The drones are already in the air, the privacy conversation is still on the ground

A drone can cross a boundary without opening a gate. It can follow a fence line in the dark. It can hover over a crowd. It can see what no fixed camera was ever capable of seeing.

Drones have become invaluable to South Africa’s socioeconomic landscape. They are no longer expensive toys for insatiable hobbyists or wannabe pilots, nor are they used only for specialist aerial work or occasional safety and security work. They are becoming part of the infrastructure that helps South Africa function in difficult conditions: protecting mines, monitoring critical infrastructure, supporting agriculture, assisting disaster response, strengthening anti-poaching efforts, improving security visibility, reducing risk to personnel and helping organisations make faster, better-informed decisions.

In a country under this much pressure, it is clear that these “eyes in the sky” are priceless.

The more valuable drones become to South Africa’s safety, security and economic resilience though, the more important it is that they are trusted and that accountability is truly lived, not just preached.

This conversation is especially urgent now.

Amid the 30 June protests across South Africa, in moments of possible public unrest aerial visibility can be invaluable. Drones can help with situational awareness, perimeter protection, crowd monitoring, early risk identification and safer decision-making by security teams and authorities.

It raises several questions, but there’s one I wonder about frequently: what happens to the footage of the people on the ground?

We have had this conversation before, about other tools. We argued, and continue to do so, about CCTV, especially in public spaces. About licence plate recognition cameras. About facial recognition, regardless of where it is engaged.

Yet, barring a few responsible drone operators, we have barely said a word about the hovering witness.

A drone is not just an aircraft. The moment it captures an identifiable person, it becomes part of a data-processing operation, and a different law steps in. Aviation rules decide whether the drone may fly. The Protection of Personal Information Act (Popia) asks what happens once the drone is airborne and it has opened its eyes: what triggers a recording, what is captured, why it is kept, who may see it, how long it lives, whether it may be shared, and who answers for all of it.

That is the conversation the drone industry should be leading. Instead, too much of it is looking the other way.

Drones are no longer a niche technology, one where we can plead ignorance due to its newness or make an umbrella statement which equates to a complete waiver of a data subject’s privacy expectation when in public. Drones are not hovering at the experimental edge of the security industry anymore. They are inside it.

A fixed camera sees where it was installed. A drone sees where it is sent. That is the advantage, but it is also the danger. The same drone that watches a fence can watch a person. The same flight that protects a perimeter can capture a home, a yard, a balcony, a worker, a child, a passer-by who has nothing to do with the reason the drone went up. This does not make a drone bad. It just makes it powerful. And powerful technology, used without discipline, does not stay trusted for long.

On 30 June, law enforcement, communities and businesses braced for the possibility of unrest. In moments like these, aerial visibility can save lives. Drones can help with situational awareness, perimeter protection, crowd monitoring and early risk identification, so that people are not sent blindly into volatile streets.

When tensions are high, when people are frightened, when the risk of vigilantism is real, surveillance technology must be held to its purpose. The public has to be able to trust that a drone overhead is there to protect people and property, not to intimidate, profile, target or quietly build a record of a community already under strain. Adhering to privacy legislation does not stop security. It merely disciplines it.

Popia does not say drones may never be used to keep people safe. It does not ask anyone to ignore risk or pretend our security reality is gentler than it is. It asks something far more reasonable: do the operator and the client actually understand what they are capturing, why, what they are doing with it, and when they must let it go?

The answers to these questions and the actual situation at hand at the time a drone is deployed, are exactly where the test of proportionality must be engaged. Footage from a routine patrol is not the same as footage from active unrest, an infrastructure attack or an immediate threat to life. Popia was never built to freeze every situation into one rigid rule. What is reasonable depends on the circumstances.

There is a comforting, albeit illusory, assumption that drone privacy is a grey area, because we have no drone-specific privacy statute yet. That assumption is dangerous. And wrong.

Popia already applies. If footage identifies a person, or can be linked to one, it is personal information. Capturing it, storing it, viewing it, sharing it, analysing it – all of it is processing. And processing carries obligations.

Usually, the client decides why the drone is needed and what the footage is for. The operator flies on the client’s behalf. That arrangement does not let either of them off the hook. “We thought the drone company handled that” is not a defence, and neither is “we just flew where we were told”.

Responsible drone privacy is about the governance and accountability that accompanies the footage the instant it is created. A drone operator that wants to be trusted should be able to answer, without flinching:

• Why is this drone flying, and on what lawful basis?;
• Who is responsible for the footage, and who may access it?;
• How long is it kept, and how is it secured?; and
• Can it be downloaded, shared or repurposed?

An operator who can only talk about range, endurance, thermal imaging and AI detection, but goes quiet on the personal information being swept up along the way, has told you something. They want the capability without owning the risk.

In a surveillance environment, that is not good enough. One careless operator can do more damage to this industry than any privacy law ever could. That is how a tool that protects people becomes a thing people fear.

The law is the minimum standard for doing what is right. For any company deploying surveillance technology, the real asset is trust. Compliance with the law is the base, not the achievement; it keeps you lawful, but it does not, on its own, earn you the public’s confidence. The absence of a drone-specific privacy code of conduct from the Information Regulator is not permission to wait. Popia applies, and it should be applied.

The responsible operators are having this conversation out loud. It separates those who have built real governance from those who are simply flying equipment.

South Africa needs these tools. Drones have a real place in the present and in our future. But as safety and security technology evolves, so too must the responsibility that governs it.

Aviation legislation governs the flight. Popia governs the footage. Trust is built in the space between, and everywhere else legislation has not yet reached.

30 June will come and go. The protests will pass, the alerts will stand down, and the country will exhale.

But the drones will still be in the air.

They will be over the mine on a quiet Tuesday. Over the estate at 2am. Over the field, the depot, the fence line, the crowd that gathered for something ordinary. The pressure that makes aerial security urgent this week is not going anywhere, and neither are the cameras we are sending up to meet it.

That is the point. This conversation is not a response to one tense weekend. A privacy framework that only holds when the country is watching is not a framework at all. The real test is whether the discipline survives the calm, when no one is bracing for unrest and no one is checking what the drone recorded.

The drones are already in the air. The responsible operators are the ones making sure the privacy conversation finally gets off the ground, not just for 30 June, but for every ordinary day that follows. DM

Carine Marais is a privacy and data protection attorney and founder of Civitas (Pty) Ltd, Strategic Regulatory Advisory. Written in conjunction with 24/7 Drone Force as part of an ongoing effort to advance responsible, Popia-aligned drone operations in South Africa.