It is estimated, based on 2015 statistics, that the market value of global commercial drone use exceeds $127 billion. With growing demand for higher quality data through drone usage, there is an increasing probability that confidential or personal information will be collected. Drones can present a total invasion of privacy if operators gather personal data or film individuals. The most common occurrence would be filming unsuspecting individuals carrying out their daily lives as the drone flies overhead. Consequently, drone operators need to be cognisant of all ancillary data and personal information that is collected. Operators must also ensure that they abide by privacy legislation.
Both the Office of the Privacy Commissioner and the Information and Privacy Commissioner of Ontario have concluded that the Personal Information Protection and Electronic Documents Act ("PIPEDA") would apply to regulate information collected in the use or operation of commercial drones.
The purpose of PIPEDA is to establish, in an era which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information. Not surprisingly, the term "personal information" has been given a very broad definition, and includes "information about an identifiable individual."2 Arguably, much of what is collected by drone operators would satisfy this definition.
PIPEDA regulates how private sector organizations collect, use and disclose personal information in the course of commercial business.3 Commercial drone operators need to be mindful of this legislation given how drone surveillance has the ability to collect extensive amounts of data about an individual. Data collected in the process of conducting surveillance, obtaining photographs or taking videos may trigger PIPEDA provisions. Operators working for real estate firms, research agencies, oil and gas companies, excavation companies or any other institution that requires the drone operator to gather information and media content in public settings may be subject to this legislation.
A key factor in invoking the PIPEDA provisions is whether the information collected about an individual makes it possible to identify that particular individual. In Gordon v Canada (Health), it was held that the threshold to be considered "identifiable information" is whether there is a serious possibility that the information permits or leads to the individual being identified using this information either alone or in combination with information from sources otherwise available, including public sources.4 Given the degree to which information can now be pieced together, and the increasing amount of surveillance that is conducted, this should be a growing concern for many businesses.
Section 5(3) of PIPEDA outlines the way in which a private organization may collect, use or disclose personal information. It specifies that the information can only be used for purposes that a reasonable person would consider appropriate in the circumstances.5 In most cases, an organization must also obtain consent from the individual, as the provisions in PIPEDA are designed to ensure that individuals are aware of when and for what purpose their information is being captured. Given the nature of drones, their mobility and long range capabilities, the task of acquiring this consent prior to the collection of personal information will prove difficult. While there are exemptions to the provisions of PIPEDA, these will likely apply in a strict and narrow context with respect to commercial drone operators.
Principle 4.4 of PIPEDA establishes that organizations are not to collect information indiscriminately. It also requires that the amount and type of information collected be limited to what is necessary to fulfill the purposes identified. As a result, the indiscriminate collection of information, which drone technology permits, is contrary to the purpose of the legislation.
In 2015, the Office of the Privacy Commissioner of Canada released commentary in response to the put forth amendments to the Civil Aviation Regulations by Transport Canada. The commentary noted that privacy must be a "key part of the discussion".6
As drone use becomes more widespread, it is important that the commercial benefits of drone use be balanced against the privacy of others, especially in the context of activities that occur in public spaces. The goal is to ensure that the expectation of privacy remains intact. The prospect of having every move monitored, and possibly recorded, raises profound privacy concerns. While there are undoubtedly numerous commercial benefits in the use of drones to assist, these uses must be balanced against privacy issues commonly associated with the use of drones. As Transport Canada continues to update the regulations, with interest from various privacy groups, commercial drone operators should take great care to ensure they are aware of changing legislation and the privacy considerations in drone use.
Footnotes
1. PricewaterhouseCoopers, Clarity from Above: http://www.pwc.es/es/publicaciones/tecnologia/assets/clarity-from-above.pdf.
2. Personal Information Protection and Electronic Documents Act, SC 2000, c 5 [PIPEDA].
3. Office of the Privacy Commissioner, Drones in Canada: Will the Proliferation of Domestic Drone use in Canada Raise New Concerns for Privacy: https://www.priv.gc.ca/information/research-recherche/2013/drones_201303_e.asp.
4. 2008 FC 258 at 33-34.
5. PIPEDA, supra note 2.
6. Office of the Privacy Commissioner of Canada, OPC comment to Transport Canada on Unmanned Aerial Vehicles: https://www.priv.gc.ca/information/research-recherche/sub/sub_tc_150827_e.asp
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
