It’s said that while money shouts, wealth whispers. And there was a time when you could sail quietly away to enjoy secluded adventure. No online tracking. No voyeurs or bad actors following your movements in real time. That’s all gone. Today, modern superyachts glide across the oceans leaving an invisible digital trail like a tin can tied to a wedding car. Every movement, every anchorage, every discreet arrival is vacuumed up, republished and monetised by online AIS tracking platforms.

You could, of course, pull the plug. Some do. But that’s not lawful and there may be insurance repercussions if switching off were to be a contributory factor in a collision. So, that aside, what rights do owners have to vanish?

USEFUL KIT

AIS was not designed as a global voyeurism product. It’s a navigational tool. All yachts of 300 gross tonnage or more and engaged on international voyages must be fitted with Class A AIS equipment (per Regulation 19 of Chapter V of SOLAS). It enhances safety and security. By broadcasting key information through short-range radio signals to nearby vessels, it supplements the picture produced by radar, so enhancing traffic awareness. Many of the problems common to radar, such as clutter, do not affect AIS. So it’s also used in search and rescue operations. So far, so sensible.

A HARMLESS HOBBY?

There’s a comforting assumption that if something is broadcast, it’s public and you’re entitled to hoover this information up, monetise it if you want, then post it online with complete moral serenity. After all, tracking aircraft, like trainspotting, is harmless enough. But AIS’s core purpose is nearby safety, not global stalking.

Commercial ships exist to trade. Ferries exist to transport passengers. Tugs, dredgers and offshore support vessels exist to work. Superyachts, by contrast, exist for one purpose only: private leisure. They are not mere transport assets. They are floating private residences, often carrying owners, families, children, guests and crew in circumstances that are deeply personal and deliberately secluded. Where a vessel is commonly associated with an individual, then it becomes a proxy for that person. The location data is thereby also – crucially – personal data.

ENTER GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union (EU) to safeguard the personal data within the EU and the European Economic Area (EEA). The UK’s own version of GDPR was retained in domestic law post-Brexit by virtue of the Data Protection Act 2018.

And data in respect of an individual’s location is undoubtedly ‘personal data’. Article 4(1) of UK GDPR defines personal data as “any information relating to … an identifiable natural person … who can be identified, directly or indirectly, in particular by reference to an identifier such as … location data”. So AIS data can become personal data when there’s a sufficient link to a habitual individual user, or even a crewmember, because of, for example, credible media reports. It becomes pattern-of-life information which can be used to map the movements of individuals.

LAWFUL BASIS

Under Article 6 of UK GDPR, every single act of processing personal data (such as posting online) must have a lawful basis. You cannot simply decide that because information is technically available, you can do whatever you like with it. There are six lawful bases under Article 6(1):

1. Consent: has the owner consented to having their real-time location posted and published? Obviously not. They have not been asked. They have not consented.

2. Contract: is there a contract? Of course not.

3. Legal Obligation: is there a law requiring the publishing of a private individual's real-time location? Nope.

4. Vital Interests: is publication necessary to save a life? Another no.

5. Public Task: is the person posting this data a public authority exercising a public function? Unless the poster is, say, the coastguard, then this basis doesn't apply.

6. Legitimate Interest: is publication necessary for legitimate interests of the publisher or a third party? This is the publisher’s last chance saloon. What legitimate interest could be invoked for posting someone's real-time location? Maritime safety? The vessel is already broadcasting AIS for that purpose. Reposting online adds nothing. Curiosity? Entertainment? These are not ‘legitimate interests’ in the legal sense. And crucially, even where there is a legitimate interest, the balancing test must be passed. The data subject's rights are weighed in the scales. Real-time, continuous disclosure of a specific person's location is a highly significant privacy intrusion. The scales would need something very substantial on the other side to tip them the other way.

FURTHER HURDLES

Even if a lawful basis were somehow established, the processing would still need to comply with the data protection principles in Article 5 of UK GDPR. These include:

1. Lawfulness, Fairness & Transparency: publishing someone's location without their knowledge is not transparent. Whether it is fair is highly context-dependent, but continuous real-time location disclosure is unlikely to pass muster.

2. Purpose Limitation: data must be collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes. AIS data is broadcast for maritime safety. Republishing it to reveal an individual's location for non-safety purposes is incompatible with that original purpose. The vessel owner did not switch on their AIS transponder so that strangers on the internet could track their movements.

3. Storage Limitation: data should not be kept longer than necessary. If an archive of a person's historical movements is being maintained, this requires separate justification.

4. Data Minimisation: only data adequate, relevant, and limited to what is necessary may be processed. Real-time, continuous, geographically precise location tracking of a specific individual is the opposite of minimisation.

HUMAN RIGHTS

The European Convention on Human Rights (ECHR) is an overriding international treaty, protecting human rights and fundamental freedoms in Europe. All member states of the Council of Europe, including the UK and EU countries, are bound by the ECHR. Under Article 8 of the ECHR, everyone’s private and family life must be respected.

The European Court of Human Rights, which oversees compliance with the ECHR, has stated in Uzun v Germany that GPS surveillance would via GPS would amounted to an interference with someone’s private life, as protected by Article 8, unless safeguards were put in place and the surveillance was targeted, proportionate and justified by strong public interests (such as a serious criminal investigation in that case).

In the subsequent Shimovolos v Russia judgment the Court confirmed that, “Collection, through a GPS device attached to a person’s car, and storage of data concerning that person’s whereabouts and movements in the public sphere was also found to constitute an interference with private life”.

Admittedly, these cases concerned state surveillance rather than yacht websites. But the principle is unmistakable: location data is intrinsically sensitive.

MISUSE OF PRIVATE INFORMATION

The misuse of private information is also a distinct civil wrong, according to Google v Vidal-Hall, liability for which is determined on the basis of whether the claimant has an objective, reasonable expectation of privacy in respect of the data. Clearly, any yacht owner has just such an expectation. The victim doesn't have to rely on data protection law at all: they can go straight to court on the grounds that their reasonable expectation of privacy has been violated, with claimants receiving damages for the loss or diminution of the right to control their private information, independently of any distress caused.

CELEBRITY PRIVACY

But to what extent does placing oneself in the public spotlight erode the right to privacy?

In Campbell v MGN supermodel Naomi Campbell successfully sued the Daily Mirror for publishing details of her treatment at a narcotics clinic. The court established that being a public figure means you must tolerate some additional scrutiny but that does not extend to unlimited surveillance of your private movements and personal life.