This decision of the Belgian Data Protection Authority qualifies aircraft flight data (location, trajectory, schedules) as personal data, as soon as they can reasonably be linked to an identifiable natural person, and confirms the territorial application of the GDPR to a company not established in the Union that tracks the movements of individuals within it.

Facts and context

The Data Protection Authority (DPA) today published a decision issuing a reprimand and corrective measures against a company providing aeronautical data for breaches related to the online publication of helicopter flight data.

The case originated from a complaint filed on 14 October 2024 by the usual pilot of a helicopter, who contested the collection and publication of flight data concerning him on a publicly accessible online map.

Reasons for the decision

The authority first confirmed that the helicopter flight data, such as its position, trajectory, and schedules, combined with its registration number, constituted personal data. It considered that the complainant, who performed 95% of the flights, was indirectly identifiable. The authority emphasized that reasonable means allowed this identification, notably by cross-referencing flight data with public information such as the Belgian aeronautical register or the complainant's contact details that the company held otherwise. It cited in this regard the case law of the Court of Justice of the European Union (judgment of 9 November 2023, C-319/22) which specifies that to determine whether a person is identifiable, all means reasonably likely to be used by the controller or any other person must be taken into account.

• Information obligation (Article 5(1)(a), 12 and 14 of the GDPR): The authority found that flight data were collected indirectly, notably via public ADS-B Out signals, making Article 14 of the GDPR applicable. The company did not provide the complainant with the required information within one month, its privacy policy being silent on this specific processing. The authority dismissed the argument of disproportionate effort, as the company had the complainant's contact details and could therefore have contacted him.
• Right to erasure and right to object (Article 17 and 21 of the GDPR): Following the complainant's request for erasure and objection, the company refused to delete the flight data, citing compelling legitimate grounds. The authority found that the company had not demonstrated that its interests (security, journalism, research) prevailed over the rights and freedoms of the complainant. It also noted that the company had not explicitly invoked the exceptions provided for in Article 17(3) of the GDPR to justify its refusal.
• Obligation to appoint a representative in the Union (Article 27 of the GDPR): The authority first established that the processing fell within the territorial scope of the GDPR under its Article 3(2)(b), as tracking the helicopter's movements constitutes "monitoring the behavior" of a data subject within the Union. The company, not established in the Union and the processing being neither occasional nor exempted, was required to appoint a representative, which it did not do.

Decision of the authority

Consequently, the authority issued a reprimand against the company for violation of Articles 5, 12, and 14 of the GDPR.

Furthermore, the authority ordered the company to comply with the complainant's erasure request within 45 days, under penalty of a fine of €5,000 per day of delay. It also ordered the company to appoint a representative in the Union within 6 months, under penalty of a fine of €15,000 per day of delay, with the total amount of fines capped at €1,000,000.

Lessons learned

This decision reminds that:

• Location and trajectory data of an aircraft, even collected via public signals, constitute personal data as soon as there are reasonable means for the controller or a third party to link them to an identifiable natural person, for example by cross-referencing the registration number with public registers.
• Systematic and real-time tracking of the movements of a natural person within the Union, even via an aircraft, constitutes "monitoring of behavior" within the meaning of Article 3(2)(b) of the GDPR, making the regulation applicable to a controller not established in the Union.
• To refuse a request for erasure or objection based on legitimate interest, a controller must concretely demonstrate the existence of compelling legitimate grounds that override the interests and rights and freedoms of the data subject; a mere invocation of general interests such as security or journalism is insufficient.