@AJ – you may not like the process I described, but it would get you what you want.
@all
GDPR regulates the data processing, storage and access of personal data.
If ATC needs it for their tasks, they can process and store it, pass it to third parties, if covered by their tasks. Doesnt apply to others.
Question remains, is it personal data.
The IP adress is also broadcasted across the internet, but considered personal data which is legally restricted in its use.
Just because we broadcast our TX codes, ot does not exclude protection under GDPR. You also broadcast your licence plate information. It is still not allowed to have a cam and data base and publish lists, “which car was where at what time”
Afterthought for those who think it doesnt matter: Would you like such database being published?
If it is personal data, then you should only process and publish ot, if necessary in the context of a public task or private contract (to which we have agreed beforehand). Neither applies in vase of FR24 and the likes.
There is also an angle with the telecommunications acts of various countries, but the broadcasting quality makes it apparently more difficult to pursue.
Just because we have (generally) benign regimes in Europe and a (generally) reliable legal system, we should realize how quickly these can change. And limit available info as long and as far as we can…
Nope – just the right/wrong political leader.
Peter wrote:
I am sure it does not fall under GDPR. Is ATC registered under GDPR? I doubt it
I actually asked an EU ANSP in writing, spurred by the fact that when filing a FPL, the ARO office looked up the previous FPL (a week or two old). While this was convenient as in they could just copy the airplane data (equipment and surveillance string), I felt they had access to personal data of mine far beyond the time frame of the operational need.
Part of their answer was “FPLs don’t contain personal data in general, but GA pilots may put personal data in the remarks field, so we treat FPLs in a GDPR-compliant way as a precaution”. I vehemently disagree with their assessment. A FPL tracks a movement of a vehicle. In the context of private GA, saying that a FPL has no private data is like saying that tracking the movement of a car (or shoes) is not “personal data” because they are tracking only an object, not a person. Given the correlation between movements of the object and the person, this is private data. The correlation can be more or less good: prob 100% for shoes, often not much less for cars, sometimes rather less for planes (they are shared, rented out, …), but still a good two-digit percentage or 100% among a small group of people. But still, that correlation means it is private data.
On this basis every online shop would shut down, because they are storing your personal data far beyond operational need.
And I am sure 99.9% of people prefer that. When I order from Amazon I don’t want to re-enter all my details each time. I would not bother with such a shop; I’d go to the one which stores my data.
A google on your aircraft reg pretty well shows where you move about, and equally shows where you probably don’t go.
IMHO this is a lost battle.
Peter wrote:
A google on your aircraft reg pretty well shows where you move about, and equally shows where you probably don’t go.
Nobody has ever tracked my aircraft on a website until I was forced to install ADS-B OUT.
In the US I think the issue is about to erupt. Fairly obviously nobody thinks detailed tracking of individual aircraft should be provided to people who publish every detail on the internet moments later by tail number, along with the name and address of the owner… all based on information provided to them mandatorily under law. Imagine what would result if that info were available by typing in a car license plate on a website. Its obviously an aberration.
Just to elaborate on the GDPR and cars: if someone points a camera out of the window, records all the license plates of all the cars driving by and then automatically publishes this on the website – how legal is it these days?
I always thought that if it happens on a public street then you cannot do much about it.
Peter wrote:
On this basis every online shop would shut down, because they are storing your personal data far beyond operational need.
The spur behind personal data regulation is to change that. And that, if it is being stored for a legitimate need, it is not used for another usage that would not, in itself, justify keeping the data. Online shops have no need to close. I pay them for the wares that they send me, that is (I expect…) their business model. Having them delete data that is not necessary anymore does not impact that.
Peter wrote:
When I order from Amazon I don’t want to re-enter all my details each time.
You are welcome to consent to beyond-operational-need storage in exchange of more convenience for you. Shouldn’t be done without consent, is all. When I order as a “guest checkout” on a website, surely they need to store some information on the order for some time… Let’s say at most until the statute of limitations on me suing them in connection to that order expires. But it does not mean they are allowed to use it for commercial prospection for as long, or even at all.
arj1 wrote:
ust to elaborate on the GDPR and cars: if someone points a camera out of the window, records all the license plates of all the cars driving by and then automatically publishes this on the website – how legal is it these days?
I would think it is not legal nowadays. Not even to store for private use.
