# Examining the applicability of hard data protection law on demographically identifiable information (DII): the case of humanitarian UAV/drone images in Malawi

## TL;DR

This paper explores how data protection laws in Malawi can be applied to drone-collected data in humanitarian contexts, where residents may feel coerced into sharing information.

## Contribution

The study proposes regulatory modifications to encourage humanitarian organizations to apply data protection principles to demographically identifiable information collected via drones.

## Key findings

- Interviews with humanitarian officials suggest that data protection principles can be effectively applied to drone data processes.
- Proposed regulatory nudges could encourage organizations to adopt internal policies aligned with data protection laws.

## Abstract

Research carried out in Northern Malawi concluded that protecting and ensuring responsible use of drone-collected data in disaster-risk areas should be left entirely to the humanitarian organisations collecting these data, with little participation expected of the affected residents, mostly because they will always be coerced into giving up their data in exchange for assistance. One way to guarantee this protection is by applying national rules of data protection law to these drone data processes in the country. However, aerial drone data (e.g. high-resolution images) of a community would usually be demographically identifiable information (DII) which, unlike personally identifiable information (PII), is not substantively regulated by contemporary hard data protection law, i.e. the 2023 Malawi Data Protection Bill (MDPB) which leaves drone DII without any binding regulatory framework and hence less legal protection.

Faced with this regulatory obstacle, this paper sets out to propose and evaluate methods through which the data processing principles and rights provided by the MDPB could nevertheless be applied to regulate drone DII collected and processed by humanitarian organisations in Malawi. First, it sought to establish the feasibility of their application among the humanitarian community: to this end, 20 semi-structured interviews were conducted with humanitarian officials operating in the country, with results showing that these officials largely believed the MDPB principles and rights could effectively govern their drone data processes. The paper then proposes some regulatory modifications or ‘nudges’ which, if adopted by Malawian regulators, could probe humanitarian organisations towards applying the MDPB principles and rights to their drone DII processes, and examines how these principles and rights could be reflected in concrete, drone-related internal policies adopted by these organisations.

The online version contains supplementary material available at 10.1186/s41018-025-00174-z.