united-kingdom gdpr european-union personal-information
Is satelite data personal data?
<p><a href="https://www.bbc.co.uk/news/world-europe-62717599" rel="nofollow noreferrer">It is in the news</a> <a href="https://www.theregister.com/2022/08/30/frances_tax_department_used_ai/" rel="nofollow noreferrer">that artificial intelligence (AI) has been applied</a> to aerial photography to identify homeowners who have made unauthorised additions of swimming pools to their properties in France.  This has allowed them to be taxed.</p>
<p><a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/" rel="nofollow noreferrer">The UK ICO defines personal data as</a>:</p>
<ul>
<li>Personal data only includes information relating to natural persons who:
<ul>
<li>can be identified or who are identifiable, directly from the information in question; or</li>
<li>who can be indirectly identified from that information in combination with other information.</li>
</ul>
</li>
</ul>
<p>It would seem that this technique has demonstrated that individuals are identifiable from this sort of aerial photography.  Does this make <a href="https://www.maxar.com/products/satellite-imagery" rel="nofollow noreferrer">the various</a> <a href="https://www.google.com/maps" rel="nofollow noreferrer">forms of satellite imaging</a> available online subject to the GDPR?</p>

<p>Personal data is any information relating to an identifiable person, even if that person is only identifiable with the help of additional data and/or third parties.</p>
<p>Making inferences about a particular person, for example whether that person might have performed unauthorized construction, sounds very much like processing of personal data to me. In this scenario, the information is used to verify the tax assessment for a particular person, so the information clearly <em>relates</em> to a data subject.</p>
<p>The owner for a piece of land is certainly identifiable with the help of the land registry, if one exists in the country. Similar registries might also exist with tax authorities or a postal service. Here, it is the tax authority itself doing the processing, so they probably already have tax records about the owners at the address.</p>
<p>But just because it's processing of personal data doesn't mean that it is illegal.</p>
<ul>
<li>Satellite data and aerial photography providers can probably rely on a <em>legitimate interest</em> to collect, sell, or otherwise publish their data. Homeowners can reasonably expect that their property will be included in low-res aerial photography. It might not be necessary to notify the data subjects if an exception in Art 14(5) applies.</li>
<li>A public authority using aerial photography to find building code violations or to levy correct taxes may be able to base this processing activity on authorization via some law. If the public authority would have the right to inspect the buildings, then it might be possible to argue that the public authority can use aerial photography to decide which inspections/audits to prioritize. Of course, decisions producing significant legal effects must not be based on “AI” alone, due to the Art 22 GDPR right to not be subject to unchecked automated decision making (unless specifically authorized by a suitable law).</li>
</ul>
