Responsabilità per illecito trattamento dei dati nell'impiego di droni: profili sostanziali e rimediali

The article reconstructs civil liability for unlawful processing of personal data in the use of drones, particularly when integrated with AI modules: the migration from fixed video surveillance to mobile platforms introduces risk multipliers (sensor mobility, the scale and persistence of operations, algorithmic autonomy) and a stratification of data (images, metadata, behavioural patterns, biometric data). The paper situates the multi-level EU/national framework [Basic Regulation 2018/1139; Regulations (EU) 2019/945 and 2019/947; ENAC UAS-IT] in convergence with the GDPR and the AI Act, which make privacy by design/default, data minimisation, and DPIAs ex ante standards of professional diligence. On the remedial plane, Article 82 GDPR is construed as a fault-based model with a reversal of the burden of proof: the ex ante adequacy of the measures constitutes the principal exculpatory defence; the legitimacy of the “flight-data” operation is anchored in the person and in proportionality.