It is difficult to imagine any major celebration today taking place without footage shot by a drone. Drones are becoming almost indispensable even for well-organised gatherings, excursions and trips, and are increasingly being given to young people as toys. Consumer drones, however, with their ability to fly at low altitudes, almost silently and equipped with cameras, are becoming a major challenge to privacy protection.
We looked into how prepared Montenegrin institutions are to respond to this challenge and what options are available to citizens who believe that they, their children or their property have been harassed, tracked or filmed through the unlawful use of an unmanned aircraft. Our conclusion is that no single competent institution can deal with this type of privacy violation on its own, and that the police, willingly or not, will have to respond when they receive a report that, for example, someone’s drone is filming an ordinary citizen’s yard and children playing on private property. Predrag Boljević, an expert in electronics, telecommunications and aviation, puts it more explicitly: “There must be coordinated action involving the Civil Aviation Agency, which is responsible for overseeing aviation operations. We also need both adequate regulations and active oversight by the Agency for Personal Data Protection. And, of course, the police must be involved. The police must have the technical capacity and sufficient personnel to protect us from such abuse.”
Registration is mandatory
Registering as a drone operator is the first step towards complying with regulations and rules, according to the Civil Aviation Agency (CAA). Registration is online, simple and free of charge. All operators of unmanned aircraft weighing 250 grams or more are required to register, as are operators of lighter aircraft if they are equipped with sensors capable of collecting personal data, which is the case with almost all modern drones. However, although registration is mandatory, our research found that only one in five active drone users we spoke to had actually registered, despite the high penalties prescribed for non-compliance.
“Since the new EU rules began to be applied in July 2024, we have registered close to 550 UAS operators, 95% of whom are Montenegrin citizens,” the CAA told us, adding that before the new rules were introduced, 90% of those registered were foreign nationals, who are now no longer required to register separately in Montenegro. Through informational and educational activities, as well as its enforcement policy, the Agency says it is working to increase the number of registered operators, noting a significant rise in registrations by Montenegrin citizens.
Fines of up to €20,000
The Agency regularly imposes fines for violations of the Law on Air Transport.
Over a six-month period, it says, around 20 pilots and operators of unmanned aircraft were fined for failing to register or for other violations: “The most common violations involve flying over assemblies of people, which is not permitted without special approval from the Agency, failure by unmanned aircraft operators to register, and flying near Podgorica and Tivat international airports, particularly within four kilometres of the runway.”
Under the Law on Air Transport, if an operator is not registered or pilots are not appropriately qualified, fines range from €500 to €2,000. The CAA further notes that fines for breaches of the regulations can amount to as much as €20,000.
Privacy violations
The Civil Aviation Agency, however, supervises drone operations only within the scope of aviation regulations. Citizens may contact the Agency if a drone is flying too low over people or property or remains over a particular location for a prolonged period.
“The pilot of an unmanned aircraft with a take-off mass of less than 500 grams must not fly over assemblies of people and should plan the flight so as to avoid flying over persons who are not involved in the operation (so-called uninvolved persons). In the event of an unexpected overflight of individuals, the drone pilot is required to minimise the time spent flying over them. The pilot of a drone weighing less than two kilograms should conduct operations while maintaining a minimum horizontal distance of 50 metres from people,” the CAA website states.
Source: EASA
The relevant rulebook is clear – when conducting operations, drone operators and pilots must take privacy protection into account and comply with the Law on Personal Data Protection, the CAA emphasises.
Who should citizens contact?
In cases of suspected privacy violations, in addition to reporting the matter to the Police Directorate, the competent authority is the Agency for Personal Data Protection and Free Access to Information, the CAA points out.
“The Police Directorate also carries out supervision in the field, which is particularly important for detecting incidents, identifying persons and ensuring a timely response to the CAA, with a view to jointly and more effectively combating the unlawful use of drones. We also note that the Cooperation Agreement between the Agency and the Police Directorate has recently been enhanced. Among other things, the Agreement provides for the timely exchange of information and data between the institutions in order to improve control mechanisms, protect citizens and their property, and ensure joint action in preventing, detecting and combating misdemeanours and criminal offences,” the Agency states.
Police “Not Competent”
We also contacted the Police Directorate, where we encountered an institutional wall. We received no answers to our questions, only unofficial explanations that the police were not competent for the issue we were investigating.
Among other things, we asked whether they receive reports concerning the unlawful use of drones and how their officers establish the identity of a drone operator. We also wanted to know what challenges they most frequently encounter in such cases, what options are available to citizens who notice that a drone is recording their private property or family members without authorisation, and what they advise citizens to do in such situations. We also asked whether any case had so far been recorded in which a drone had been used in preparation for the commission of a criminal offence or to endanger the security of citizens.
Agency: Securing recordings is of particular importance
In response to our questions, the Agency for Personal Data Protection and Free Access to Information emphasises that, in the context of personal data protection, it is particularly important that drone recording be conducted in such a way that, unless there is a specific legal basis for doing so, persons who have not previously consented to being recorded in this manner cannot be recognised in the footage or otherwise identified, particularly where such recordings are made public.
“Upon receiving a request from an individual who believes that their right to personal data protection has been violated through the processing of such data by means of a drone, or upon receiving an initiative to carry out supervision, the Agency will forward it ex officio to the CAA for action within the powers prescribed by the Law on Air Transport. Where possible, it is particularly important that audio and video recordings be secured during the supervision procedure. If the operator of the unmanned aircraft system is a legal entity, once supervision has been carried out by the Civil Aviation Agency, the case is forwarded to the Agency for Personal Data Protection and Free Access to Information, which considers the possibility of taking further action within its remit. This Agency does not have the statutory authority to initiate a supervision procedure when personal data are processed by natural persons, because, pursuant to Article 8, paragraph 2 of the Law on Personal Data Protection, the law does not apply to a natural person when personal data are processed for their own purposes,” the Agency explains.
The Agency also notes that Article 174 of the Criminal Code defines unauthorised photography as a criminal offence prosecuted by private action, meaning that an individual who believes that a drone operator has violated their right to privacy through unauthorised recording and intrusion into their private life may initiate proceedings before the competent authority.
Boljević: Police must have the technical capacity and personnel to protect us
Predrag Boljević, an expert in electronics, telecommunications and aviation, explains that the competences of the CAA, the Agency for Personal Data Protection and Free Access to Information and the Police Directorate overlap when it comes to protecting the privacy and security of citizens threatened by the use of drones.
“In other words, each of them has its own remit, and if one fails to do what falls within its responsibility, or is not technically prepared to safeguard our privacy or security, we are the ones who suffer the consequences,” he stresses. Drones, he says, are readily available to everyone, while the quality of the footage they produce can be excellent because they may be equipped with “powerful cameras”.
Therefore, if our privacy is to be protected, society as a whole must be prepared for this. “There must be coordinated action involving the Civil Aviation Agency, which is responsible for overseeing aviation operations. We also need both adequate regulations and active oversight by the Agency for Personal Data Protection. And, of course, the police must be involved. The police must have the technical capacity and sufficient personnel to protect us from such abuse,” Boljević is unequivocal. There is also, he adds, a social dimension – the need for a public campaign explaining that one person’s right to use a drone must be limited by another person’s right to privacy.
He recalls that when cameras first became widespread, everyone wanted to install them wherever they pleased, whereas today public spaces are protected in that regard. The same, he says, applies to drones. “The Agency has adopted regulations governing the use of drones, while the police must provide the personnel and equipment necessary to respond in a timely manner when those standards are violated. You cannot fly wherever and however you want – there is no ambiguity in the legal framework,” Boljević says.
The police, he stresses, are responsible for security on water, on land and in the air. “Security is their domain – exclusively their responsibility,” Boljević emphasises, adding that we need to learn to distinguish between security and safety.
The Civil Aviation Agency, he says, is responsible for safety in the skies. “Security is the physical aspect of protection, whereas safety is the technical aspect – in other words, anyone operating an aircraft must meet certain technical standards. We have to distinguish between the two,” he concludes.
Citizens are not allowed to use jammers
Aware that citizens might conclude that justice is slow and that it would be better to deal with the problem themselves, we asked the Agency for Electronic Communications and Postal Services whether a private individual is permitted to use so-called jammers for protection.
A radio-signal jamming device is considered radio equipment and, under the Law on Electronic Communications, may not be manufactured, imported, placed on the market or used in Montenegro by either a natural or legal person under any circumstances, the Agency says. “The use of a jammer by a natural person under any circumstances, including for the protection of private property or to prevent or disrupt the operation of a drone flying over or recording their house, yard or other private premises, is not permitted,” the Agency emphasised.
An electronic communications inspector, it explains, has the authority to restrict or prohibit the operation of, or temporarily seize, equipment and technical devices that cause electromagnetic interference, while the law also provides for substantial fines. “A legal entity shall be fined between €6,000 and €30,000 for an offence if it manufactures, imports, places on the market or uses in Montenegro radio equipment which, among other things, does not use the radio-frequency spectrum efficiently so as to avoid harmful interference and does not meet the requirements laid down in the regulation governing radio equipment. For the same offence, the responsible person within a legal entity may be fined between €300 and €3,000, an entrepreneur between €800 and €8,000, and a natural person between €150 and €1,500,” the Agency for Electronic Communications and Postal Services specifies.
Remote identification system
In an attempt to establish what citizens can do before contacting the institutions if they suspect that they have been filmed by a drone but do not know who is actually operating it, we came across information on the website of the European Union Aviation Safety Agency (EASA).
EASA states that, as of 1 January 2024, all drones operating in the specific category, as well as all class-marked drones operating in the open category, are required to have an active and up-to-date remote identification system (Remote ID). “This involves equipping drones with technologies that enable the competent authorities, as well as any citizen, to remotely identify drones while they are in the air or on the ground by using a smartphone application. This may include the transmission of identification data such as the drone’s serial number, the operator’s registration number, the position of the remote pilot or, if that information is unavailable, the point of take-off, as well as the location of the drone. Security is the main reason why remote identification is necessary – so that it can be established when a drone is being used unlawfully and when it poses a risk to security, safety and privacy,” EASA points out.
Technically, therefore, citizens already have the possibility of using a mobile phone to detect an identification signal and then contacting the Civil Aviation Agency with that information. However, this is only a possibility, not a guarantee that remote identification will be successful in every case.
Given the importance of registering drone operators, we asked the CAA whether it would be possible to introduce mandatory registration at the time a drone is purchased or imported, including during customs clearance if it was bought abroad. “Approval for the import or entry of a drone into Montenegro is issued by the Ministry of Economic Development. Registration at the time of purchase is not possible because the person purchasing the drone does not necessarily have to be its user or operator – for example, the drone may have been purchased as a gift,” the CAA states. Finally, when asked whether it considers the current legal framework sufficient to protect citizens against the misuse of drones in relation to privacy violations, or whether additional regulation in this area is needed, the CAA responded: “Given the dynamic development of this field, we monitor changes to European Union regulations and apply the highest standards in this area, precisely in order to ensure that measures contributing to a higher level of air transport safety are implemented in Montenegro.
There are also other regulations dealing with issues such as privacy, third-party liability insurance and similar matters, which fall within the remit of the institutions responsible for those areas. Therefore, any assessment of the need for additional regulation concerning privacy protection must be considered through a coordinated approach involving all competent institutions.”
Ana Šuković, journalist of portal Antena M
The text was originally published on the portal Antena M
This text was produced within the framework of the MediaLit project, implemented by the Centre for Civic Education (CCE) in partnership with the Helsinki Committee for Human Rights in Serbia, the Helsinki Committee for Human Rights in North Macedonia, the Tirana Centre for Journalistic Excellence in Albania, and the Atlantic Initiative in Bosnia and Herzegovina. The project is funded by the European Union and co-funded by the Ministry of Regional-Investment Development and Cooperation with Non-Governmental Organisations of the Government of Montenegro. The content of this text is the sole responsibility of the author and does not necessarily reflect the views of CCE, the partner organisations, the European Union, or the Ministry.