Drone Reconnaissance: Legal Rules for First Responders

Unmanned aircraft systems (UAS) have established themselves across authorities and organizations with security tasks (BOS, Behörden und Organisationen mit Sicherheitsaufgaben) - including police forces, fire services, technical relief agencies (THW), and emergency medical services - as indispensable tactical assets. During major incidents, vegetation fires, flooding events, or search and rescue operations in rugged terrain, optical and thermal aerial reconnaissance delivers real-time situational awareness that validates tactical choices and shields response teams from uncalculated risks.

At the same time, public safety drone operations navigate a complex multi-tier system of European and national regulations. Mission planners, procurement officers, and legal advisers face the challenge of reconciling aviation operational rules, national statutory privileges, and strict data protection guardrails. Operational capabilities must withstand subsequent administrative and judicial scrutiny.

• European aviation law: Regulation (EU) 2018/1139 (EASA Basic Regulation) and Implementing Regulation (EU) 2019/947 govern civil operational categories and establish baseline safety requirements.
• German national aviation law: The German Air Traffic Order (Luftverkehrs-Ordnung, LuftVO) defines geographic zones in Section 21h and sets out statutory exemptions for BOS operations in Section 21k.
• Data protection and security law: The General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and state-level police and disaster relief statutes govern how image and video data may be captured, transmitted, stored, and deleted.

The fundamental realization for practical deployment is clear: an exemption from civil aviation permit requirements does not constitute an exemption from data protection mandates. Only a synchronized alignment across all three legal pillars guarantees legally compliant and dependable field operations.

In public safety procurement and mission planning, uncertainty frequently arises regarding the distinction between in-house sovereign flight operations and the engagement of external service providers. The starting point for every legal evaluation is Article 2(3)(a) of Regulation (EU) 2018/1139. This provision clarifies that unmanned aircraft are excluded from the scope of civil EU drone regulations when deployed for activities in military, customs, police, search and rescue, firefighting, border control, or coastguard services.

Exemption from operating authorizations in direct BOS operations

When a BOS conducts drone operations using its own personnel and equipment to fulfill statutory mandates in emergency response or law enforcement, Section 21k(1) LuftVO applies. For unmanned aircraft with a maximum takeoff mass below 25 kilograms, no formal operating authorization under Article 12 of Implementing Regulation (EU) 2019/947 is required. Nevertheless, Article 2(3) sentence 2 of Regulation (EU) 2018/1139 obligates member states and their emergency authorities to consider the general safety objectives of the regulation and ensure an equivalent level of safety as well as safe separation from other airspace users.

Legal status of private contractors and supervised flights

When a public authority contracts drone missions to a private enterprise, such as for 3D terrain mapping after severe weather or automated perimeter security via Drone as First Responder workflows, the contractor does not automatically inherit sovereign privileges. Under the heading on BOS operations by external drone operators, the Federal Aviation Office (Luftfahrt-Bundesamt, LBA) states that any BOS may outsource parts of its drone operations to external operators, but that these operators are then not exempt from the authorization requirement and must stay within the scope of their own operating authorization. The same guidance notes that the fact an operator is working for a BOS may, in some circumstances, be taken into account by the competent state aviation authority when it grants an exemption from the geographic zone conditions of Section 21h LuftVO under Section 21i LuftVO.

The statutory exemption of Section 21k(1) LuftVO applies strictly to operations conducted by or under the supervision of the authority. A private contractor benefits from this relief only when flights occur under the immediate oversight and responsibility of the BOS. Where that is the case, the LBA guidance on supervised operations states that the BOS remains responsible for compliance with the required safety level and must ensure that contracted third parties act in line with its operations manual and observe the safety standards it has defined at all times.

European drone regulations classify operations into three distinct risk tiers: Open (low-risk baseline flights within visual range), Specific (medium-risk operations requiring authorization, such as flights outside visual line of sight), and Certified (high-risk applications requiring full aircraft and operator certification). In the Specific category, the Specific Operations Risk Assessment (SORA) framework developed by JARUS and adopted by EASA serves as the primary methodology for evaluating operational safety and ground risk. Complex flight approvals, such as obtaining a formal BVLOS approval, rely entirely on this risk evaluation methodology.

Structural changes under the SORA 2.5 package

The formal adoption of the SORA 2.5 package by EASA modernizes the Acceptable Means of Compliance (AMC) and Guidance Material (GM) for Implementing Regulation (EU) 2019/947. SORA 2.5 refines the determination of Ground Risk Classes (GRC) and Air Risk Classes (ARC) while providing clearer criteria for Specific Assurance and Integrity Levels (SAIL).

• Revised ground risk determination: Streamlined assessment of critical drone impact areas based on characteristic dimensions and kinetic energy models.
• Operational Safety Objectives (OSOs): Updated compliance criteria across 24 safety objectives to scale robustness cleanly according to the assigned SAIL level.
• Standardized authorization paths: Accelerated permit processing across national aviation authorities (NAAs) and simplified mutual recognition across EU member states.

For public safety organizations collaborating with external commercial operators, understanding SORA 2.5 parameters is vital. Even when emergency services exercise statutory exemptions during active crises, routine training flights, capability testing, and contractor missions must align with these standardized European risk metrics.

While European regulations define the operational risk categories, Section 21h LuftVO sets the rules for operating unmanned aircraft in the geographic zones referred to in Article 15 of Implementing Regulation (EU) 2019/947, covering both the open and the specific category. These statutory restrictions protect critical infrastructure, sensitive public facilities, protected environmental areas, and general air traffic from unauthorized drone activity.

• Aviation infrastructure: Over and within a lateral distance of 1.5 kilometers from the boundary of airfields that are not airports, operations are permitted only in the specific category or with the consent of the air supervision office, the flight operations office, or the airfield operator. Over and within 1,000 meters of airport boundaries, and within less than 1,000 meters of the runway centrelines extended by 5 kilometers in both approach and departure directions, operations are permitted only in the specific category.
• Critical infrastructure: A mandatory 100-meter lateral clearance applies around industrial plants, correctional institutions, military installations, and plants for central energy generation and distribution unless the competent body or operator has expressly consented.
• Government and diplomatic properties: A 100-meter protection zone covers constitutional bodies, federal and state ministries, consular missions, and security agency properties.
• Transportation routes: Flights over and within 100 meters of federal highways, federal waterways, and railway systems are restricted unless strict altitude and separation conditions are fulfilled.
• Residential properties: Overflight of residential parcels generally requires the express consent of the property owner or occupant, except under strictly defined technical and operational exemptions.

Under standard civil operating conditions, navigating these geographic boundaries requires time-consuming administrative approvals or individual exemption certificates from state aviation authorities. For first responders arriving at an evolving incident, however, traditional permit application timelines are incompatible with the operational tempo of saving lives.

To prevent regulatory restrictions from impeding emergency response, the German legislator created a dedicated exemption mechanism in Section 21k LuftVO. Under Section 21k(2) LuftVO, the strict geozone bans of Section 21h do not apply to unmanned aircraft operated by or under the direct supervision of public safety authorities when deployed to handle emergencies, accidents, or catastrophic events.

Technical criteria and tactical coordination

The primary statutory threshold limits the automatic exemption to unmanned aircraft with a maximum takeoff mass of less than 25 kilograms. When deploying systems in proximity to airports or within controlled airspace (airspace class D), tactical coordination remains mandatory to prevent mid-air collisions with manned emergency traffic, such as police or rescue helicopters.

• Air traffic control coordination: Establishing immediate radio or telephone communication with the relevant air traffic control unit (DFS Deutsche Flugsicherung) when operating within controlled terminal areas.
• Right-of-way adherence: Drones must yield unconditionally to all manned aircraft, ensuring continuous situational awareness and pre-planned collision avoidance maneuvers.
• Remote identification relief: Under Section 21k(3) LuftVO, BOS operations are exempt from standard direct remote identification (Direct Remote ID) requirements during statutory mission fulfillment.

For organizational implementation, the LBA recommends that BOS align with the safety objectives of Implementing Regulation (EU) 2019/947 and draw up an operations manual that would in principle be approvable, describing when deviations are permitted, who decides, and what must be considered; the published LBA documents on operating authorizations and the EGRED 2 recommendations on drone use in civil protection offer orientation. Tactical freedom in urgent scenarios is balanced by rigorous internal training and documented command structures.

A frequent misconception in emergency operations is that aviation law exemptions extend to data protection requirements. In reality, while Section 21k LuftVO exempts public safety agencies from airspace permits, aerial optical and thermal surveillance remains fully subject to European data privacy law and national police statutes. Whenever drone cameras capture identifiable individuals, vehicle license plates, or private property interiors, personal data processing under Article 4(1) GDPR occurs.

Legal grounds and proportionality in tactical imagery

Public authorities must anchor data collection in specific statutory authorizations, such as state police laws (Polizeigesetze) for crime prevention or disaster response acts (Katastrophenschutzgesetze) for emergency operations. The principle of data minimization (Article 5(1)(c) GDPR) requires operators to restrict sensor resolution, tilt angles, and recording duration to what is strictly necessary to achieve the tactical objective.

• Live streaming vs. permanent storage: Video feeds should be evaluated in real time on incident command screens and deleted immediately unless needed for formal evidentiary purposes.
• Automated anonymization and masking: Deploying edge processing to blur uninvolved bystanders and non-relevant residential gardens during wide-area reconnaissance.
• Technical and organizational measures: Encrypting live telemetry, video downlink streams, and onboard storage against unauthorized third-party access.

In addition, public safety organizations must maintain documented processing activities and conduct a Data Protection Impact Assessment (DPIA) under Article 35 GDPR prior to routine drone deployment. Transparent governance ensures that aerial reconnaissance withstands legal scrutiny from data protection commissioners and judicial reviews.

Aerial reconnaissance provides modern first responders with decisive situational advantages, transforming disaster response, fire containment, and tactical law enforcement. However, converting technological capability into sustainable field readiness requires a structured operational architecture that aligns aviation privileges, SORA risk management, and GDPR compliance.

When public safety agencies procure drone hardware and mission software, selecting interoperable and compliant technology platforms is critical. Solutions must support secure data transmission, automated flight logging, and rapid mission planning while enabling seamless coordination with air traffic control and complementary drone defense frameworks.

• Standardized operational manuals: Establishing comprehensive documentation that reflects the safety benchmarks of Implementing Regulation (EU) 2019/947.
• Clear contractor governance: Ensuring external service providers hold verified Specific category authorizations rather than relying on ungrounded sovereign exemptions.
• Integrated compliance controls: Implementing hardware-agnostic mission management through specialized systems like wedrone to maintain audit-proof operational logs and data protection standards.

By embedding regulatory awareness into procurement workflows and operational drills, emergency response organizations can deploy aerial assets with complete operational confidence and uncompromising legal certainty.

Read more: Legal framework for drone defense in Germany and the EU · wedrone Defense & public agencies.