What RODO says about drone photography
Drone video and photos with recognisable faces are personal data under art. 4 RODO. The operator is either a data controller or a processor, depending on contract structure. A legal basis is required: consent (art. 6 ust. 1 lit. a), contract (lit. b) or legitimate interest (lit. f). In real estate the most common basis is the consent of the property owner, who is both the data subject and the property owner.
Who signs consent on a real estate shoot
- The property owner - always, in plain words "I consent to the shoot and to publication for marketing purposes"
- Owners of neighbouring plots - if their land, faces or cars with readable plates are in the frame
- Guests and tenants - if they are present during the shoot
- The building manager or wspólnota mieszkaniowa (the Polish homeowners' association) - for multi-unit buildings, a formal letter with the date and flight zone
Consent at events
The "public event" exception works but does not remove the duty to inform. A wedding is a private event, and the couple must indicate on the invitation or the WiFi landing page "photo and video recording, including by drone, is being conducted". A concert or festival - the clause is embedded in the ticket terms. A corporate event - HR or the event manager informs employees in writing 7-14 days before the date.
What to do with recognisable faces after the shoot
- Anonymisation (face blurring) - the standard way to comply with RODO for people without consent
- Cropping - removing the person from the frame in post-production
- Pseudonymisation and consent collected after the fact - rarely works in practice, UODO does not accept these scenarios
- Source-file storage - on servers inside the EU (OVH Warsaw, Hetzner Falkenstein), not on non-EU services without SCC
NDA for premium properties and closed events
When the client is a public figure (politician, artist, business leader), the standard VisionAir NDA covers: an open-ended ban on publication in any form, a 50 thousand PLN penalty for breach, and an obligation to delete source files within 30 days of master delivery. The NDA is signed before travel to the site and applies to the entire crew.
Who is liable in case of a breach
A triad of responsibility: data controller (typically the client-agent, since they publish the listing), processor (the shooting service) and sub-processor (e.g. a foreign CDN or cloud storage). UODO (the Polish data protection authority) fines can reach 4 percent of annual turnover or 20 million EUR at the upper limit. In practice in Poland, most cases settle at a 5-50 thousand PLN fine plus an obligation to remove the publications.
UODO cases 2023-2025
| Case | Violation | Outcome |
|---|---|---|
| Aerial photo of a real estate listing, 2023 | Publication without blurring neighbouring plots and recognisable cars | 12 thousand PLN fine and removal of publications |
| Wedding drone shoot, 2024 | Commercial use of frames in a portfolio without written consent of the couple | 8 thousand PLN fine and removal from the photographer's website |
| Corporate event drone video, 2025 | No written 14-day notice to employees | Warning and a 30-day corrective-measures plan |
The VisionAir approach: before brief sign-off the client receives a template of three consents (the property, neighbours, persons in the frame) and a guide to informing employees or guests. This removes liability from the client-agent and closes baseline UODO risks.
Agent checklist before ordering a shoot
- Owner's consent for commercial use specifying the publication channels
- List of neighbouring plots with consents collected, or a sketch of zones without consent
- Clarification on the facade: should the entrance and signage be recognisable
- Source-file delivery scenario: where, for how long, who has access
- Right to erasure after the property is sold (data subject right to erasure)
- NDA if the property is sensitive or the client is a public figure
- Contact email for receiving data subject requests
RODO is not an obstacle, it is a structure. Studios that accept this from day one sell 30 percent more real estate, because the client is not afraid of legal consequences.
Frequently asked questions
- Who drafts the consents - the agent or the drone operator?
- VisionAir prepares the templates and the agent collects signatures. This is the market standard: the operator knows the RODO structure for the shooting scenario, the agent has direct access to the owner and neighbours. Signed originals are kept by both sides for 5 years.
- What if a neighbour refuses to sign?
- Two options. First, replan the flight path so that their land and recognisable objects do not enter the frame. Second, blur their plot in post-production. VisionAir runs a pre-flight survey 1-2 days before the shoot specifically for this.
- Where are source files stored after the shoot?
- On OVH servers in Warsaw with a backup on Hetzner Falkenstein - both inside the EU. Default retention is 90 days, after which deletion or extension is handled on client request. Access is limited to two VisionAir staff with two-factor authentication.
