Examining the applicability of hard data protection law on demographically identifiable information (DII): the case of humanitarian UAV/drone images in Malawi

Research carried out in Northern Malawi concluded that protecting and ensuring responsible use of drone-collected data in disaster-risk areas should be left entirely to the humanitarian organisations collecting these data, with little participation expected of the affected residents, mostly because they will always be coerced into giving up their data in exchange for assistance. One way to guarantee this protection is by applying national rules of data protection law to these drone data processes in the country. However, aerial drone data (e.g. high-resolution images) of a community would usually be demographically identifiable information (DII) which, unlike personally identifiable information (PII), is not substantively regulated by contemporary hard data protection law, i.e. the 2023 Malawi Data Protection Bill (MDPB) which leaves drone DII without any binding regulatory framework and hence less legal protection.

Faced with this regulatory obstacle, this paper sets out to propose and evaluate methods through which the data processing principles and rights provided by the MDPB could nevertheless be applied to regulate drone DII collected and processed by humanitarian organisations in Malawi. First, it sought to establish the feasibility of their application among the humanitarian community: to this end, 20 semi-structured interviews were conducted with humanitarian officials operating in the country, with results showing that these officials largely believed the MDPB principles and rights could effectively govern their drone data processes. The paper then proposes some regulatory modifications or ‘nudges’ which, if adopted by Malawian regulators, could probe humanitarian organisations towards applying the MDPB principles and rights to their drone DII processes, and examines how these principles and rights could be reflected in concrete, drone-related internal policies adopted by these organisations.