The sUAS Guide 2016 Q3 Update | Page 24

governs the collection, use and disclosure of personal information. The Privacy Act requires an ‘agency’ to comply with a set of 12 broad ‘information privacy principles’. An agency is ‘any person or body of persons, whether corporate or unincorporate, and whether in the public sector or the private sector’,5 and thus includes a drone operator, whether that operator is an individual flying recreationally or a company utilising a drone for commercial operations.

While the information privacy principles of the act do not directly create a legal right enforceable in a court of law,6 section 66 creates a civil wrong of ‘interference with privacy’. Interference with privacy requires that the action in question breaches an information privacy principle (or one of four other specified breaches)7 and in the opinion of the privacy commissioner or the Human Rights Review Tribunal has caused or may cause some harm to the individual. An action in the tribunal may be at the suit of either the director of human rights proceedings (Privacy Act 1993, section 82) or the aggrieved party (section 83), and may be appealed to the High Court.8 The aggrieved party may only bring suit after the Office of the Privacy Commissioner has investigated the complaint, and the scope of the tribunal’s hearing is restricted to the issues investigated by the privacy commissioner. In both New Zealand and the United Kingdom unmanned aerial systems are considered to be a form of closed circuit television (CCTV) and subject to the same privacy regulation as CCTV (Mabbett, 2015; Information Commissioner’s Office, 2015). In Armfield v Naughton [2014] NZHRRT 48, the tribunal considered issues related to a CCTV system that in part surveilled the front yard of a neighbouring property. Naughton had set up a number of CCTV security cameras around his house, one of which had an unobstructed view of Armfield’s lawn and of the swing used by Armfield’s children. The tribunal held that the camera recording part of the front yard collected personal information in a way that intruded to an unreasonable extent on the personal affairs of the people living at Armfield’s property. Whether the surveillance was ‘highly offensive’ as required by the privacy torts was not considered by the tribunal as its jurisdiction is limited to the Privacy Act.

Armfield v Naughton confirmed previous decisions that ‘injury to feelings’ includes negative feelings such as anxiety, stress, fear and anger; that is, all of the feelings associated with unwelcome surveillance. Damages were awarded for ‘humiliation, loss of dignity, and injury to the feelings of the aggrieved individual’. A benchmark of $15,000 in damages was noted by the tribunal, although a lesser amount was awarded effectively at the request of the plaintiff.

Personal information is defined in the Privacy Act as ‘information about an identifiable individual’. Whether an individual can be clearly identified from drone imagery depends on the quality of the camera on board the drone and the distance between the drone and the person. A person on the ground is unable to determine whether photography is occurring, or whether they can be identified from any imagery. Furthermore, when the address at which imagery is taken is known, it may be possible to identify the individual from certain characteristics such as build and hair colour. Thus, even when the imagery is at a relatively low resolution, it is reasonable to assume that personal information is being gathered.

We can therefore conclude that (1) a drone that flies in the vicinity of a property and takes photos of that property is potentially collecting personal information; and (2) a person who is in some way upset, anxious or angry about such an action has suffered an ‘injury to feelings’. Having satisfied the second limb of section 66, the only remaining requirement to prove an interference to privacy is whether the personal information collected breaches an information privacy principle.

24 sUAS Guide / Q3 Update, October 2016