Use of Drones in Disasters in the European Union: Privacy Issues and Lessons Learned from the COVID-19 Pandemic and Mass Surveillance Jurisprudence of the ECtHR and the CJEU

Abstract

Severe earthquakes, extreme floods, tragic accidents, mega-fires, and even viruses belong to disasters that can destroy the economic, social, or cultural life of people. Due to the climate crisis, disasters will likely become more frequent and intense over the years. Unmanned aerial vehicles (UAVs/drones) have obtained an increasing role in disaster management, which was particularly evident during the COVID-19 pandemic. However, lack of social acceptability remains a limiting factor of drone usage. Drones as a means of state surveillance—possibly mass surveillance—are subject to certain limits since their advanced monitoring technology, including Artificial Intelligence, may affect human rights, such as the right to privacy. Due to the severity of the pandemic, which has been described as the “ideal state of emergency”, despite the rising use of drones, such privacy concerns have been underestimated so far. At the same time, the existing approach of the European Court of Human Rights (ECtHR) and the Court of Justice of the European Union (CJEU) regarding the COVID-19 health crisis and human rights during emergencies seems rather conservative and, thus, setting limits between conflicting rights in such exceptional circumstances remains vague. Under these conditions, the fear that the COVID-19 pandemic may have become a starting point for transitioning to a world normalizing the exception is evident. Such fear in terms of privacy implies a world with a narrowed scope of privacy; thus, setting questions and exploring the challenges about the future of drone regulation, especially in the European Union, are crucial.

1. Introduction

Severe earthquakes, extreme floods, tragic accidents, mega-fires, and even viruses belong to disasters that can destroy the economic, social, or cultural life of people. Due to the climate crisis, disasters are highly likely to become more frequent and more intense over the years. Although effective disaster management requires accurate data collection, such collection may be tough in emergencies due to the lack of coordinated actions by competent agencies. Surveillance technology today provides unique opportunities to complement ongoing human efforts in such situations. Remote sensing has played a key role in supporting these functions worldwide, mainly for rapid-onset natural hazards (Twigg 2004). Unmanned aerial vehicles (drones), which belong to remote sensing technologies, have obtained an ever-increasing role in disaster management in mapping, monitoring, rescue planning, damage assessment, and communication network restoration. Drones have been used in actual disaster events (primarily for surveying damage), as documented by several humanitarian reports, since they support the real-time monitoring of a disaster-affected area, thus enabling quick collection and analysis of relevant information as well as effective planning for further relief actions (Chowdhury et al. 2021).

The outbreak of the COVID-19 pandemic resulted in a global rise in state surveillance (Eck and Hatz 2020). During the pandemic, among other applications, drones have been, for the first time, widely used for state surveillance. As a means of state surveillance, possibly even mass surveillance, drones are subject to certain limits since their advanced monitoring technology may cause serious interference with human rights, such as the right to privacy. Due to the severity of the pandemic, which has been described as the “ideal state of emergency” (Greene 2021), despite the rising use of drones, such privacy concerns have so far been hidden in the shadows (Butt et al. 2021). Simultaneously, surveillance technology with the help of Artificial Intelligence is developing at breakneck speed, and what seemed like science fiction 10 years ago is today’s old news (Harari 2020), so privacy concerns will become burning issues soon.

2. Research Methodology—Research Objectives

This study focuses on the use of drones in disasters in the European Union and explores whether the current legal framework is enough to mitigate the risks to privacy rights in such extreme situations.

Drones are selected as the research focus of this study since, on the one hand, they offer huge comparative advantages in comparison to other surveillance methods, especially in disasters. Still, on the other hand, their special advantage of (relative) invisibility represents, at the same time, the biggest threat to the right to privacy (Vermeulen 2014). Privacy protection is considered in disasters, which are emergency situations, when safeguarding the right to life may outpace privacy concerns. In disasters, the collision of fundamental rights may seem inevitable for the purpose of saving lives.

However, while outpacing the right to privacy in extreme situations may seem prima facie, as a rational expectation of any reasonable person, the fact that due to the climate crisis, disasters are likely to become more frequent and intense over the years expands the range of possible derogations of the right to privacy in disasters. Therefore, it is crucial to examine whether the existing legal framework and its interpretation can serve as mitigation methods for the multiple privacy risks emerging from using drones in future disasters.

The scenario of fundamental rights’ collision in disasters has taken place due to the outbreak of the COVID-19 pandemic on a large scale. For this reason, the use of drones in the COVID-19 pandemic has been further examined as a perfect case study.

EU legislation has been selected for the present study since the European Union consists of consolidated democracies that respect human rights and, especially, the subjects’ personal data. The European Union has adopted extensive regulations regarding the safety and security of drones. Nevertheless, the public remains skeptical regarding the acceptance of drones in relation to other surveillance methods.

Considering these facts, this research utilizes interdisciplinary literature regarding the definition and description of disasters and the application of drones in disasters, particularly in the COVID-19 pandemic. Such an interdisciplinary approach is necessary to highlight the necessity of using drones in disasters along with justifiable fears. Disasters as states of emergency are also evaluated in the scope of the jurisprudence of the European Court of Human Rights (ECtHR) and Court of Justice of the European Union (CJEU) to examine what kind of emergency measures are allowed in such situations. In addition, existing drone legislation, as well as privacy protection legislation and its interpretation by the European Court of Human Rights and by the Court of Justice of the European Union, is investigated to derive essential conclusions on how conflicting rights can be reconciled and how the safer use of drones in disaster management can be achieved.

This paper is structured into four parts: In the first part, disasters, mainly contemporary disasters, are defined, while the COVID-19 pandemic as a disaster is also approached. In addition, disasters, notably the COVID-19 pandemic as a state of emergency, are investigated in the scope of the European Court of Human Rights (ECtHR) and Court of Justice of the European Union (CJEU) jurisprudence. In the second part, drones as disruptive and emergent technologies in disasters, as well as applications of drones in disasters and privacy issues emerging from the use of drones in disasters, are presented, with an emphasis on the COVID-19 pandemic. The third part focuses on relevant legislation and the interpretation of privacy protection by the European Court of Human Rights and the Court of Justice of the European Union in recent mass surveillance cases as milestones for future drone-related cases. As a final discussion, lessons learned from relevant jurisprudence and from fighting the COVID-19 pandemic are presented, aiming at the safer use of drones in disaster management regarding privacy.

3. Disasters

3.1. Characteristics of Disasters—Contemporary Disasters

A hazard is any phenomenon, physical event, or human behavior (floods, hurricanes, droughts, epidemics, nuclear spills, etc.) that can harm humans, destroy property, cause social disruption, or cause environmental degradation. A disaster, on the other hand, is the potential consequence of a hazard where a community or population cannot handle the effects of the hazard, given the resources at their disposal. The type of hazard from which they are rooted typically defines disasters. Hazards are grouped into three categories: technological, natural, and environmental degradation hazards (Prasad and Francescutti 2017). In other words, a disaster may be a natural or man-made hazard, which has the power to produce significant negative results. Physical damage or destruction, loss of life, or even drastic changes to the environment belong to such results. Earthquakes, floods, accidents, fires, or explosions belong to events causing negative results. In such situations, people’s economic, social, or cultural life is strongly affected (Restás 2015).

In the same perspective, the “Disaster Charter1” distinguishes “natural or technological disasters”. According to the Charter, a natural disaster means a situation of great distress involving the loss of human life or large-scale damage to property, caused by a natural phenomenon, such as a cyclone, tornado, earthquake, volcanic eruption, flood, or forest fire, and the term technological disaster refers to similar damage caused by a technological accident, such as pollution by hydrocarbons, or toxic or radioactive substances.

Another different category of disasters is terrorist-induced disasters. Although there are important differences between terrorism and other disasters, the site of a terrorist act must be treated as a crime scene as well as a disaster scene (National Research Council 2002). Even though terrorist-induced disasters are deliberate and criminal acts, they are similar to natural and technological disasters, especially regarding response and recovery. From this perspective, naturally caused or unintentional, negligence-caused technological disasters can be deemed analogous to terrorist-induced disasters.

There are many ways to scale different disasters. Disasters can be scaled from limited to escalated by the affected area or population, from the eruption to slowly spreading by the time they develop, or in many other ways depending on the condition we consider (Restás 2015). Large-scale disasters are characterized by urgent needs that arise in many different places simultaneously.

The intensity and frequency of climate-related hazards due to the climate crisis have increased, significantly exacerbating the damage caused by climate-related disasters (Yu 2022). Extreme events that were once considered extreme in magnitude and frequency have now been transformed into annual or seasonal frequency. At the same time, disasters usually occur where hazards impact vulnerable populations. The poor communities are exposed to natural disasters due to increased concentration in risky areas. Finally, cascading disasters, multiple disasters that can occur sequentially, reflect the complexity of modern society and the interdependent socioeconomic system that supports it (Pescaroli et al. 2018). Where vulnerabilities overlap and interact, escalation points are created that can create secondary effects with a more significant impact than the primary event (Alexander and Pescaroli 2019).

3.2. The COVID-19 Pandemic as a Natural Disaster

The COVID-19 pandemic is the most recent example of a biological hazard that has had disastrous effects, killing millions of people and affecting the lives of most people on the planet. Despite different perceptions depending on healthcare systems or demographic characteristics, every country understood the pandemic as a threat (Eck and Hatz 2020).

According to the predominant scientific consensus, the COVID-19 pandemic is classified as a natural disaster because a naturally occurring biological agent caused it, the SARS-CoV-2 virus, which is believed to have originated in wildlife before being transmitted to humans. Only if it is proven that it was accidentally or intentionally released due to human activity (e.g., a lab incident) could it be considered a technological disaster.

Curfew measures, obligatory masks, obligatory vaccination, obligatory telecommuting, and distance learning are typical examples of how the pandemic has affected everyday life. The World Bank estimated that the COVID-19 pandemic in 2020 increased the number of extremely poor people by 119 million to 124 million (Mahler et al. 2021). It also seems to be a strong connection between the climate crisis and the COVID-19 pandemic since the synergy produced by the concurrency of COVID-19 and climatic variables is directly associated with human health risks (Nundy et al. 2021). For example, atmospheric pollution can exacerbate the respiratory health risks associated with COVID-19. Finally, the severity of the consequences and the long-term effects of the COVID-19 pandemic are derived from the intensity of the event and the constant preparedness level required by states to fight it.

3.3. Disasters as States of Emergency in the Scope of the Jurisprudence of the European Court of Human Rights (ECtHR) and Court of Justice of the European Union (CJEU)

3.3.1. Disasters as States of Emergency in the Scope of the Jurisprudence of the European Court of Human Rights (ECtHR)

Normalcy must be empirical regularity, and an emergency is the exception (Greene 2011). Thus, it can be argued that disasters, especially large-scale ones, constitute a public emergency, as described in Article 15 of the European Convention on Human Rights.

Article 15 of the ECHR allows for derogation in cases of “war or other public emergency threatening the life of the nation”. The characteristics of such cases imply an actual or imminent danger whose effects involve the whole nation, while measures allowed by the ECHR would not be effective at all in such circumstances. A war or armed insurrection is a typical example, as is a severe natural disaster or disease outbreak (Greene 2011). In such cases, a declaration may take place to tackle this extraordinary danger, threatening the nation’s life. Such a declaration allows the government to impose emergency measures and shrink or suspend human rights. The reasoning for applying a state of emergency, the necessary procedures, and the limits of the emergency powers differ from country to country2.

Despite the wide margin of discretion of the national authorities to define when a state of emergency has arisen, the European Court of Human Rights still holds some supervision rights over national authorities3.

Nevertheless, it is an unquestionable truth that human rights can be strongly violated during declared states of emergency. Democracy during states of emergency is less safe than without them, even with strong procedural safeguards (Steuer 2022). For this reason, advanced democracies prefer to deal with emergencies through ordinary legislation rather than declaring a state of emergency, feeling that this legislation is, in some ways, exceptional. Still, it has been argued that emergency legislation may remain ordinary in this way, and finally, the laws made to deal with the emergency may become embedded in the normal legal system, enacting permanent changes under the color of the emergency. This way, liberties are likely to be subject to rapid erosion (Ferejohn and Pasquino 2004), while states of exception may silently become expected forms of governmentality; what was temporary or even totally unacceptable may become unremarkable, mundane and, consequently, normal (Agamben 2005; Wood and Webster 2009). This happens because, when dealing with emergencies through ordinary legislation, the most important characteristic of any emergency regime, which is its temporary character, is displaced. Emergency rules must be time provisional. The state must aim at any emergency to ensure that, in the end, normalcy will recover4 since the notion of exception envisages a temporary situation.

In addition to that, the trend that advanced democracies prefer to deal with emergencies through ordinary legislation has led to the practice that the Contracting State usually states that the measures it is taking “may” involve a derogation from the Convention. Subsequently, the Court (ECtHR) determines whether the derogation was valid only if the measures applied cannot be justified under the substantive articles of the Convention5. In this sense, Article 15 has been interpreted to reinforce the perspective that states of emergency are merely another factor restricting certain human rights. Furthermore, ECtHR has so far mainly focused on whether measures taken are proportionate to the exigencies of the situation and not on assessing the emergent character of the situation. Specific analyses of proportionality and necessity of measures are deemed essential under the dynamic approach of Article 15, meaning that what is considered necessary in the context of a significant crisis may not be considered necessary several months afterward when re-estimating the whole situation6.

Lawless v Ireland7 was the first case to assess the existence of a state of emergency under Article 15 and the first to be heard before the ECtHR. In this case, the ECtHR was called upon to decide whether the detention of G.R. Lawless without trial was justified by the right of derogation allowed in certain exceptional circumstances under Article 15 of the Convention. The Court determined that the existence of a public emergency threatening the life of the nation was a fact due to the engagement of a secret army in Ireland, operating also outside the territory of the state and due to the steady and alarming increase in terrorist activities, although public institutions have been kept functioning more or less normally. In this sense, the ECtHR left the decision for the presence of the state of emergency to the margin of appreciation of the sovereign states, thus showing that it recognizes such a decision as a highly politicized legal issue. At the same time, the ECtHR focused on whether the measures taken in derogation from obligations under the Convention were “strictly required by the exigencies of the situation”. The Court decided that any other available means had been proven unable to check the growing danger which threatened the Republic of Ireland and that given the fact that a number of safeguards against abuse existed such as supervision by the Parliament, the measure of arrest and detention of persons concerned in unlawful activities appeared to be a measure strictly required by the exigencies of the situation within the meaning of Article 15 of the Convention. Similarly, in the most recent case of A. and Others v. the United Kingdom,8 the Court accepted that there had been a public emergency threatening the life of the nation, although no al-Qaeda attack had taken place within the territory at the time the derogation was made. According to the thoughts of the Court, a state could not be required to wait for disaster to strike before taking measures to deal with it. In this sense, national authorities enjoyed a wide margin of appreciation in assessing the threat based on the known facts. Still, when applying the proportionality principle, the Court found the derogating measures disproportionate in that the permittable indefinite detention of non-nationals suspected terrorists discriminated unjustifiably between nationals and non-nationals. In this way, the Court tightened the legal standards for emergency derogations and reinforced the importance of legal safeguards against arbitrary detention.

Thus, according to the wording of the ECtHR in case A. and Others v. the United Kingdom, disasters or imminent disasters may constitute public emergencies if they fulfill the characteristics that qualify a situation as a state of emergency. Such characteristics may have an objective character, but the final decision for the presence of the state of emergency lies in the margin of appreciation of the sovereign states under the supervision of the ECtHR. In any case, if a state of emergency exists, the measures taken must always be strictly required and equipped with sufficient safeguards against abuse.

3.3.2. Disasters as States of Emergency in the Scope of the Jurisprudence of the Court of Justice of the European Union (CJEU)

As far as EU law is concerned, it is to underline that the EU currently lacks regime d’ exception due to the principle of conferral. Although constitutionalizing an EU State of Emergency seems rather necessary and ambitious (Arribas 2024), the EU is still far from adopting such an idea. The EU Treaties or the Charter of Fundamental Rights of the European Union do not currently include such clauses. Article 52 (1) of the Charter refers to arrangements regarding the limitation of rights using the wording of the case law of the CJEU. So, it includes limitations and no derogations of human rights in the case of a crisis, including disaster management. At the same time, there are provisions in EU law that allow EU action “to address the sudden and urgent threats to the core values and structures of the EU and its Member States” (B. De Witte 2022), the so-called “emergency competencies”, which are applied in cases of emergency.

Most relevant in cases of disaster management are Articles 107 (2) (b), 107 (3) (b) TFEU and 122 of TFEU. According to Article 107 (2) (b), aid to make good the damage caused by natural disasters or exceptional occurrences, and according to Article 107 (3) (b), aid to remedy a serious disturbance in the economy of a Member State, are both considered to be compatible with the internal market. Furthermore, according to the first paragraph of Article 122 TFEU, the adoption of appropriate measures to tackle severe difficulties is allowed. Moreover, according to its second paragraph, granting financial assistance to Member States is also allowed to tackle severe difficulties caused by natural disasters or exceptional occurrences beyond their control. Article 122 TFEU is considered to have been “rediscovered” in the last four years for the Union’s quick and efficient response to several difficulties, such as the response to the pandemic, coordinating gas purchases across the EU, addressing high energy prices, etc. However, EU legislation produced through 122 TFEU has been severely criticized since Article 122 TFEU is deemed to undermine direct democratic legitimacy and support a technocratic vision of EU politics. Under these circumstances, the discussion about reforming Article 122 TFEU has recently become quite broad (Dermine 2024).

Jurisprudence of the CJEU related to Article 122 TFEU is relatively rare. In Case C-589/15 P—Anagnostakis II, the Court noted that the principle of conferral limits the EU’s competencies to those explicitly granted by the Member States in the Treaties and that ad hoc assistance subject to certain conditions can be granted to Member States, but general and permanent assistance is not allowed9. Similarly, in Case C-370/12 Pringle, the Court judged that Article 122 (2) TFEU cannot justify a mechanism of the non-repayment of debt due to the general and permanent nature of such a mechanism10.

Furthermore, the so-called “Airline cases” dealing with actions for annulment of Commission Decisions regarding authorization for state aid granted during the pandemic under Article 107 are of great importance11. In French Scheme and Swedish Scheme cases, the EU Court, for the first time, recognized Article 107 TFEU as a special provision of Article 18 TFEU, thus giving Member States the legal basis for supporting national entities if there is a “serious disturbance in the economy” in the sense of Article 107 (3) (b) TFEU or “natural disasters or exceptional occurrences” in the sense of Article 107 (2) (b) TFEU.

So, it follows from the above that disasters are undoubtedly included in the scope of Articles 107 and 122 TFEU, allowing emergency measures of an extraordinary and temporary nature with a margin of appreciation granted to EU Bodies and Member States; however, according to existing EU law, the suspension of fundamental rights in cases of crisis is not allowed. Still, according to Article 52 (1) of the Charter, limitations are permitted as far as they are subject to a triple test of legality, legitimacy, and necessity (Alivizatos et al. 2020), which is like the application of the principle of proportionality followed by the ECtHR, both of which are analyzed below.

3.4. The COVID-19 Pandemic in the Scope of the Jurisprudence of the European Court of Human Rights (ECtHR) and Court of Justice of the European Union (CJEU)

3.4.1. The COVID-19 Pandemic in the Scope of the Jurisprudence of the European Court of Human Rights (ECtHR)

Although the COVID-19 pandemic has been described as the “ideal state of emergency” (Greene 2021), only Albania, Armenia, Estonia, Georgia, Latvia, North Macedonia, the Republic of Moldova, Romania, San Marino, and Serbia sent to the General Secretary of the Council of Europe notifications under Article 15 of the Convention. This is a cause for concern since exceptional measures affecting human rights were a fact in most states, especially during the first wave of the pandemic. Even though formal derogations using Article 15 of the European Convention on Human Rights (ECHR) are regarded by some scholars as the best way of ensuring that exceptional powers are quarantined to exceptional situations (Greene 2021), a very small number of countries made use of this Article during the pandemic. Consequently, due to the lack of notifications, it has been harder to monitor derogations, and a range of exceptions has been “normalized”.

As far as relevant jurisprudence of the ECtHR is concerned, Terheş v. Romania12 constitutes the most pertinent case so far. In this case, the applicant raised its complaints under Article 5 § 1, so the Court did not consider Article 15 at all. Article 5 § 1 was declared inapplicable ratione materiae13, so although the case refers to a lockdown applied universally to all residents in response to the COVID-19 pandemic and although Romania had sent in front of the General Secretary of the Council of Europe notifications under Article 15 of the Convention regarding restrictions on freedom of movement under Article 2 of Protocol No. 4, the Court emphasized the distinction between a deprivation of liberty under Article 5 and a restriction on freedom of movement under Article 2 of Protocol No. 4. It concluded that the lockdown measures constituted a restriction on freedom of movement rather than a deprivation of liberty, without even addressing the proportionality question. So, since the applicant had applied solely on the grounds of Article 5, the Court did not examine the situation at all from the standpoint of Article 15§ 1. Despite this, the decision has been criticized as “normalizing the exception” since it seems to accept the limitation clause approach instead of the derogation approach. The danger of taking the limitation clause approach instead of the derogation approach in such a global and intense emergency is the normalization of the state of exception and increased difficulty in weighing proportionality the longer the pandemic lasts (Gozdecka 2021).

The ECtHR again avoided connecting the pandemic lockdown measures with Article 15, also in Constantin-Lucian Spînu v. Romania14. Since Romania’s specific measures taken in connection with the declaration of the state of emergency had ceased at the date of the decision, the Court examined the case solely on the grounds of Article 9.

On the contrary, in the case of Communauté Genevoise d’Action Syndicale (CGAS) v. Switzerland, the Court noted explicitly that only a minority of ten states had had recourse to the “derogation” clause in Article 15 of the Convention. The other states had chosen merely to restrict a number of rights protected by the Convention15. In this sense, by not invoking Article 15, Switzerland had to justify its actions under the normal standards of proportionality and necessity without the broader leeway offered by a formal derogation. Thus, the Court indirectly highlighted the importance of Article 15 as a tool for states to justify “draconian” measures during emergencies.

Consequently, the ECtHR seems unwilling to express whether the derogation approach could cover lockdown measures during the COVID-19 health crisis. However, in numerous COVID-19-related cases, the ECtHR has accepted the limitation approach16. Although such decisions refer to countries that never sent notifications under Article 15 of the Convention, it is evident that the Court prefers to seek justification for the lockdown measures under the substantive articles of the Convention and not under Article 15, confirming once more the trend that advanced democracies prefer to deal with emergencies through ordinary legislation.

3.4.2. The COVID-19 Pandemic in the Scope of the Jurisprudence Court of Justice of the European Union (CJEU)

The relevant jurisprudence of the Court of Justice of the European Union is also significant since the role of both courts (ECtHR and CJEU) became even more crucial during the pandemic. During this period, judges acted as guardians of rights and freedoms, striking new balances in the light of the rule of law and general principles, such as proportionality, effectiveness, precaution, and solidarity (Iamiceli and Cafaggi 2023).

As aforesaid, Articles 107 (3) (b) TFEU and 122 of TFEU have both been used extensively for legislating an emergency COVID-19-related framework (Arribas 2024; Nicolaides 2022). So far, no action has been taken for annulment under Article 263 TFEU regarding financial assistance granted under Article 122 TFEU during the pandemic. Actions for annulment of Commission Decisions regarding authorization for state aid granted during the pandemic under Article 107 have already been commented on in Section 3.3.2 above regarding the so-called “Airline cases”.

Moreover, in case C-128/22 Nordic Info v. Belgische Staat, as Advocate General Emiliou correctly stated, the CJEU, for the first time, was called upon to rule on the compatibility with EU law of precautionary measures, which shook, by their very nature and severity, one of the main foundations, and indeed achievements, of the European Union, that is to say, the creation of ‘an area … without internal frontiers, in which the free movement of persons is ensured’17. This judgment is significant as it addresses the balance between public health measures and fundamental freedoms within the EU during a global pandemic, which may be classified as a serious threat to public policy and/or internal security. The Court accepted entry bans, quarantines, and testing in the event of a health crisis, as long as the proportionality requirement was respected. It also accepted that measures are proportional as long as they are (a) appropriate for attaining the objective of the general interest pursued, (b) limited to what is strictly necessary, and (c) not disproportionate to that objective, which implies, in particular, a balancing of the importance of the objective and the seriousness of the interference with those rights and freedoms18.

It is, thus, more than evident that the CJEU, although not able to use the derogation approach itself when it comes to circumstances such as the global COVID-19 pandemic, moves further than the limitation approach, allowing restrictions even on the main objectives of the EU, such as the free movement of European citizens. In this sense, an expansion of current emergency competences of the EU or a special regulation of EU emergency powers is necessary to avoid misinterpretations, including the application of the proportionality principle in emergencies.

4. Drone Applications in Disasters and Privacy Issues Emerging from the Use of Drones in Disasters

4.1. Drones as Emergent and Disruptive Technologies in Disasters

Certainly, drones can execute tasks that cannot be performed by other tools. Unlike tracking apps, which rely on data collection and user participation, drones provide a physical presence in disaster-stricken or high-risk areas. They can operate in real time in inaccessible or hazardous environments, such as dense forests. They are mobile and less visible, so they can follow individuals or objects for a long time without being noticed. They also offer innovative solutions to facilitate faster emergency responses in cases of disasters (Yucesoy et al. 2025; Vermeulen 2014). Additionally, drones integrated with AI technologies can perform necessary actions without human need (Mohsan et al. 2022). In these cases, drones can be classified as emergent technologies (Choi-Fitzpatrick 2020).

Despite the unique opportunities that drones offer in disasters, public acceptance of drones still seems limited, with acceptance usually hovering around 50% (Eißfeldt and Biella 2022). The general public considers drones as dangerous weapons or spies without consent (Serafinelli 2022), especially after the drone deployment in Ukraine (Hambling 2025). The fear of an invasion of privacy is evident, along with the fear of surveillance by security forces, the state, or other entities (Kraus et al. 2020). In this sense, drones have been characterized as “aero-visual techniques of power” and as both the product and producer of novel regimes of “aerial governmentality” (Adey et al. 2013; Klauser 2021) or, according to Michel Foucault, “disciplinary governmentality” (Foucault 1977), meaning that discipline is achieved because of the feeling of being constantly watched from the air and because it is not easy for people to avoid this type of aerial surveillance (Vermeulen 2014). Further social issues arise, such as the fear of job loss in the case of shipment professions, fear of crashing drones, and harassment due to the noise and visual pollution produced. Drones are a threat to the psychological well-being of those on the ground, even when used for biodiversity conservation (Sandbrook 2015). Drones could, thus, be classified as disruptive technologies, namely innovative technologies for which there is little approval for either means or ends (Choi-Fitzpatrick 2020).

According to recent studies that examined the public acceptance of drones, the public supports the use of drones mostly for public safety and scientific research applications (Aydin 2019), and acceptance seems to be highest for official uses, such as ‘catastrophe response’, ‘life-saving efforts and rescue operations’, and ‘science and research’ (Eißfeldt and Biella 2022). The public seems to understand that the benefits of the use of drones in these situations outweigh the associated risks, but it still raises privacy concerns. Generally speaking, the public is currently at a consciousness-raising stage with respect to drones, still gathering information and forming impressions (Aydin 2019) or, in different wording, in the phase of negotiation and interpretative flexibility regarding drones (Dolata and Schwabe 2023).

Such a negotiation process should ideally lead to the effective adoption of drone technology, especially in disasters, where their use seems inevitable. Knowledge regarding drone applications in disasters is necessary for this negotiation process, as is knowledge regarding the privacy issues associated with these applications and how the existing legal framework and its interpretation can serve as mitigation tools for emerging privacy risks. In the following sections, the research focuses on these pillars, while the COVID-19 pandemic is used again as the perfect case study.

4.2. Drone Applications in Disasters

As mentioned before, drones can execute tasks that cannot be done by other tools. In detail, there are four primary application areas of drones in disaster management now: (1) monitoring, mapping, or damage assessment; (2) search and rescue; (3) transportation; and (4) training (Mohd Daud et al. 2022). In addition, recently, drones have been reported as crucial for restoring communication networks in disasters (Lorge 2024).

Drones are instrumental in monitoring, mapping, and damage assessment in disaster management. Unlike fixed-wing light aircraft or helicopters, drones are more cost-effective, faster, and capable of providing data even in extreme weather conditions. They are equipped with advanced cameras (infrared, thermal, etc.) and can transmit high-resolution images and videos in real time.

Moreover, the use of drones for search and rescue has increased in recent years. Drones are valuable because they significantly speed up the rescue process without endangering the rescuers. Drones can search for and locate the victim over a larger area in less time than rescuers, even at open sea or by locating buried subjects.

In addition, drones can be used to transport medical or emergency supplies to a disaster-affected region or during an emergency. They can even assess a patient’s condition prior to the arrival of an ambulance and deliver medical supplies and blood samples during emergencies. Drones can also be helpful during immediate and non-immediate medical disaster relief efforts (Rosser et al. 2018). They can provide an instant telecommunications infrastructure, assist in telemedicine-enabled clinical services, and perform equipment/drug/patient delivery.

Furthermore, drones have been reported to be an excellent resource for training and preparing emergency medical services personnel in Mass-Casualty Incidents research (Jain et al. 2018).

Finally, restoring communication networks in a disaster is vital in disaster relief. Especially during natural disasters, communication towers are often destroyed, making it impossible for affected populations and relief teams to communicate. During the 2024 Noto Peninsula earthquake, drones were used to restore communications by relaying cell phone signals from users to base stations (Ishiwatari 2024).

It is also crucial to underline that new generations of drones can use Artificial Intelligence (AI) for effective disaster management. The Ministry of Land, Infrastructure, Transport and Tourism (MLIT), during the 2024 Noto Peninsula earthquake in Japan, used drones to survey the affected areas and assess the extent of damage to buildings, infrastructure, and landscapes equipped for the first time with new technology of Artificial Intelligence (AI) and 3D devices. The AI-created 3D data were promptly provided to on-site search-and-rescue teams through smartphones and cloud systems and to the public via the ministry’s website (Ishiwatari 2024). This way, the prioritization of rescue efforts was more manageable, the distribution of rescue powers and resources more effective, and the information given to the public more immediate and efficient.

4.3. Drone Applications Fighting the COVID-19 Pandemic

The COVID-19 pandemic provides a unique setting for understanding how drones can be used in extreme situations, especially regarding state surveillance, as, unlike most other security threats, the threat posed by the disease was not endogenous to governance and was applicable to all countries (Eck and Hatz 2020).

Area monitoring or aerial surveillance has been the most frequently used drone application in the case of normal everyday practice and special activity in combating the COVID-19 pandemic (Restás 2022). Area monitoring or aerial surveillance was used in all countries where drone applications were reported. Area monitoring provided an opportunity to confirm the effectiveness of the measures ordered, to impose necessary further tightening, or even to resolve previous tightening. Some countries even used drones with loudspeakers or QR code flags, such as China, India, Italy, Kenya, Rwanda, Spain, and the United States. Most drone applications so far have been used to facilitate law enforcement, such as keeping social distances; reducing mass presences in parks, streets, and squares where possible; eliminating groupings, presumably acquaintances and friends; wearing a face mask or gloves as required; or leaving the given territory or moving to their place of residence. Primarily, video surveillance and broadcasting of voice messages with a drone are expected to track non-compliant citizens and reduce the possibility of responders having direct contact with potentially infected people19.

Drones have been further reported to be an important tool in fighting the COVID-19 pandemic by helping to create more resilient supply chains and socially distanced delivery services, and it seems that the Golden Age of drones is coming (Wolf 2020). Self-test kits and various medical supplies can be transported without direct human contact, reducing infection risks (Kunovjanek and Wankmüller 2021). The practical applications of delivery drones also include transporting from a central sampling site to a laboratory at another location, thereby reducing the waiting time for the result. Finally, all drone producers also offer the option of using drones for spraying disinfectants.

Based on the above, it can be concluded that during the COVID-19 pandemic, drones were widely used to facilitate state surveillance and socially distanced delivery services. Thus, they were deemed increasingly helpful instruments of defense that could also be useful in fighting future pandemics.

4.4. Privacy Issues Emerging from the Use of Drones in Disasters

4.4.1. Privacy Issues Emerging from the Use of Drones in Disasters in General

Privacy expectations during disasters are not identical to those in non-emergency situations (Sanfilippo et al. 2020). At the same time, today, for the first time in human history, technology enables the constant monitoring of people and their environment (Harari 2020). Drones are capable of such constant monitoring, especially when combined with advanced wireless technologies and Artificial Intelligence.

However, as Warren and Brandeis stated already in 1890, “technology generally has always been a threat to the right to privacy, in other words, to “the right to be le(f)t alone” (Warren and Brandeis 1890), the potential violation of privacy nowadays seems to be more timely than ever before due to advanced technologies such as algorithmic video surveillance technologies and facial recognition technologies. Thus, among society’s open challenges is tackling the potential violation of individual privacy due to drone monitoring in non-emergency and emergency situations. In emergencies, a balance in favor of privacy protection is harder, as analyzed below, but it is still necessary.

Firstly, it must be considered that no universal definition of privacy exists since there is no universally shared understanding of privacy, and it depends on the existing societal characteristics and the economic and cultural environment (Lukacs 2016). Different legal cultures and jurisdictions have adopted different privacy and data protection approaches, each reflecting their unique historical, political, and legal development. However, there is the counterargument that in a globalized world with possible transnational surveillance measures, it becomes increasingly difficult to rely on purely domestic notions and national protections of privacy (Lachmayer and Witzleb 2014). Apart from this, nowadays, the digital age has led to a non-strict separation between the private and public spheres. Still, under these circumstances, the idea of a reasonable expectation of privacy exists (Mund 2018).

Among the above-mentioned uses of drones in disasters, state drone surveillance for facilitating law enforcement may create the most substantial privacy concerns since, due to the nature of drones, even mass state surveillance is possible. State surveillance implies a routine and systematic activity of information gathering, transfer, and analysis (Lyon 2007), and it involves monitoring, collecting, and/or the processing of personal data by a government. State surveillance is considered fundamental to both governance and social control, as it serves to identify individuals, order society, and ensure discipline. Contemporary capitalist nation-states are ‘surveillance societies’ (Lyon 1994, 2001, 2007), meaning that surveillance has become a key mode of ordering in late capitalism (Lyon 2007).

A relevant example of ordering society and ensuring discipline is the use of drones for police traffic surveillance and crime surveillance, which has been observed as dangerous, even more than civilian drones, and their use has raised concerns regarding privacy (Finn and Wright 2012). Aerial surveillance may damage an individual’s freedom and privacy and create further threats to privacy in cases of mapping people-to-people relationships, re-identification by location, public dissemination of health data, etc. (Chulvi 2020). Contrary to CCTV cameras, drones can also collect information from private places that individuals have tried to prevent from being seen, for instance, by establishing walls, fences, or other objects (Vermeulen 2014). In common-law countries, like the United States of America, Canada, Australia, New Zealand, and Singapore, such collection from drones may also be considered as property trespass or nuisance20.

It must also be underlined that deep learning approaches for object detection and action recognition can be successfully applied in drone surveillance (Mishra et al. 2020). Deep learning approaches can be used for the automatic detection of human actions. In this sense, drone technology seems to interfere mainly with informational and location privacy rights. Drones equipped with high-resolution cameras, sensors, and recorders can be piloted remotely for pinpoint surveillance; they also incorporate cameras or other equipment that can capture photos or record videos, which may result in the violation of privacy. Using a drone makes it possible to collect sensitive information, monitor people’s movements, and create detailed profiles about them using wireless localization (Mohsan et al. 2022). The anonymity of their flights also extends the privacy issues caused by drones since the drone pilot or the flight’s purpose cannot be easily identified by the public, thus making accountability and the enforcement of legal regulation difficult21 The purpose detection problem and the identification problem are considered as two important scientific gaps for drones that allow privacy invasion attacks (Mekdad et al. 2023). In disaster zones, information regarding identified individuals, such as their location, property, and health, can be collected and stored, with the threat of future misuse. The Guardian reported in 2015 that the Nepalese government established new regulations about the use of drones in disasters after concerns that drone footage after an earthquake had captured “images of historic artefacts which could be misused later22”.

Due to the climate crisis as aforementioned, disasters are likely to become more frequent and intense over the years. Therefore, the embedment of drone surveillance looms on the horizon as drone use in case of disasters seems inevitable. This consists of the threat that drone surveillance for safety and security reasons may become increasingly “normal” and, as Giorgio Agamben (Agamben 2005) says, not remain as a means of use in “states of exception” but spread and become a part of expected forms of governmentality. In this sense, long-term privacy rights are most likely to be affected, since the feeling of constant mass surveillance through drones is present and is highly likely to bring about the chilling and panopticon effect and, thus, deter people from exercising their legal rights.

4.4.2. Privacy Issues That Emerged from the Use of Drones in the COVID-19 Pandemic

Several human rights activists have criticized the use of drones, especially during the COVID-19 pandemic, due to the potential abuse of civil rights, such as the protection of privacy, and some drone programs have been suspended. For example, a drone program with software using biometric readings to understand population patterns and allowing quicker reaction time to ongoing events or potential health threats has been canceled in Connecticut due to privacy concerns (Kimery 2020). Furthermore, in May 2020, the Conseil d’État, France’s highest administrative court, issued a decision banning French authorities from using drone surveillance to track individuals violating social distancing rules23. The Court cited privacy issues with drone surveillance and stated that drone surveillance by police would be banned until the technology is added to prevent the filming and identification of individuals or approval is given by France’s privacy regulator.

Despite the criticism, as aforesaid, drones were widely used during the pandemic by many states as a means of surveillance, mainly for monitoring social distancing, thus widely affecting the informational and location privacy of individuals. Due to the severity of the pandemic, such privacy concerns have been hidden in the shadows so far (Butt et al. 2021), and exceptional legislation has, at the same time, created an increasing “chilling effect” on individuals, potentially eliminating opponent voices.

In this sense, it has been argued that the acceptance of state drone surveillance in the COVID-19 pandemic is likely to narrow the scope of some rights, such as the right to privacy, and justify long-term restrictions that will permanently change their shape, as well as create uncertainty when it comes to the proportionality and justifiability of limitations on rights (Gozdecka 2021). It can also generate new tools that governments could use to track citizen movement and interactions when the lockdown is lifted (Chulvi 2020). Finally, it has been argued that such control measures have the potential to become a relatively permanent fixture in the arsenal of state responses (Gozdecka 2021), leading gradually to permanently increased government surveillance, which constitutes one of the most significant threats to personal privacy.

5. Tackling Privacy Concerns Emerging from the Use of Drones in Disasters in the Scope of the Mass Surveillance Jurisprudence of the European Court of Human Rights and the Court of Justice of the European Union

5.1. Are Drones Subject to National Civil Aviation Law or Extensively Regulated by EU Legislation? Are Privacy Issues Adequately Addressed in Drone Regulatory Framework?

Drones, in terms of international law, are subject to the national civil aviation law of the states. Of course, it is important to mention that, nowadays, globalization forms the necessary environment for harmonized international law regarding unmanned aircraft systems comparable to that of manned operations.

Several efforts have been made so far regarding UAV regulatory harmonization. For example, the International Civil Aviation Organization has produced several international standards, recommended practices, and policies (Lee et al. 2022). Nevertheless, there is no clear reference to privacy matters in international contexts, such as ICAO Cir 328, unmanned aircraft systems (UASs) (Maniadaki et al. 2021).

Another notable organization for international harmonization for UAVs is the Joint Authorities for Rulemaking on Unmanned Systems (JARUS), which includes a group of UAV experts from national and regional aviation authorities (Lee et al. 2022).

Under these conditions, it seems that the need for the international harmonization of drone regulation has already been embedded and should finally be realized and expanded to privacy issues, including emergencies.

On the other hand, according to the Strategy for drones in Europe, “by 2030 drones and their required eco-system will have become an accepted part of the life of EU citizens”24. So, as far as EU law is concerned, the EU has an extensive and harmonized regulatory framework for drones, including technical details regulating the safety and security of drone use. However, this framework includes rather fragmentary and general privacy protection and emergency management provisions.

In the following table (

Table 1. EU drone regulatory framework.

Legal Act	Brief Content	Provisions Regarding Privacy	Provisions Regarding Emergencies
Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018.	Regulation of civil aviation.   European Union Aviation Safety Agency creation.	Protection of privacy and personal data in accordance with the Union law (Article 56).
Commission Delegated Regulation (EU) 2019/945 of 12 March 2019, on unmanned aircraft systems and operators of unmanned aircraft systems from third countries.	Definition of categories of unmanned aircraft systems (Open, certified, specific category).	Need for a risk assessment for the “specific” category (Article 40).
Commission Implementing Regulation (EU) 2019/947 of 24 May 2019, on the rules and procedures for the operation of unmanned aircraft.	Establishment of geographic zones for unmanned aircraft systems (UAS).	Acknowledgement of the importance of privacy and data protection in various articles.   Definition of UAS geographical zones and the establishment of registration systems for safety, privacy, personal data protection, security or the environment, and risk assessment for the “specific” category.	National aviation authorities can authorize drones to operate in restricted or controlled airspace if necessary to address emergency response efforts.
Opinion 01/2020 of EASA (European Union Aviation Safety Agency).	Regulatory framework for the U-Space.	Privacy is a major threat to the development of UAS market as UAS operations are and can be conducted closer to people (Summary). One of the main objectives of the U-space services is to ensure that environmental, security, and privacy requirements applicable in the Member States are met (Chapter IV of the Opinion).
Commission Implementing Regulation (EU) 2021/664 of 22 April 2021 on a regulatory framework for the U-space	Regulatory framework for the U-Space.   “U-space airspace” is the geographic zone designated by Member States where drone operations are permitted only with the support of U-space services. U-space is the traffic management system for unmanned aircraft systems (UAS).	Acknowledgement in various parts of the need for respecting applicable privacy requirements, mainly due to the rising number of UAS entering the airspace and due to the increased complexity of operations of UAS beyond visual line of sight (BVLOS).
Commission Implementing Regulation (EU) 2021/665 of 22 April 2021, amending Implementing Regulation (EU) 2017/373	Amendments regarding the requirements for providers of air traffic management/air navigation services and other air traffic management network functions in U-space airspace designated in controlled airspace.
Commission Implementing Regulation (EU) 2021/666 of 22 April 2021, amending Regulation (EU) No 923/2012.	Amendments regarding requirements for manned aviation operations in U-space airspace.
AI ACT (Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828.	Harmonised rules on artificial intelligence.   Drones are explicitly mentioned in Annex I Section B of AI Act.	The use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage should be prohibited because that practice adds to the feeling of mass surveillance and can lead to gross violations of fundamental rights, including the right to privacy (Preamble 43).   The right to privacy and the protection of personal data must be guaranteed throughout the entire lifecycle of the AI system (Preamble 69).   Union law on the protection of personal data, privacy, and the confidentiality of communications is applicable in connection with the rights and obligations laid down in this Regulation (Article 2(7).   Exceptional process of special categories of personal data, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons (Article 10 (5).   Privacy-preserving measures including pseudonymisation (Article 10).   A fundamental rights impact assessment is necessary for high-risk AI systems (Article 27).	Under certain conditions, rapid availability of innovative technologies may be crucial for the health and safety of persons, the protection of the environment and climate change and for society (Preamble 130).   Provides for derogation from conformity assessment procedure for a limited period for exceptional reasons of public security or the protection of life and health of persons, environmental protection, or the protection of key industrial and infrastructural assets (Article 46 (1).   Allows derogation in favor of law-enforcement or civil protection authorities in a duly justified situation of urgency for exceptional reasons of public security or in the case of specific, substantial, and imminent threat to the life or physical safety of natural persons, law-enforcement authorities or civil protection authorities Article 46 (2).

), the EU drone regulatory framework is presented, separately mentioning the provisions regarding privacy and emergencies, which are important, though they are proven to be fragmentary and general, mainly acknowledging the need for respecting applicable EU personal data and privacy law.

It must be mentioned that the Artificial Intelligence Act, although not issued only for drones, is of major significance for their proper use, since they are explicitly mentioned in it as well as since drone surveillance, as already mentioned above, may also be used along with facial recognition or big data analytical software in the data collected. As is evident from Table 1, the AI Act is the only relevant legislation containing concrete provisions regarding emergencies. In this sense, the AI Act seems to aim to cover the need to make innovative technology rapidly available as a reason for derogation from the conformity assessment. Nevertheless, no additional criteria are provided for providers or market surveillance authorities (MSAs) to assess when the availability is ‘crucial’ or when an exceptional reason is present (Ooms and Hendrickx 2024). It has been further reasonably argued that Article 46 (2) is unclear regarding the requirements of urgency and exceptional reasons (Ooms and Hendrickx 2024). At the same time, a crucial role of market surveillance authorities is recognized during the whole derogation procedure, while according to Article 70 (3), MSAs must be prepared for their tasks with sufficient expert personnel.

In conclusion, it is evident from the above that the European Union has developed a comprehensive drone regulatory framework to develop the promising sector of drones, focusing especially on safety and security matters. Nevertheless, in this detailed framework, privacy protection provisions are vaguely and fragmentarily formulated in a rather general manner, acknowledging, mainly, the need for respecting applicable EU personal data and privacy law. A parallel application of the Union’s privacy protection legal framework is, thus, necessary. However, the application of many different legal acts may confuse drone users regarding the way such acts complement each other. It is remarkable that in a recent survey, 39% of drone-using police participants chose “legal framework” as a limiting factor of drone usage (Klauser 2021). Due to the seriousness of the matter, one would at least expect a special chapter about privacy and personal data protection in the EU special drone regulatory framework so that privacy protection is directly ensured. The same problem arises with drones in emergencies since the absence of relevant provisions in drone special legislation is more than evident despite the rising use of drones in emergencies. Although the AI Act is the only act with a special article regarding urgency and exceptional reasons, it still contains dubious provisions, leaving a wide margin for interpretation.

5.2. Protection of Privacy According to the Jurisprudence of the European Court of Human Rights (ECtHR) and Court of Justice of the European Union (CJEU)

5.2.1. Short Description of the Protection of Privacy in the ECHR

After reviewing the international and European special drone legislation and considering that provisions regarding the protection of privacy are mostly fragmentary, vague, and general in all relevant acts, it seems necessary to examine whether there exists an alternative privacy protection mechanism that can also be addressed for drones in disasters.

Thus, privacy is protected by numerous international binding contexts. The European Convention on Human Rights is important because it applies to all EU countries that are parties to the Convention.

Article 8 of the ECHR outlines rules on the protection of privacy: “Everyone has the right to respect for his private and family life, his home and his correspondence”. However, the right to private life is not guaranteed as an absolute right. According to paragraph 2 of the same Article, limitations are allowed as long as they are in accordance with the law and necessary in a democratic society in the interests of national security, public safety, or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or the protection of the rights and freedoms of others. Any limitations need to first pass the “democracy test” (Mitrou 2009), meaning that a limitation may be necessary first only if there is a need for the specific settlement of measures for the public interest objective pursued (appropriateness). If a limitation is proven to be strictly necessary, it must also be assessed to determine whether it is proportionate. Proportionality means not only limited to what is necessary but is also understood under the notion that the advantages resulting from the limitation should outweigh the disadvantages the latter causes in the exercise of the fundamental rights at stake. In addition, to reduce disadvantages and risks to the enjoyment of privacy rights, limitations must contain appropriate safeguards (Maniadaki et al. 2021).

5.2.2. Protection of Privacy in the Mass Surveillance Jurisprudence of the ECtHR

The ECtHR is regarded as one of the world’s most powerful and pro-privacy courts. According to the jurisprudence of the ECtHR, a three-step test must be applied so as to assess the interference according to Article 8 ECHR: (1) if it is “in accordance with the law”, meaning if it is based on a provision of domestic law with certain quality to be accessible to the persons concerned and foreseeable as to its effects, (2) if it pursues a legitimate aim, and (3) if it is “necessary in a democratic society”. At its early jurisprudence, the ECtHR had judged that the “notion of necessity implies that the interference corresponds to a pressing social need and that it is proportionate to the legitimate aim pursued”25. The requirement of “necessity in a democratic society” has evolved over the years by balancing “whether it is possible to achieve the aims by less restrictive means”, while, at the same time, domestic law needs to provide “adequate and effective safeguards and guarantees against abuse”26 (Maniadaki et al. 2021). The ECtHR has consolidated such safeguards in cases of secret surveillance measures, and they are widely known as the six Weber safeguards27.

According to the ECtHR, “private life is a broad term not susceptible to exhaustive definition” and “elements such as gender identification, name, sexual orientation and sexual life are important elements of the personal sphere protected by Article 8”, while it also recognizes a zone of interaction of a person with others, even in a public context, which may fall within the scope of “private life”28. In the Peck v. UK case, regarding CCTV footage of a person in the process of attempting suicide on a public street, the ECtHR judged that Article 8 applied even though the applicant was in a public street because he was not participating in a public event and was not a public figure. It further judged that the demonstration of the effectiveness of CCTV was not a relevant or sufficient reason to support the disclosure of the CCTV footage to the press, which revealed the applicant’s identity, and there had been insufficient safeguards put in place to ensure protection of the applicant’s identity and the protection of his personal data.

In its most recent decisions, Big Brother Watch29 and Centrum för rättvisa v. Sweden30, which have been characterized as the Grand Normalization of Mass Surveillance (Milanovic 2021), the ECtHR now appears to adopt “lower” and “thinner” standards from the perspective of privacy by focusing primarily on even more procedural safeguards and affirming, at the same time, the prima facie legality of mass surveillance measures. This means that, in principle, government surveillance is regarded as acceptable in the frame of the “inevitability” narrative of mass surveillance (Zalnieriute 2021). Such judgments by the ECtHR have significant implications for privacy law since they open the path for a highly permissive approach to government surveillance. The Court’s focus on the procedural safeguards required for surveillance systems has been criticized by academia as procedural fetishism (Zalnieriute 2021, 2023a) and by its judges31.

The prima facie legality of mass surveillance measures and the persistence on procedural safeguards are also most evident in the case Glukhin v. Russia, which was the ECtHR’s first ruling on facial recognition technology. In this case, the usbe of facial recognition technology was considered a significant interference with Glukhin’s right to privacy. The Court stated that under the given conditions of a peaceful protest, the use of facial recognition technology was not necessary in a democratic society, and sufficient safeguards had not been applied. Despite the outcome of the decision, this decision has been criticized because it fails to consider the substantive legality of facial recognition technology and instead focuses once more on procedural safeguards. This way, the Court implicitly approved the use of surveillance technologies such as facial recognition technologies, although it has been argued that such surveillance technologies may make law enforcement policies resemble authoritarian regimes, even in liberal democracies (Zalnieriute 2023b).

The reviewed jurisprudence of the ECtHR, although not ad hoc, is also crucial for drone cases since it refers to surveillance in public places and mass surveillance technologies. As mentioned, state drone surveillance for facilitating law enforcement is one of the most common and rising uses of drones, which may create privacy concerns due to the nature of drones as mass state surveillance tools. According to relevant ECtHR jurisprudence, it could be argued that the use of drones by the state would be prima facie legitimate in disasters, which are situations of great distress and emergency, even when equipped with AI tools, if procedural safeguards are followed. Considering that terrorist- induced disasters are analogous situations to natural and technological disasters, the relevant case law of the ECtHR regarding fighting international terrorism can also be applied by analogy.

5.2.3. Short Description of the Protection of Privacy According to EU Law

Article 7 of the Charter of Fundamental Rights of the European Union is the Article that explicitly protects private and family life.

However, since personal data are closely linked to an individual’s private life, ensuring their secure and fair processing helps protect privacy. In this sense, the EU’s basic tools for data protection, namely Article 8 of the Charter of Fundamental Rights of the European Union as well as the General Data Protection Regulation (GDPR) and Police and Criminal Justice Authorities Directive, although not explicitly using the term “privacy” in every instance, are all rooted in the idea that safeguarding personal data is essential for protecting individuals’ privacy and fundamental rights. GDPR, which regulates how data are collected, processed, and shared, is the most comprehensive, direct, and powerful act for privacy protection in the European Union.

The following table (

Table 2. GDPR key articles relevant to drone-based data collection.

Article	Brief Content	Relation with Drone-Based Data Collection in Disasters
ARTICLE 5	Principles relating to processing of personal data.	Principles to be applied also to drone-based data collection in disasters: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitations; integrity and confidentiality; and accountability. Obligations and rights stemming from this Article may be restricted in case of disasters according to Article 23 GDPR
ARTICLE 6 (1) (e)	Processing is lawful when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.	Can be applied to drone based data collection in disasters as a valid legal basis (performance of a task carried out in the public interest).
6 (3)	The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued	An objective of public interest shall me met and be proportionate to the legitimate aim pursued
ARTICLE 9	Processing of special categories of personal data (genetic data, biometric data for the purpose of uniquely identifying a natural person) is not prohibited in special circumstances.	Can be applied to special categories of drone-based data collection in disasters as a valid legal basis (processing for reasons of substantial public interest/processing for reasons of public interest in the area of public health/processing must be proportionate and with sufficient safeguards).
ARTICLES 12–22	Transparent information, communication and modalities for the exercise of the rights of the data subject. Information to be provided where personal data are collected from the data subject. Information to be provided where personal data have not been obtained from the data subject. Right of access by the data subject. Right to rectification. Right to erasure (‘right to be forgotten’). Right to restriction of processing. Notification obligation regarding rectification or erasure of personal data or restriction of processing. Right to data portability. Right to object. Automated individual decision-making, including profiling.	Obligations and rights stemming from these Articles (12–22 and 34) may be restricted in case of disasters according to Article 23 GDPR.
ARTICLE 34	Communication of a personal data breach to the data subject.
ARTICLE 23 (1) (e)	Permitted restrictions to personal rights for Union or Member State law for the pursue of important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security.	Can be applied to drone data collection in disasters. Restrictions must respect the essence of the fundamental rights and freedoms and must be a necessary and proportionate measure in a democratic society.
ARTICLE 35	Data protection impact assessment.	Systematic and large-scale drone use in disasters falls into the scope of this Article since it is highly likely to result in a high risk to the rights and freedoms of natural persons.

) presents relevant GDPR key articles, mentioning separately their brief content and their relation to drone-based data collection in disasters.

It is evident from the above table that GDPR may be, in the first place, applicable to drone-based data collection in disasters, regulating, in detail, personal data issues; however, according to Article 23, affirmed major rights and obligations can be restricted in the case of disasters. As is also explicitly stated in Preamble 73 of GDPR, such restrictions “may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including the protection of human life especially in response to natural or manmade disasters”… “Those restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms”. In its recent jurisprudence, C-268/21 Norra Stockholm Bygg32 (preliminary ruling), concerning the production of a document containing personal data in civil court proceedings and the interpretation of Article 6 (3) and (4), the CJEU judged that restrictions under 23 GPDR must respect the principle of proportionality. The CJEU mentions inter alia that the right to the protection of personal data is not an absolute right but must be considered in relation to its function in society and be balanced, in accordance with the principle of proportionality, against other fundamental rights. The CJEU further concludes that the national court is required to have regard to the interests of the subjects concerned and to balance them according to the circumstances of each case.

The same idea is reflected in the Guidelines 10/2020 on restrictions under Article 23 GDPR, issued by the European Data Protection Board33. According to these guidelines, restrictions should be interpreted narrowly, applied only in specifically provided circumstances, and enforced when certain conditions are met. Additionally, the link between the proposed restrictions and the objective pursued must be clearly stated in the legislative measure. When the EU or national legislator establishes restrictions based on Article 23 GDPR, it must ensure compliance with the requirements set out in Article 52 (1) of the Charter, particularly by conducting a proportionality assessment to ensure that restrictions are limited to what is strictly necessary. In this context, Article 52 (1) of the Charter of Fundamental Rights of the European Union is crucial for establishing permissible restrictions. Article 52 (1) establishes the principle of proportionality and allows limitations on the exercise of rights and freedoms recognized by the Charter, similar to the ECHR, provided they are grounded in law, respect the essence of protected rights, and are necessary and appropriate.

However, the explicit application of Article 23 GDPR in the Member States’ law is relatively rare. A relevant example that is also mentioned in Section 5.2.5, below, is the intelligent video surveillance systems, including drones, that were permitted in France during the Olympic and Paralympic Games, under Article 10 of the Law Nr. 2023-380 of 19 May 2023 on the 2024 Olympic and Paralympic Games, inter alia for fire and rescue services, which fall under the scope of GDPR. The French Data Protection Authority (CNIL) did not explicitly reference Article 23 GDPR in its deliberations34 concerning surveillance measures implemented under this law. Still, the CNIL addressed principles that align with the considerations outlined in Article 23 GDPR, such as the necessity and proportionality of data processing activities and the importance of safeguarding individual rights.

5.2.4. Protection of Privacy in the Mass Surveillance Jurisprudence of the CJEU

Through its jurisprudence, the CJEU seems to form the same requirements as the ECtHR regarding permitted limitations on protected rights. In this sense, it requires the “existence of clear and precise rules” and “minimum safeguards” to protect rights against abuse.

Regarding video surveillance of public spaces, the CJEU has adopted a narrow interpretation of permitted exceptions. In Case C-212/13—Rynes v. Úřad pro ochranu osobních údajů35, the CJEU judged that the operation of a camera focusing on a public space but installed on a family home for the purposes of protecting the property, health, and life of the home owners cannot be considered as included in the exceptions of processing personal data “by a natural person in the course of a purely personal or household activity”.

However, in Tele 2 and Digital Rights Ireland, the CJEU recognized that the objective of combating serious crime and ensuring public security36 is paramount. It, thus, affirmed that measures aimed at protecting national security, public safety, and serious crime prevention can, in principle, justify restrictions on fundamental rights. However, the Court did not define “serious crime”, thus allowing countries to define which crimes qualify as “serious” under their national legal systems. On the contrary, in Ministerio Fiscal,37 the Court examined whether access to such data is limited to investigations into serious crime or if it can also be used for less serious offenses and judged that if the interference to human rights affected is not serious, then the limitations can also be applied for the objective of preventing, investigating, detecting and prosecuting criminal offenses generally. In the Peter Puškár case,38 the Court analyzed the proportionality principle and accepted that tax fraud undermines the public interest and that restrictions to data protection are allowed if they constitute a measure necessary to safeguard an important economic or financial interest of a Member State or the European Union, including monetary, budgetary, and taxation matters.

Of major importance are the cases Privacy International39, La Quadrature du Net and Others40, and G.D. v. Commissioner of An Garda Síochána41 regarding bulk general and indiscriminate interception and retention of communications by intelligence agencies for national security and serious crime prevention purposes. Under sufficiently concrete circumstances and provided that “clear and precise rules” and “effective safeguards against the risks of abuse” exist, legislative measures allowing mass and indiscriminate data interception and retention are permitted”. This way, mass surveillance is deemed again also by the CJEU prima facie legitimate for national security and serious crime prevention purposes. Such cases, as foresaid, regarding fighting international terrorism can also be applied by analogy in cases of natural and technological disasters that have many commonalities with terrorist-induced disasters, thus considering drone mass surveillance in disasters also prima facie legal.

5.2.5. Mass Surveillance Jurisprudence in Member States: The Case of France

Similarly, in its Décision n° 2023-850 DC of 17 May 2023, Conseil constitutionnel (Constitutional Council), France approved the controversial surveillance measures included in the Olympic Games law42. This law permitted, on an experimental basis and until 31 March 2025, the use of intelligent video surveillance systems (algorithmic video surveillance technologies, not facial recognition technologies), including drones, to ensure the security of the Olympic events, raising, in this way, important questions about privacy and civil liberties, due to the mass surveillance regime established, although for a temporary basis. This decision is crucial since it refers to a European country and is in line with the Glukhin v. Russia decision of the ECtHR, although it was issued two months earlier and in line with the AI Act but issued one year earlier than the AI Act was entered into force. It has, thus, been evident that the trend for the prima facie legality of mass surveillance measures has already been embedded in the Courts of the Member States’ jurisprudence and seems difficult to reverse despite the criticism.

6. Conclusions—Discussion: Rethinking the Use of Drones in Disasters—Future Challenges

Ten core conclusions can be drawn based on the previous analysis:

(a)

Due to the climate crisis, natural disasters have become more frequent and more intense over the years.

(b)

Drone applications in disasters are extremely promising, and the European Union promotes them. Due to their unique opportunities, drones have actually become indispensable tools in disasters.

(c)

Drones are mass surveillance tools that generate considerable threats to privacy, and even in the digital age, the idea of a reasonable expectation of privacy exists (Mund 2018).

(d)

Drones are extensively regulated in the European Union as far as safety and security matters are concerned; however, existing privacy protection provisions and provisions for the management of emergencies in the EU’s drone legal framework are rather fragmentary and general, mainly acknowledging the need for respecting applicable EU personal data and privacy law.

(e)

The EU personal data and privacy protection framework, especially GDPR, affirms important rights and obligations to secure privacy rights while allowing restrictions on affirmed major rights and obligations in the case of disasters.

(f)

Advanced democracies prefer to deal with emergencies through ordinary legislation rather than declaring a state of emergency, and this was also proven during the pandemic.

(g)

The European Union currently lacks a consistent regime d’exception.

(h)

Naturally caused disasters or unintentionally, by negligence, caused technological disasters can be deemed analogous situations with terrorist-induced disasters.

(i)

Mass surveillance measures are considered prima facie legal both by the ECtHR and CJEU, especially when fighting terrorism. Artificial Intelligence can currently be applied to drones in emergencies in the EU, with a wide margin of appreciation from the Member States.

(j)

Due to the COVID-19 pandemic, people have become more familiar than in the past with being tracked and monitored by the state. Exceptional legislation was the norm during the pandemic, and concerns regarding human rights have been hidden in the shadow of the emergency. There are fears expressed that increased government surveillance may gradually become permanent, and long-term privacy rights are likely to be affected.

It is further undisputable that the primary duty of Member States in the case of disasters is to safeguard the right to life, on which the enjoyment of all other human rights depends43. It is true that if people are given a choice between privacy and life, they will undoubtedly choose life. Still, all human rights must be considered and adequately protected in all circumstances, even in disasters. Otherwise, individuals face the danger of losing their political character (Agamben 2002) and being transformed into biological beings without their will (Agamben 2005); therefore, it is important to protect affected human rights, even in extreme emergencies such as disasters.

Under the given conditions, future challenges in the European Union for the use of drones in disasters include the following:

(a)

Preparedness for disasters during ordinary times is needed to minimize their frequency and intensity and, thus, minimize the need for using surveillance tools. However, long-standing restrictions with a profound impact on rights and freedom should be avoided during the preparedness phase; otherwise, that would lead to a perpetual emergency and long-term “justifiable” limitations on human rights, such as privacy.

(b)

Judges need a deep understanding of surveillance technologies, such as drones, to assess their inevitability effectively in given circumstances and successfully apply the proportionality test by checking extensively whether no other less restrictive means exists and whether the guarantees set are enough.

(c)

Building trust between citizens and the state that surveillance powers in disasters serve only the purposes set so that no chilling effect is produced and democratic values are adequately protected is necessary. Citizens are still in the phase of forming impressions about drones, and such trust is necessary for the effective adoption of drone technology in disasters.

(d)

Special drone regulations in the EU should be revised to address privacy protection issues and emergency management directly. A special chapter about privacy, personal data protection, and emergencies in the EU special drone regulatory framework would be useful.

(e)

Reform of the EU’s so-called “emergency competences” is required so that ambiguities are avoided and democratic legitimacy is not undermined.

(f)

Advanced interpretation of ECHR and EU Law and a reversal of the trend that mass surveillance powers are prima facie legal are required, so as to build trust with the public in the state and drones become more accepted.

(g)

Revision of the AI Act with clearer limitations of Artificial Intelligence applications in emergencies is necessary.

(h)

The ultimate goal would be to maintain a broad democratic notion of the right to privacy in the EU.

It would be an illusion to believe that drone use could be easily prohibited for the sake of privacy. Further, it would be an illusion to believe that even if drones are strictly regulated against privacy risks, they could easily be checked by authorities and judges to ensure they comply with the regulations, especially in disasters. On the one hand, it is difficult to distinguish—if not an expert—between convenience and necessity, and, on the other hand, as aforesaid, no universally shared understanding of privacy exists, and privacy has a dynamic meaning. Disasters such as the COVID-19 pandemic have shown that privacy concerns are underestimated in extreme conditions. It is remarkable that, despite the global character of the pandemic, measures for fighting it by sovereign states have not been identical. However, the wide use of surveillance tools during the COVID-19 pandemic, including drones, poses critical questions for the future. The COVID-19 pandemic has been characterized as signifying a dramatic transition from ‘over the skin’ to ‘under the skin’ surveillance (Harari 2020).

In a world with a narrowed and blurry scope of privacy, fewer privacy risks arise, and relevant legislation becomes less necessary. Is this the case now? Is this the time when important liberties won slowly through history shrink rapidly, significantly, and permanently in the extreme conditions of the pandemic? Should we remain obedient and silent in a world with less privacy and more surveillance?

No, on the contrary, it is the time that the EU promotes the use of drones and the time that drones have become indispensable tools in disasters, so ensuring the safe deployment of drones in future disasters is essential, without “hiding human rights protection in the shadows”. Whatever the new emergencies may be, it is important to embed that people can enjoy their right to life and health as well as their right to privacy at the same time. Choosing among them is not the right choice, even in disasters. Surveillance technologies such as drones must be legitimated and justified in every application against privacy risks to gain public acceptance. However, legitimization and justification alone do not necessarily lead to public acceptance. In a democratic society, national and regional authorities must communicate and negotiate constantly with their citizens to find a mutually acceptable balance between individual freedom and communal well-being (Gozdecka 2021). Public opinion is the primary tool for achieving a society with democratic functions (Sabino et al. 2022). In this sense, the state must invest in targeted actions for the public to build trust and acceptance of drones. Such trust can be built through enhanced transparency regarding the scientific evidence driving administrators’ choices (Iamiceli and Cafaggi 2023).

Under present circumstances, drones, when necessary for disaster management, appear to be safer if their use takes place on a local scale, case-by-case basis without instituting surveillance regimes. On a local scale, any negative impact of drones is minimized since surveillance in this way focuses on fewer individuals, is by nature more temporary, and does not consist of a “serious” interference in human rights that could lead to a chilling effect on citizens. It is also easier for the public to be informed and accept such use locally rather than centralized monitoring. At the same time, satellite remote sensing may better serve centralized monitoring goals in the case of disasters since it raises fewer privacy issues. International disaster management services like Copernicus EMS have already integrated satellite remote sensing (Kucharczyk and Hugenholtz 2021).

However, surveillance programs on a large scale are highly likely to be essential in the future, even in disasters, and, therefore, it is crucial to avoid any simplified, immature, and consequently dangerous approach to the use of drones as surveillance tools. New emergencies will be more global than in the past. The COVID-19 pandemic was a global disaster. Climate-crisis-related disasters have a global character, too. Challenges to privacy protection have become more global nowadays than ever before, especially in disasters. These new global challenges to privacy, which have far-reaching consequences for communities and individuals, can no longer be solved solely at a national level (Lachmayer and Witzleb 2014). The international harmonization of drone regulations, even in disasters, is, therefore, essential. EU Member States should capitalize on the efforts made so far for a direct and broad harmonization of drone regulation, which would also cover privacy issues. Initiatives like the Disaster Charter and the Proposal for the WHO Pandemic Agreement44 could be roadmaps for such future actions.

On 5 May 2023, the World Health Organization announced that it was ending the emergency declared for COVID-19 more than three years ago. However, health experts do not view the lifting of the global emergency as a milestone but as a warning. For example, Dr Margareth Dalcolmo, a well-known respiratory physician and member of Brazil’s National Academy of Medicine, advised to “take the end of COVID-19 merely as an alert, a time to start being prepared for the next pandemic” (Nolen 2023). Considering that our globalized world is now preparing for new emergencies and possible disasters, lessons learned from fighting the COVID-19 pandemic could be vital to balance and adequately protect threatened liberties, particularly to maintain a broad democratic notion of the right to privacy. We need to understand that even living in a world of emergency does not mean that human rights are ephemeral.