Privacy: your camera collects personal information, and the law follows it

Know what counts as personal information, why privacy law applies to a drone flight even though no privacy statute names drones, what a recreational pilot is expected to do about it, and which regime governs a business or a government institution.

• You know what your payload captures — a camera, a sensor, a recording — because that is what the rules attach to. TC Privacy Guidelines Drone Users
• You know whether you are flying recreationally, for a business, or for a federal government institution, because each has its own regime. TC Privacy Guidelines Drone Users
• You know the difference between a privacy law and a criminal offence, since the same flight can raise both. TC Privacy Guidelines Drone Users

Privacy laws may not mention drones by name, and they still apply to the pictures, videos and other information a drone collects. TC Privacy Guidelines Drone Users

Personal information is defined as information about an identifiable person. The examples given are a name, a picture of a person's face and a licence plate number. TC Privacy Guidelines Drone Users

A flight can also raise offences that are not privacy-law questions at all. The page lists using a drone in a way that could be: voyeurism, mischief, creating a nuisance, or a violation of provincial or municipal law. You are responsible for knowing all the laws that apply to your drone use. TC Privacy Guidelines Drone Users

TC Privacy Guidelines Drone Users

Guideline	What it asks of you
Be accountable	You are the pilot, and you are responsible for all the personal information your drone collects TC Privacy Guidelines Drone Users
Limit collection	Take reasonable steps to avoid capturing personal information you do not need, and make anything captured without consent anonymous — blur faces or licence plates TC Privacy Guidelines Drone Users
Obtain consent	If it is likely you will capture people's personal information, take reasonable steps to tell those affected and get their consent TC Privacy Guidelines Drone Users
Store information securely	If you keep recordings containing personal information, take reasonable steps so that no one else can access it TC Privacy Guidelines Drone Users
Be open and responsive	If someone complains that your flight is harming their privacy, respond with respect and courtesy TC Privacy Guidelines Drone Users

Businesses in Canada must follow the Personal Information Protection and Electronic Documents Act — PIPEDA — when using drones. Under it, the organisation must get consent for collecting, using and disclosing personal information, and for that consent to be valid, people must understand the nature, reason and consequences of what they are agreeing to. TC Privacy Guidelines Drone Users

Two boundaries matter as much as the rule itself: TC Privacy Guidelines Drone Users

• PIPEDA does not apply to an organisation that operates entirely within Alberta, British Columbia or Quebec — those provinces have their own private-sector privacy laws — except where the collection, use or disclosure crosses borders or the organisation is federally regulated. TC Privacy Guidelines Drone Users
• PIPEDA does not apply where the personal information is collected, used or disclosed for purposes that are journalistic, artistic, literary, academic, or for not-for-profit organisations or charities. TC Privacy Guidelines Drone Users

The organisation is also expected to follow the 10 fair information principles the Office of the Privacy Commissioner outlines — including identifying the reason for collecting personal information and giving people access to their own. TC Privacy Guidelines Drone Users

For federal government institutions, including parent Crown corporations and their wholly owned subsidiaries, the Privacy Act applies rather than PIPEDA. It allows personal information to be collected where the information relates directly to the institution's programs or activities and the person is told the reason for the collection. TC Privacy Guidelines Drone Users

Before flying, the page asks the institution to test the need itself: does the program need the information, is a drone an effective way to get it, and is there a less intrusive alternative? TC Privacy Guidelines Drone Users

And there is a procedural duty that precedes a new programme: a Privacy Impact Assessment (PIA) must be completed before introducing new or redesigned programs and services that handle personal information. Completed PIAs go to the Treasury Board Secretariat and the Office of the Privacy Commissioner of Canada. TC Privacy Guidelines Drone Users

Question	The answer
Do privacy laws apply to drones?	Yes — they need not name drones to cover what a drone collects TC Privacy Guidelines Drone Users
What is personal information?	Information about an identifiable person: a name, a picture of a face, a licence plate number TC Privacy Guidelines Drone Users
What can a flight be beyond a privacy issue?	Voyeurism, mischief, a nuisance, or a provincial or municipal law violation TC Privacy Guidelines Drone Users
What must a recreational pilot do about consent?	Tell those likely to be captured and get their consent TC Privacy Guidelines Drone Users
When is PIPEDA consent valid?	When people understand the nature, reason and consequences TC Privacy Guidelines Drone Users
When does PIPEDA not apply to an organisation?	Operating entirely within AB, BC or QC (unless the information crosses borders or the organisation is federally regulated), and for journalistic, artistic, literary, academic or not-for-profit purposes TC Privacy Guidelines Drone Users
What must precede a new government drone programme?	A Privacy Impact Assessment TC Privacy Guidelines Drone Users

• Information captured without consent should be made anonymous TC Privacy Guidelines Drone Users
• Recordings containing personal information must be stored securely TC Privacy Guidelines Drone Users
• A complaint about privacy is answered respectfully, not defensively TC Privacy Guidelines Drone Users
• A PIA goes to the Treasury Board Secretariat and the Privacy Commissioner TC Privacy Guidelines Drone Users

Symptom	Likely cause	What to do
"No law mentions drones" is offered as a defence	The laws apply anyway	Answer that privacy law covers what the drone collects TC Privacy Guidelines Drone Users
A licence plate is not treated as personal information	It is one of the examples	Treat it as personal information TC Privacy Guidelines Drone Users
A flight is assumed to raise only privacy issues	Some conduct is an offence	Consider voyeurism, mischief, nuisance and provincial or municipal law TC Privacy Guidelines Drone Users
A business relies on consent nobody understood	Validity requires understanding	Explain the nature, reason and consequences TC Privacy Guidelines Drone Users
PIPEDA is applied in Alberta, BC or Quebec without checking	Those provinces have their own laws	Check the border-crossing and federally-regulated exceptions TC Privacy Guidelines Drone Users
A new government programme flies before any assessment	A PIA comes first	Complete the PIA and file it TC Privacy Guidelines Drone Users

Practise: Ops privacy

Practise: Ops pipeda

Practise: Ops privacy act

• TC web page — Privacy guidelines for drone users