Have you ever wondered if data privacy laws apply to Outer Space? Usually, we think the laws apply horizontally. That is, between people, companies, and across country borders. But, SpaceTech disrupts how organisations typically collect, process, and transfer data. The consequence is that we have to consider if the laws apply vertically–to Outer Space.

In this post, we look at what SpaceTech is and how it could interfere with our data privacy rights. Then, we explain the difference between Airspace, Near Space, and Outer Space. Next, we review whether data-protection laws apply to Outer Space. Finally, we end off with some prescient thoughts and list the actions you can take.

What is SpaceTech?

SpaceTech refers to technologies created by space scientists and companies for use in Outer Space. We can also connect SpaceTech to the internet. When we do so, it becomes part of an Internet of Things network. Below, we describe and illustrate the most prominent SpaceTech.

Satellites

Satellites refer to devices placed in the Earth’s orbit to collect or to communicate information. The most popular use of satellites is high-resolution imagery. A simple example of this imagery is Google Earth’s street view function. This function lets you see recent images of a particular location with a high degree of accuracy. 

However, there are many legal restrictions on satellite imagery. For example, it can’t be too detailed and available in real-time. The reasons for the restrictions include prevention of surveillance, protection of privacy, and the promotion of national security. 

But, many satellite companies are pushing for more accurate and real-time satellite imagery. They argue that there are several critical reasons for being able to use it, such as humanitarian relief during natural disasters.

Some companies are even giving away satellite data for free to lower the market’s barriers to entry for software developers and startups.

Space cloud computing

Cloud computing means the delivery of different services through the internet. These services include data storage, networking, servers, and software. Up until recently, businesses have been hosting cloud computing on Earth. However, some companies are developing cloud-computing infrastructures that they will house in Outer Space. 

Space cloud computing will advance and expand the cloud computing market. It will help space agencies when they send humans or robots on space exploration journeys. Sometimes, astronauts are in predicaments, where they have to learn rapidly or process data efficiently. Immediate access to information can mean life or death for the astronauts. Space cloud computing will connect them to a centre of limitless information and online resources as they travel through space.

The market for cloud computing is lucrative, so organisations are continually looking for ways to gain a competitive edge. This technology is particularly useful for satellite operators. It can help them rapidly download high-resolution imagery and combine it with AI for the insightful analysis of the images.

Space internet

Space internet refers to a network of satellites that provides access to the internet to anyone, anywhere on Earth. It aims to solve the digital divide by providing internet access to everyone. The benefits of space internet include global coverage, high-speed access, cost-effective rates, reliability, and instant installation and deployment.

We’ve had space internet for about two decades. But, the satellites were located too far into Outer Space to provide easy access. However, accessibility will no longer be an issue. Recently, Elon Musk launched Starlink, which provides public access to space internet at rapid speeds.

Space drones

Drones are ubiquitous. We’ve been using them for many purposes: from putting out fires to delivering pizza. How can drones be elevated? Well, organisations are moving to create what they call “space drones”. Essentially, they see (cameras), hear (microphones), and estimate geolocation data (GPS) from Outer Space. We can use them for search and rescue, maintenance of other SpaceTech, surveillance, space exploration, and weather monitoring.

In the next 7 years, NASA intends to launch two sophisticated space drones into Outer Space. Further, certain countries are manufacturing space drones for military applications.

Space AI

As you may know, AI refers to a computer’s ability to process data like humans or better than humans. AI has several uses in Outer Space. For example, companies are using AI to enhance remote-sensing data. Remote sensing refers to the process where satellites or high-flying aircraft scan the Earth to collect data about it.

When data scientists combine remote-sensing data with AI technology, the uses are exponential. However, the most relevant include:

  • Event monitoring. Agricultural companies can use this data to detect and monitor crop fires. In comparison, governments can use it to monitor natural disasters and observe climate change.
  • Real estate. Property buyers and owners can view and monitor properties. Companies like Airbnb can verify listings. And, municipalities can check if property owners have expanded buildings beyond their declared plans.

GPS

Since 1974, we’ve been using the satellite-based Global Positioning System (GPS).

“GPS navigation involves multiple satellites in the [E]arth’s atmosphere transmitting signals to devices that can then determine their current location on the ground. With advances in computerizations these devices have been extended to do about the same that old world navigators would do, and much more.”

Almost all of our smart devices (mobile phones, tablets, laptops) connect to GPS. Intriguingly, GPS can help when it comes to cybersecurity. The reason is that GPS boasts highly secure encryption methods. Companies like SpeQtral are leveraging GPS and other technologies to create advanced cybersecurity solutions.

How could SpaceTech interfere with your data privacy rights?

SpaceTech creates a constellation of problems for your data protection rights.

  • Satellites. Satellites produce high-resolution images of the Earth. These images may include pictures of you in your private spaces. Further, it’s nearly impossible for you to determine who’s sending your data to satellites and who’s receiving your data from them.
  • Space cloud computing.  These services include data storage, networking, servers, and software. How would you request access to your data if a company houses it in Outer Space? Could you transfer your data from a space cloud to an Earth cloud? Or, what about from one space cloud to another? Who owns the space cloud? What happens if it gets hacked?
  • Space internet. How would your personal information be protected on the space internet? Examples include your IP address, geolocation, and device fingerprints. Also, would search engines be subject to data protection rules in Outer Space?
  • Space drones. Space drones can capture your data by taking images of you, recording your voice, and tracking your geolocation. What about your privacy rights?
  • Space AI. SpaceTech organisations may combine space AI with satellite data and cloud computing for increased efficiency. However, what happens when the AI processes your personal information? Will your right not be subjected to automated decision making extend to Outer Space?
  • GPS. Your smartphones routinely make use of GPS technology. It tracks your movement patterns and the location of your personal property. How is your geolocation data protected?

We think you’d agree that we must know if our data privacy rights protect us in Outer Space.

Thinking vertically – Airspace, Near Space, and Outer Space

We need to distinguish between Airspace, Near Space, and Outer Space before we can consider whether data-protection laws apply to Outer Space. Why? Because writers generally agree that Airspace and Near Space form part of a state’s sovereign territory. If a company uses SpaceTech within the territory of a state, then that state’s data protection laws may apply. Alternatively, if an organisation uses SpaceTech in Outer Space, it would be unclear which laws apply, because Outer Space belongs to all of humanity.

So, where does Airspace, Near Space, and Outer Space end and begin? The fact is that no-one agrees on the answer. However, there is some guidance. The Fédération Aéronautique Internationale (FAI) has defined the point at which the Airspace above a country ends and where Outer Space begins. This boundary is called the Karman line. For decades, the FAI has set the Karman line at 100 kilometres above the Earth’s surface.

But not all countries and organisations adhere to this measurement. For example, the US and NASA treat the boundary as 80 km above the Earth’s surface. Further, some writers argue that there’s a scientific space between Airspace and Outer Space. They call this space, “Near Space” and locate it between 20 and 80 km above the Earth’s surface. Because most aircraft can’t fly in this space, they believe we should distinguish Near Space from Airspace and Outer Space.

Based on these estimates of the start of Outer Space, it would be reasonable to suggest that Outer Space starts at 80 km above the Earth’s surface. Also, we can deduce that Airspace would be between 0 to 20 km above the Earth’s surface. The diagram below illustrates the measurements.

The vertical axis - Earth, Airspace, Near Space, Outer Space

What’s also essential to consider is the scope of territorial waters where countries have a coastline. The reason is that countries own their territorial waters and so their laws would apply. The current international rule is that a country owns 12 nautical miles from its coastline.

Data protection laws

Not all countries have data protection laws. Where they don’t, SpaceTech investors would find them attractive to develop and use SpaceTech. If there are no laws, the organisations wouldn’t be subject to the constraints of data protection laws. Also, depending on the nature of an organisation, it may not have to comply with these laws anyway. For example, the European Space Agency is not subject to the GDPR.

However, there are several states with data protection laws in one form or another. We can’t discuss all of the states, their data protection laws, and how the laws relate to Space Tech and Outer Space. Instead, to provide a global perspective, we consider data protection laws from each of the four corners of the Earth. Specifically, we only focus on the question of whether organisations within these states can process and transfer personal information or data to Outer Space.

North - GDPR (EU)

Within Airspace and Near Space, it seems like the GDPR will apply to the processing and transfer of personal data by SpaceTech organisations. The reason is that these spaces fall within the sovereign territory of the EU.

However, when it comes to Outer Space, it’s unclear whether the GDPR will apply.

  • Article 3. It says that the GDPR applies to the personal data of EU data subjects within the Union.
  • Chapter 5. This chapter envisions data transfers taking place on Earth only. So, the GDPR doesn’t cover data transfers to Outer Space.

Chapter 5 creates a loophole in the GDPR. If an organisation ordinarily needs to comply with the GDPR, it may not be subject to the GDPR when it transfers personal data to Outer Space.

South - POPIA (ZAF)

POPIA would most likely apply in the Airspace and Near Space of ZAF because these spaces fall within the territorial jurisdiction of ZAF.

But, when it comes to the processing and transfer of personal information to Outer Space, it’s unclear if POPIA applies.

  • Section 3. POPIA applies to personal information processed within ZAF.
  • Chapter 9. This chapter deals with “Transborder Information Flows”.
  • Section 72. POPIA doesn’t prevent data transfers to Outer Space. However, if we interpret it to include data transfers to Outer Space, POPIA would probably require similar data protection measures as captured in POPIA. Alternatively, because POPIA is silent on data transfers to Outer Space, the silence can be an unintended loophole.

East - ITA (IND)

The IND legislature didn’t draft the ITA with data protection as the sole focus of the legislation. However, it does provide some protection for data. This protection extends to sensitive personal data only.

  • Section 43A. This section places responsibilities on a business that possesses, deals, or handles any sensitive personal data. Suppose a third party compromises the security of the special personal data. In that case, the business must pay damages by way of compensation to the data subject for wrongful loss or wrongful gain.
  • Section 72A.  The ITA states that a person or organisation, who holds special personal data of data subject under a lawful contract, must not use that data in a way that causes wrongful loss or gain. If they do, then they’d be subject to imprisonment or a fine.

The vagueness of the ITA leaves scope for the processing and transferring of special personal data into Outer Space.

West - CCPA (USA)

Section 1798.150 of the CCPA places a comprehensive obligation on organisations to “implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information”.

Suppose an organisation fails to have adequate security measures, and a third party gains unauthorised access to personal information. The organisation could be liable to pay damages or be interdicted to up its security measures. Otherwise, a court has the power to order any other relief that it deems appropriate.

Section 1798.150 applies regardless of where an organisation processes personal data. Moreover, there are no loopholes because there are no sections that specifically deal with data transfers.

End thoughts

In their current state, data-protection laws don’t sufficiently address the privacy concerns of data subjects within Outer Space. Further, even if the courts of a specific nation or union were to interpret data protection laws to apply to Outer Space, this interpretation would apply in the relevant jurisdiction only. Thus, we recommend that the various countries put their heads together to develop an international standard for data protection in Outer Space. If not, then the uncertainty will prevail, and SpaceTech organisations could abuse the legal gaps.

Actions you can take

  • Comply with data protection laws whilst developing or using SpaceTech by asking for our advice or by joining our data protection programme.
  • Obtain legal certainty by asking us to provide you with a legal opinion on one of the legal issues of SpaceTech.
  • Check that your privacy policy is in line with the latest laws by asking us to review your privacy policy.
  • Manage information security when using SpaceTech by asking us to provide you with a bespoke security policy.
  • Prepare for incidents effectively when using SpaceTech by asking us to provide you with an incident response policy.