In recent years, the water and wastewater industries have increasingly begun utilizing unmanned aircraft systems (UAS) — commonly known as drones — to conduct visual inspections and monitoring of facilities and infrastructure including water towers and other remote and hard to reach locations. In fact, New Jersey American Water, an early adopter of drone technology in the water industry, conducted nearly 200 drone flights in 55 locations in 2017.
Although drones have the ability to increase efficiency and decrease costs in the water and wastewater industry, water and wastewater entities utilizing drones are now required to comply with new federal laws enacted as part of the FAA Reauthorization Act of 2018, which govern the information privacy practices of commercial drone operators in all sectors. The FAA Reauthorization Act of 2018 passed both houses of Congress with widespread bipartisan support and was signed into law by President Donald Trump on October 5, 2018.
Another statute of the Act expressly requires that commercial drone operators’ required privacy policies protect and respect personal privacy consistent with the United States Constitution and all federal, state, and local laws. Currently, there are no federal statutes other than the Act governing data collected or obtained by drones and there are no federal statutes governing data privacy and security in the water or wastewater industry, unlike industries such as financial services, healthcare, and education, whose data privacy and security practices are subject to sector-specific federal statutes and regulations. Although members of Congress have introduced legislation that would govern data privacy and security across all sectors, no such legislation has been enacted.
However, ensuring that their required privacy policies are consistent with state laws can pose a challenge to the water and wastewater industry given the rapidly evolving patchwork of data privacy and security statutes enacted by numerous states in recent months and years, many of which significantly differ from one another. States including New York, Massachusetts, California, Texas, Florida, and Pennsylvania have enacted statutes requiring businesses that collect or possess personally identifiable information to use reasonable proactive measures to protect such personally identifiable information from disclosure, including data breaches and cyberattacks that result in the dissemination of such information.
Although the California Consumer Privacy Act, which took effect on January 1, 2020, and the Nevada privacy statute, which went into effect October 1, 2019, impose significant obligations on businesses that process or collect the personal data of California and Nevada residents, these statutes only govern the collection or processing of data obtained from consumers. Since the water and wastewater industry does not use drones to collect data from or regarding consumers, these statutes are unlikely to be implicated by the industry’s use of drones. Since drone activity in the water and wastewater industries is largely limited to inspections of physical assets and infrastructure rather than monitoring or observing people, it is likely that water and wastewater industries could avoid having to comply with state data privacy laws simply by ensuring their drones do not collect any personally identifying information regarding people they inadvertently observe in the course of their activities. However, water and wastewater entities operating drones would be well advised to draft and adhere to privacy policies establishing that their drones are not used to observe or collect information regarding people and no such data will be collected regarding people inadvertently observed by drones.
Biometric data is an identifier of a person that is used to electronically identify such a person and can potentially include scans of a person’s face or iris, thermal imaging of a person, or a fingerprint. Thermal imaging, facial scanning, and other similar technologies can inadvertently collect biometric information regarding a person inadvertently observed by a drone using such technologies to inspect infrastructure or equipment such as water towers and such technologies are not typically necessary for such purposes. Therefore, drone users in the water and wastewater industry should consider ensuring that their drones are not equipped with such technologies. Industry drone users would also be well advised to spell out in their privacy policies that their drones are not equipped with thermal imaging or any other technology capable of collecting biometric data and their drones will not collect any such data from any person they inadvertently observe in the course of their activities.
Moreover, since some states have recently enacted statutes prohibiting the use of drones for illicit purposes such as voyeurism and surveillance of certain facilities including critical infrastructure without owner approval, entities in the water and wastewater sectors should provide in their privacy policies that the companies and their employees and agents are prohibited from using drones for non-essential activities including corporate espionage, surveillance of third party assets, or filming or photographing people in a potentially voyeuristic manner.
Although the data privacy requirements of the FAA Reauthorization Act of 2018 may seem frustrating and confusing to entities in the water and wastewater industry, such entities can overcome these challenges and successfully utilize drone technology by developing effective, efficient compliance strategies with the help of experienced data privacy and drone attorneys. WW
About the Authors: Bradford P. Meisel, Esq. is an associate at McElroy, Deutsch, Mulvaney & Carpenter LLP specializing in corporate, cybersecurity, data privacy, and drone law.
Diane D. Reynolds, Esq. is a partner and head of the Cybersecurity, Privacy, and Data Protection Practice at McElroy Deutsch, Mulvaney & Carpenter LLP, a law firm with approximately 275 lawyers in nine states, with expertise in corporate, labor and employment, construction, environmental, and real estate law.