Satellites and GDPR earth observation data as personal data

This dissertation examines whether Earth Observation (EO) data collected by satellites can constitute personal data within the meaning of the General Data Protection Regulation (GDPR). It challenges the assumption that EO data fall outside the scope of data protection law and argues that their qualification as personal data requires a contextual, technology-sensitive assessment. The analysis is structured around the three elements of the GDPR definition of personal data, as developed by the Article 29 Working Party and confirmed by the Court of Justice of the European Union (CJEU): "any information", "relating to", and "identification". The dissertation demonstrates that EO data satisfy the broad "any information" criterion regardless of their format or medium. It further argues that EO data may relate to natural persons through their content, purpose, or effects, particularly in applications such as geomarketing, geoscoring, smart-city initiatives, socio-economic analysis, risk assessment, and humanitarian operations. The decisive issue is identifiability. To assess this element, the dissertation develops the concept of the "3Ws of EO Data Processing"—by whom, for what purposes, and by which means—identification may occur. Drawing on CJEU jurisprudence, it argues that identifiability should be assessed through a relative approach. Given the complex EO data value chain, involving satellite operators, data platforms, cloud service providers, and end users, whether EO data constitute personal data must therefore be determined on a case-by-case basis from the perspective of the "by whom" dimension. The "for what purposes" dimension examines whether the purposes pursued by satellite operators or EO data platforms relying on cloud computing infrastructure are relevant to the assessment of identifiability. It concludes that neither the controller's purposes nor the use of cloud computing, themselves, preclude the possibility of identifying a natural person. The analysis demonstrates that EO data cannot be categorically excluded from the scope of the GDPR. While raw satellite imagery will often not constitute personal data, advances in sensing technologies, data analytics, and data integration increasingly enable the singling out of natural persons, thereby bringing certain EO data processing activities within the scope of the GDPR. The dissertation further examines direct and indirect identifiers, including location data, demographic information, biometric characteristics, and licence plate numbers, as well as the risks of re-identification despite existing anonymization techniques. Attention is paid to technological developments such as quantum computing, on-board processing, data broker ecosystems, and very high-resolution imagery enhanced by AI- and ML-based object detection. The dissertation concludes that EO data should not be categorically excluded from the GDPR. While raw satellite data will not always qualify as personal data, EO data integrated into databases and combined with additional information may satisfy the GDPR's definition of personal data. At the same time, the unique characteristics of EO data require a tailored assessment of data collection and processing by EO satellites operating in outer space. In light of the absence of comprehensive privacy and data protection rules in international space law, the GDPR may serve as an important regulatory framework capable of addressing this normative gap whenever its applicability requirements are met.