Drone Rules 2021: Flying High Is Welcome But Spare A Thought For Privacy

With the recent terror attacks in Jammu, where a drone was used to drop explosives at an air base, drone technology becomes a critical area of interest. Over the years, usage of drones in civilian and commercial spheres has increased manifold. India has chosen to embrace the new technology as a key driver of commerce, law and order, employment generation and development related activities. The new rules espouse ease of doing business, drone research and development, simpler registration process and digital platforms. However, it is imperative to balance drone technology with privacy rights of citizens. This article aims to weigh the new drone rules on the scales of privacy and data protection.

Proposed Framework As Per Drone Rules, 2021

Based on weight, the drones have been classified into different categories such as nano, micro, small, medium and large. A Digital Sky Platform is envisaged under the Ministry of Civil Aviation for activities related to drone management in the country. The central government shall further notify safety features to be installed in a drone, which may include 'No Permission – No Take off' (NPNT) hardware, real – time tracking beacon, geo – fencing capability. Further, no person shall fly a drone without a unique identification number. The Rules propose dividing the airspace of India into three zones for drone operations: Green zone, Yellow zone and Red zone, which prescribe varying degrees of restrictions on the operation of drones.

Law Enforcement And Drone Usage In India

Over the past few years, law enforcement agencies have been relying on drones for maintaining law and order. Delhi police used drones for monitoring activities during anti – CAA and farmers' protests. It also admitted to hiring drones from open market during state assembly elections and riots in north- east district. Mumbai police deployed drones to monitor crowded areas like Dharavi. In Kerala and Punjab, police used drones during lockdown to identify those who violated the protocols, with former even relying on private citizens to operate third party drones.

In April, 2021, a conditional exemption from UAS (Rules), 2021 was granted to government agencies under the Ministry of Home Affairs and for police forces of all states/UTs (Ministry of Civil Aviation 2021). Broad exemptions have been regularly given to law enforcement agencies for conducting surveillance.

Eye In The Sky: The Privacy Question

Though new technologies offer endless potential for growth, yet there is always a concern regarding protection of privacy and user data. Modern drones come equipped with capabilities of automated facial recognition, high resolution cameras, heat – motion sensors and large storage capacity. While drone technology is unique in application, an individual has no control over eye in the sky hovering above.

Unmanned Aircraft Systems Rules (UAS Rules), 2021 while mentioning the role and responsibilities of an operator, also mentioned that drones should fly "ensuring the privacy of a person and its property during operation" (Rule 35). Similarly, Schedule VI (Rule 29) put the onus of protecting individual privacy and his property on the drone operator.

The present Drone Rules, 2021 replaced the UAS (Rules), 2021 to ease drone usage in India. However, absent in these rules is a mechanism for citizens' privacy and protection of data collected by the drones. To put it bluntly, the new rules do not even mention the word 'privacy' in the entire draft. It, therefore, begs the question whether a rhetorical premise of mere "trust, self- certification and non-intrusive monitoring" will be sufficient to ensure privacy and data protection of citizens, without mandated privacy safeguards or an overarching law on data protection?

As per Section 23 of the Rules, "All State Governments, Union Territories administration and law enforcement agencies shall be provided direct access to the data available on digital sky platform."

Section 32 further provides a blanket exemption by stating, "Central Government may, by a general or special order in writing, exempt any person or class of persons from the operation of these rules, either wholly or partially, subject to such conditions, as may be specified in that order."

Puttuswamy and Personal Data Protection Bill, 2019

In 2017, the Supreme Court, in a landmark nine judge bench judgement 'Justice K.S. Puttuswamy(Retd) vs Union of India & Ors', recognised privacy as an intrinsic part of right to life and personal liberty under Article 21 and as part of freedoms guaranteed by Part III of the Constitution. While elaborating on various facets of privacy and fundamental rights, the Court laid down various tests that should be applied to privacy infringement. It was laid down that test of 'reasonableness' should be applied to violation of privacy in the context of arbitrary state action. Similarly, privacy invasions into Article 19 and 21 shall have to be 'just, fair and reasonable'. Further, some privacy claims deserve the 'highest standard of scrutiny' and can be justified only in a case of 'compelling state interest'. The court also propounded that invasion of life and liberty should meet the standards of 'legality', 'necessity', 'legitimate aim' and 'proportionality'.

The Personal Data Protection Bill, 2019 was introduced to protect personal data as an essential facet of informational privacy, while recognising the right to privacy as a fundamental right. The Bill lays down obligations of data fiduciary, subjecting personal data processing to certain purpose, collection and storage limitations. It furthers makes consent of an individual necessary at the commencement of data protection. It is, however, difficult to fathom the manner of obtaining consent of every individual in a crowd or a procession – with a drone hovering above.

Section 35 of the draft bill gives central government wide powers to exempt government agencies from provisions of the bill, if deemed necessary, on grounds of public order, sovereignty and state security. The reasons are to be recorded in writing, subject to procedures, safeguards and oversight mechanisms applicable to the exempted agency.

The Personal Data Protection Bill, 2019 has been pending scrutiny, for more than a year, before a Joint Parliamentary Committee (JPC) and is likely to submit its report only during current the Winter Session of Parliament. It is hoped that certain provisions are re-drafted to address loopholes and sweeping exemptions in the current draft, and tighter privacy safeguarding mechanisms are re-inforced.

Looking at the Drone Rules, 2021 it is apparent that there is a clear absence of additional safeguards around drone data collected and processed by law enforcement agencies. Government can potentially use drones for mass surveillance exercises without offering adequate privacy protection to citizens. The Rules do not adhere to the various principles enunciated in Puttuswamy judgement. They are certainly not in consonance with the privacy provisions of the Data Protection Bill, except the exemptions to government agencies. The Rules do not have a saving clause or any specific provision which places them within the domain of larger Data Protection Bill.

Going Forward: Global Drone Hub Or Orwellian State?

Covid -19 pandemic has shown that civilian use of drone technology can be a game changer when it comes to handling a crisis of this magnitude. During lockdown, drones were used for spraying disinfectants over public places. Drones have been effective in monitoring railways tracks, highway patrolling and traffic management in large cities. In some areas, drones are being deployed for spraying pesticides over crops. Experimental studies are being conducted to deliver medicines and vaccines via drones in remote rural and tribal parts of the country. During these times, drone technology can be a successful example of cooperative federalism, as health is a state subject.

Drones can be significant creators of employment and economic growth due to their reach, versatility, and ease of use, especially in India's remote and inaccessible areas. In view of its traditional strengths in innovation, information technology, frugal engineering and huge domestic demand, India has the potential to be a global drone hub by 2030.

Privacy, being a fundamental right, is paramount. Wide exemptions in the Drone Rules, 2021, combined with an absence of specific privacy safeguard mechanism would constitute a threat to privacy. Government agencies should be specifically brought within the definition of 'significant data fiduciary', under the Personal Data Protection Bill, 2019. Privacy tests laid down by the Supreme Court in Puttuswamy must be adhered to. Further, Drone Rules should have laid down a transparent process for hiring and procurement of drones from third parties.

The onus is on our law makers to ensure that India does not end up becoming an 'Orwellian state', where citizens are under constant surveillance by the authorities and are repeatedly reminded of this by the slogan "Big Brother is watching you."

Parikshit Goyal is a practising advocate, views are personal.