the requester. Other individuals, vehicle registration plates, and identifiable property will also appear. You cannot disclose this third-party data without either obtaining consent from those third parties or determining that it is reasonable in all circumstances to disclose the data without consent.

In practice, this means you will need to redact or blur other identifiable individuals in the footage before providing it to the requester. Video editing software with face-blurring capabilities is essential for any operator who retains footage of public spaces.

Section 45 of the Data Protection Act 2018 confirms that you are not obliged to comply with a request if doing so would involve disclosing information relating to another individual who can be identified from that information, unless that other individual has consented or it is reasonable in all the circumstances to comply without consent.

Step 4: Provide the Footage in an Accessible Format

Article 15(3) requires that where the request is made by electronic means, the information be provided in a commonly used electronic format unless the individual requests otherwise. For drone footage, this typically means providing video files in a standard format such as MP4.

You must also provide supplementary information as required by Article 15(1), including:

• The purposes of the processing
• The categories of personal data concerned
• The recipients or categories of recipients to whom the data has been or will be disclosed
• The envisaged retention period
• The existence of the right to request rectification, erasure, or restriction of processing
• The right to lodge a complaint with the ICO
• Where the data was not collected from the individual directly, information about its source

Exemptions: When You Can Withhold Footage

The UK GDPR and DPA 2018 provide certain exemptions from the right of subject access, though they are narrower than many operators assume.

• Third-party data: As noted above, you may withhold footage if providing it would necessarily reveal another person's identity and it is not reasonable to disclose without their consent
• Legal privilege: Footage held for the purpose of obtaining legal advice or in connection with legal proceedings may be exempt under Schedule 2, Part 2 of the DPA 2018
• Crime prevention and detection: If providing the footage would prejudice the prevention or detection of crime, an exemption under Schedule 2, Part 1, paragraph 2 may apply
• Regulatory functions: Where disclosure would prejudice a regulatory function, Schedule 2, Part 1, paragraph 3 provides an exemption

Exemptions must be applied on a case-by-case basis. You cannot adopt a blanket policy of refusing all SARs on the basis of a general exemption. Each request must be assessed individually, and you should document your reasoning if you rely on an exemption.

Common Misconceptions

Misconception: I can ignore SARs if I am a small operator. The UK GDPR applies regardless of the size of your organisation. A sole trader with one drone has the same obligations as a large corporation. The only exception is the domestic purposes exemption, which applies to purely personal and household activities and does not extend to footage shared publicly or processed for any external purpose.

Misconception: If I delete the footage, I do not need to respond. If you no longer hold the footage because it has been deleted in accordance with your retention policy before the request was received, you must still respond to the request. Your response should confirm that you no longer hold the data and explain your retention policy. However, if you delete footage after receiving a request to avoid compliance, this may constitute an offence under section 173 of the Data Protection Act 2018.

Misconception: I can charge for the work involved. The default position is that SARs are free. You may only charge a reasonable fee if the request is manifestly unfounded or excessive, and you bear the burden of proving this.

Preparing Your Operation for SARs

1. Maintain a flight log that records the date, time, location, and duration of every flight where footage is captured
2. Implement a clear data retention policy and apply it consistently, deleting footage when it is no longer needed
3. Invest in video editing software capable of face-blurring and redaction
4. Establish a standard procedure for receiving, verifying, searching, and responding to SARs
5. Include your contact details on your website and in any privacy notices so individuals know how to make a request
6. Train any staff who handle footage on how to recognise and escalate a subject access request
7. Document every SAR received, your search efforts, and your response, even if the outcome is that no data was found