They Are Watching You: Drones, Data & the Unregulated Commercial Market.

• Author: Dorsey, Samantha

Table of Contents I. INTRODUCTION 353 II. FROM THEN UNTIL NOW: ALOOK AT DRONES 354 A. What is a UAS and What Are Its Capabilities? 354 1. Who Can Operate a UAS? 355 2. UAS Surveillance Capabilities 356 3. Ways in Which UAS Surveillance Data Has Raised Privacy Concerns 357 B. Privacy and Data Collection 358 1. Reasonable Expectation of Privacy 358 2. Different Types of Surveillance: Pattern of Life 359 3. Data Collection and Post-Collection Uses 360 4. Privacy Theories: Control, Autonomy, Anonymity 361 C. Attempts at Regulating Activity 362 1. Regulatory Privacy Guidelines 362 2. State Laws and Concerns 363 III. ADDRESSING &ANALYZING THE PROBLEM 364 A. Potential UAS Privacy Infringement Concerns 364 B. Current Regulations Are Missing the Mark 366 IV. AREGULATORY COMPROMISE 366 A. Best Practices for Collecting Data from a UAS Delivery Service Customer 367 B. Best Practices for Collecting Data from a Non-UAS-Delivery- Services-Participant 369 C. What About UASs That Are Employed Only for Surveillance-- Not Delivery Services? 370 V. CONCLUSION 371 I. INTRODUCTION

It is a sunny July afternoon and you are laying outside on your pool raft in your fenced-in backyard. You take off your sunglasses to take in the cloudless blue sky--but to your surprise, a small unmanned aircraft system (hereinafter "UAS"), commonly referred to as a drone, is hovering over your backyard. Try yelling at it, try telling the UAS to get off of your property and to stop recording you--see what happens. Nothing. The drone is unarmed and is most likely not breaking any law by hovering over your private residence and using its savvy surveillance and data collecting functions.

What information and data were just collected, how much was collected and who collected it? What will happen to the data just collected; will you ever be notified of its use? These are the issues that have arisen in recent years, as the commercial and personal use of UASs have increased, without associated privacy guidelines maintaining the same growth. There is presently no hard-and-fast regulation or law requiring consent before collecting data via UASs, nor any requirement for a UAS operator to notify individuals of their identity or that they will be surveilling their private residences. Thus, a regulatory solution must be implemented to create general guidelines and enforce best practices to limit overreaching UAS data collection.

The present privacy protection framework surrounding the emerging commercial drone market fails to both hold commercial drone operators accountable for data collection and provide individuals with the ability to know what type of information is being collected and by whom. While the expectations of one's privacy has changed a great deal as technology continues to grow, this Note will discuss the necessity of a nationally unified regulatory framework that will designate and place restrictions upon data collection, explain how that data may be used, and establish an accountability log that will provide individuals with the opportunity to access their data that is being collected by a commercial UAS entity. To implement this regulatory framework, Congress will need to pass legislation that addresses all data collection privacy concerns and also grants agencies like the Federal Trade Commission ("FTC") the authority to interpret and establish their specific rules.

Before delving into the major issues and lack of regulations regarding UASs in the commercial market, this Note will provide detailed background information on UASs, basic privacy theories, and the privacy risks that may be implicated by UAS use. The following sections will provide comprehensive insight on the present uses and capabilities of UASs, including privacy issues and attempts to solve such concerns. After addressing the threats UASs pose, a regulatory solution will be proposed.

2. FROMTHENUNTILNOW: ALOOKATDRONES

   1. What is a UAS and What Are Its Capabilities?

      An unmanned aircraft system ("UAS"), commonly referred to as a drone, "is an aircraft without a human pilot onboard." (1) Rather, "the UAS is controlled from an operator on the ground." (2) "Small" UASs will be the primary focus of this Note, unless otherwise specified. Under Federal Aviation Administration ("FAA") regulations, a small UAS is an aircraft weighing less than 55 pounds. (3)

      There are many intended uses of UASs, resulting from the varying interests of UAS operators and UAS customers. The primary use for many UAS operators is to collect imaging for real estate endeavors, various inspections, agriculture and filmmaking. (4) Additionally, both nationally and internationally, there has been an increase in utilizing UASs for delivery services from both the operator and customer standpoint. (5)

      In an attempt to keep up with demands for faster and more efficient delivery services, many individuals and companies view drone delivery as the next best thing. For example, Amazon, one of the largest delivery services in the United States, currently has a trial-run-stage drone delivery service which it claims will be capable of delivering packages to customers in thirty minutes or less. (6) While Amazon plans on launching its drone delivery service in the United States in the near future, it has already tested this service in the United Kingdom. (7) Amazon's drone delivery trial run in the United Kingdom first delivered an Amazon Fire TV and a bag of popcorn to an Amazon subscriber in December 2016. The entire delivery took a total of thirteen minutes from the customer clicking "order" to the items appearing at the customer's doorstep. (8)

      While Amazon may be striving to meet its customers' demands for the fastest delivery possible, there are other motives for drone delivery services. Internationally, Harvard graduate Keller Rinaudo, has launched Zipline, a time-sensitive medical delivery service. (9) Zipline drone delivery is more than delivering a television to an impatient customer, it is a new medical advancement that may be used to save lives.

      1. Who Can Operate a UAS?

         Who is the operator on the ground? As per Part 107 of the FAA's Small Unmanned Aircraft Rule ("Part 107") the operator of a small UAS must be (1) at least 16 years old, (2) have a remote pilot certificate with a small UAS rating, or (3) be directly supervised by someone with such a certificate. (10) In order to qualify for a remote pilot certificate, an individual must either pass an initial aeronautical knowledge test at an FAA-approved knowledge testing center or have an existing non-student Part 61 pilot certificate. (11)

         The operators of UASs are required to follow the FAA's newly enacted August 2016, Part 107 Rule, which set forth the new pilot certification and training rules, as well as safety rules including time, height, and speed restrictions for small UASs. (12) These safety regulations may be waived if the FAA authorizes a Section 333 exemption. This is where the problem of data collection begins. (13)

         Under the Section 333 exemption, the seemingly most important flying restrictions dictated by Part 107 that provided some privacy protection against nonconsensual data collection (e.g. prohibitions against flying beyond line of sight, over people, at night, and above 400 feet in the air) are not enforced. (14) If a pilot's Section 333 waiver is granted, s/he may operate at night, beyond line of sight, above 400 feet, as well as in other specific types of operation. (15) The exemption is granted when the activity proposed requires such an exemption, like surveying a residential area. (16) This waiver opens up the door to the hypothetical scenario presented in the introduction--the UAS pilot is now authorized to fly or hover above your property, even if you are not a part of the UAS operation. (17) The FAA has set forth very specific safety rules and restrictions to prevent physical collisions or potential security threats (it is illegal to fly, for instance, in Washington D.C. or near airports) but has failed to consider or adopt privacy regulations in its new Part 107 regulation. (18)

      2. UAS Surveillance Capabilities

         While all UASs have varying levels of surveillance capabilities, many of them are highly advanced. This section will illustrate the level of technology that some UASs possess and how other companies have used similar technology for other means of surveillance and data collection that have led to similar privacy issues.

         Many UASs are technologically capable of data collection, and some to a much higher degree than others. Most UASs are "equipped with sophisticated imaging technology that provides the ability to obtain detailed photographs of terrain, people, homes, and even small objects." (19) The giga-pixel cameras used to outfit UASs can "provide real-time video streams at a rate of 10 frames a second" and "track up to 65 different targets across a distance of 65 square miles." They "may also carry infrared cameras, heat sensors, GPS, sensors that detect movement, and automated license plate readers." (20) The technologies utilized by UASs are growing rapidly, and soon may even include facial recognition. (21) The use and emergence of these technologies will only continue to provide UAS operators with greater tools and capabilities in collecting data.

         Similar sensors and surveillance tools used in UASs have already been employed by the likes of Google in its Google Street View mapping project, which takes 360 degree views of streets all over the world by way of highly equipped vehicles. (22) Google has since faced privacy-based complaints, as people are concerned with their faces not being properly blurred when the street shots are available on Google's mapping site. (23) However, Google has technically not violated any privacy laws in the United States because under current tort "invasion of privacy" laws, there is no expectation of privacy when a person is in a public space and in fact, the risk of surveillance is...