Remote Sensing and the New European General Data Protection Regulation

Paper number

IAC-17,E7,3,8,x39782

Author

Mr. Brendan Cohen, Cleary Gottlieb Steen & Hamilton LLP, United States

Year

2017

Abstract

In the three decades since the United States first commercialized satellite images from space under the LANDSAT program, earth observation satellites have improved dramatically.  Currently, the highest resolution images that are commercially available are provided by DigitalGlobe’s WorldView-3 satellite, for which each pixel in a captured image corresponds  to approximately 31 cm.  While this is not yet sufficient to be able to see an individual person, image resolution will only get better and is certainly high enough today to discern details like cars and, as DigitalGlobe advertises, “manholes and mailboxes.”

     A new European General Data Protection Regulation (“GDPR”) ((EU) 2016/679) was adopted on April 27, 2016 and will begin to apply on May 25, 2018.  Under this regime, “personal data” is broadly defined and includes any information relating to a person who can be directly or indirectly identified in particular by reference to other data.  Any entity that, directly or indirectly, collects or processes data of European Union residents is subject to the terms of the GDPR.

     Even if it is not yet possible to directly identify an individual using today’s satellites, commercial satellite companies arguably capture enough information to be able to indirectly identify an individual by reference to other imaged information.  Since a non-EU entity is subject to the GDPR if it is monitoring a subject’s behavior within the EU, any entity capable of collecting such data would arguably be subject to the requirements of the GDPR, even if taken from a satellite under the jurisdiction and control of, and processed in, a non-EU country.

     This paper will examine the new regulation that will be implemented by the GDPR and analyze its applicability to remote sensing applications.  Furthermore, it will consider how the regulation might be interpreted or amended in order to meet the GDPR’s objective of balancing individuals’ rights to control the use and processing of their personal information with both the freedoms to use outer space guaranteed under the Outer Space Treaty and the economic reality of the utility of high-resolution space-based data collection for commercial purposes.

Abstract document

IAC-17,E7,3,8,x39782.brief.pdf

Manuscript document

IAC-17,E7,3,8,x39782.docx (🔒 authorized access only).

To get the manuscript, please contact IAF Secretariat.