Attack of the drones – when conservation meets ‘counter espionage’

Equipped with a miniature but top-of-the-range camera, last week's incident involving aerial surveillance performed by the Committee Against Birds Slaughter seemed destined to be put to the test over privacy.

Sharp-eyed bird hunters last week spotted a mini 'spy drone' zipping around Marsascala. At one time, it was reported that the drone was flying around 50 to 100 metres over their heads. On spotting the model aircraft, equipped with a camera, the hunters didn't seem to hesitate much and shot it down within seconds.

The question that has lingered concerns whether it is legal for a private entity such as CABS to perform techniques normally associated with military or law enforcement-related surveillance. It transpires that CABS, the German-based committee, rented the spy drone equipped with a camera from Germany to film illegal trapping sites.

Replying to a question put forward by MaltaToday late last week, the police said that they were still investigating the legality of the method used, adding that investigations were still ongoing and preferred not to go into the merits of the case at that point in time.

On his part, the Information and Data Protection Commissioner Joseph Ebejer told MaltaToday that the Data Protection Act applies to the processing of personal data, which includes the recording, storage, and transmission of images of identified or identifiable natural persons on camera, not in the course of a purely personal activity.

"Where the images capture identified or identifiable individuals, given the applicability of the Act, such processing would be permitted only if it satisfies at least one of the criteria established in Article 9 of the said Act. 

"In the absence of consent, if identifiable individuals were captured by the surveillance camera, unless similar processing can be justified on public or legitimate interest grounds, this may constitute a breach of the Data Protection Act."

According to Antonio Ghio, who heads the ICT law department at Fenech & Fenech Advocates and specialises in data protection and intellectual property law, told MaltaToday that  "filming of an individual's face without an individual's consent is a data protection issue", comparing it to the email leak involving Opposition leader Joseph Muscat and RTK journalist Sabrina Agius.

Church media house Media Centre had sacked the former acting editor, after copies of her private email conversation with Muscat were published by Nationalist Party media and became the subject of hacking allegations raised by Muscat in parliament.

Ghio added: "If the police were conducting this method as a form of surveillance it's one thing but if a private entity, in this case CABS, conducted surveillance of this type, that is filming by means of a model aircraft, is another.

"This is also similar to when a news photographer captures pictures of an individual in a public area without the individual's consent and publishes the material. In this case, CABS was using public land, therefore it all boils down to how the Data Protection Office interprets these allegations."

Both the hunter's federation FKNK and Kaccaturi San Umbertu (KSU) hit out at CABS following the incident.

FKNK said that it would be filing a report against CABS for invasion of privacy and harassment while St Hubert Hunters told MaltaToday that this was nothing but a PR stunt by CABS.

However, Ebejer said that until Tuesday the Office of the Information and Data Protection hadn't received any official complaint to investigate an alleged breach of the Data Protection Act. "Harassment does not fall within the Office's remit since it is considered a crime under the provisions of the Criminal Code."

Earlier this year, it was reported in the press that FKNK said that BirdLife (Malta) had been warned by the Data Protection Commissioner not to process footage of individuals without their consent.

The Data Protection Act article on personal data

"Personal data may be processed only if:

(a) the data subject has unambiguously given his consent; or

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or

(d) processing is necessary in order to protect the vital interests of the data subject; or

(e) processing is necessary for the performance of an activity that is carried out in the public interest or in the exercise of official authority vested in the controller or in a  third party to whom the data is disclosed; or

(f) processing is necessary for a purpose that concerns a legitimate interest of the controller or of such a third party to whom personal data is provided, except where such interest is overridden by the interest to protect the fundamental rights and freedoms of the data subject and in particular the right to privacy."