[jdong]

>1. Flight tracking data, collected from ADS-B, is legal and publicly available. Aircraft ownership data is public too.

Not legal in Europe. You can't legally collect this (or any other PII) for fun, you'd need particularly strong reasons to do so without consent.

Mobile phones also broadcast their IMEIs and location, it would be similarly illegal to collect and store those signals to track phone movements.

>2. Nobody has a right to keeping their aircraft movements private, and aircraft movements != personal movements.

While not all aircraft movements are personal movements, many are.

[_djo_]

Again, please provide any substantive evidence for that claim.

Private aircraft are neither private cars nor private phones and have he ever been treated equivalently under EU law.

You’re reasoning through false analogies.

[jdong]

It's the general data privacy regulation, it applies generally, to everything. It treats planes, cars and phones in exactly the same way (in that it never specifically mentions any of them).

The GDPR even covers you just writing notes into your diary about what your neighbours have been up to.

[Eisenstein]

Is there a precedent for this or are you just interpreting it as what you think makes sense?

[rosnd]

What exactly do you mean by precedent?

Yes, there are a plenty of precedents in the usual sense of the word. Such as this case, https://www.enforcementtracker.com/ETid-851

If you're going to argue (like _djo_) that this is not a precedent because it concerns a different type of a vehicle, you're entering into some rather absurd territory.

We have a clear example showing that simply storing pictures of car license plates by a toll road operator was a GDPR violation. Aircraft tail numbers are functionally exactly the same as car license plates.

The GDPR does not at any point discuss vehicles, from a GDPR perspective it makes no difference if the vehicle is a car, bicycle or your personal submarine. Or if there's a vehicle at all! GDPR concerns all PII for an extremely broad definition of PII.

Tracking locations of personal aircraft without consent is a GDPR violation, there really couldn't be a more obvious example of one.

PS. GDPR places the onus on the data controller to prove what they're doing is legal, not the other way around. You are guilty unless proven innocent. The reasonable question is to ask "Is there a precedent for this being legal?".

The answer to that is probably not, because the European flightradar24.com does have a privacy policy anywhere. This alone is blatantly illegal, but the reason they don't have one is almost certainly that their business is fundamentally not legal in Europe.

If what flighradar24.com and adsbexchange.com are doing was legal, they would have a privacy policy explaining the legal basis for their data collection. It's fundamentally impossible for their business to be GDPR compliant without one.