Drones are taking off – and so are questions about the data they collect.
The use of unmanned aerial vehicles (UAVs), commonly known as drones, is seeing rapid growth across various industries in Canada. Drones are increasingly being used in agriculture, construction, oil and gas, mining and other industries, to monitor, inspect, explore and survey work sites, not to mention the most touted use of all, delivery of the ubiquitous Amazon packages to remote areas. At the same time, drones are also being used for corporate espionage and criminal applications, leaving companies unsure of how they can protect themselves.1
The growth of UAVs brings additional focus on the aviation regulatory landscape and the crucial safety considerations informing the sharing of airspace, considerations that underlie the recent coming into force of amendments to the Canadian Aviation Regulations. This adds to the existing framework put in place by Transport Canada governing the use of UAVs, a framework that comes with the possibility of significant fines for violations. Aside from safety issues, operators of UAVs also need to be mindful of privacy and confidentiality concerns and ensure that they comply with Canada's ever more robust and continuously evolving privacy law landscape.
This article provides (1) an overview of the privacy laws applicable to drones; and (2) tips for businesses on how they can protect themselves from corporate surveillance.
(1) Privacy Laws Governing UAVs in Canada
In Canada, privacy is a fundamental right protected by a comprehensive legal framework and understanding the privacy landscape is critical for businesses using drones. Canada's main privacy legislation is the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and its provincial counterparts in Alberta, British Columbia and Quebec. These privacy laws govern handling of "personal information" by businesses and include provisions protecting photos and videos of identifiable individuals (including those taken by UAVs).
Under PIPEDA and its provincial equivalents, and as with all collectors of personal information, commercial UAV operators must obtain informed consent before collecting personal information and must ensure that such collection is appropriate in the circumstances. Drone operators would be wise to avoid collecting personal information when possible and, accordingly, should endeavour to limit the use of UAVs in densely populated areas and should use blurring technologies to obscure faces and license plates. Operators should also inform the public with clear and conspicuous signage of their presence and their purpose, so that individuals can avoid being recorded, along with providing contact details for questions. If a business must collect personal information, in addition to obtaining prior consent, it should only collect that personal information for which it has a legitimate business purpose.
Among other consequences, breaching privacy laws could lead to an investigation by a privacy regulator. An investigation may result in a public report of findings, a fine or penalty, or an order to cease the practice or delete information.
What about recording in public?
It is a common misconception that recording people and activity in public spaces is permitted without consent. In fact, Canadian privacy laws do not permit businesses to collect, use or disclose public information without consent except when that information comes from a limited set of permitted sources. These permitted sources include items like phonebooks and business directories, but do not include outdoor public spaces.2
Other applicable privacy laws
Along with Canada's privacy legislation, there are various statutory and common law torts and recourses for invasions of privacy that may apply to the inappropriate use of drones.3 For instance, Ontario courts have long recognized a tort for "intrusion upon seclusion" which applies to the intentional (or reckless) invasion of another person's privacy, if that invasion would be highly offensive to a reasonable person.4 British Columbia's Privacy Act goes even further by expressly including intrusion via surveillance.5 Invasions of privacy may also lead to criminal prosecution where the invasion could be characterized as trespass, harassment, or voyeurism for instance. If the drone records audio, it could also result in a charge for interception of communications if a recording picks up private conversations.6
The Unauthorized Use of Drones Has Violated Your Privacy – Now What?
Where a drone is being used to invade the personal privacy of individuals, there are various legal remedies available, ranging from private-sector privacy law to tort law in the common law jurisdictions and extracontractual remedies in Quebec, to criminal law. A person experiencing invasions of privacy from drones could file a complaint with law enforcement, bring a legal claim, or file a complaint with a privacy commissioner.
(2) Confidentiality and Business Information Protection
Unlike personal information, confidential business information does not benefit from the same degree of statutory protections, and just as users of drones must respect the confidential information of others, businesses who could be recorded by UAVs must also take steps to safeguard their sensitive information. Customary practices for protecting sensitive business information include (i) registration of intellectual property rights; (ii) robust physical and technological controls on access to information; and (iii) confidentiality agreements. Both businesses using drones and those liable to be recorded by drones should ensure that their staff are adequately and continuously trained to prevent, identify and respond to unauthorized drone activity and have in place up to date policies and procedures allowing them to quickly address, remove and report such activity.
Legal Recourse for Unlawful UAV Surveillance
Privacy concerns from the unauthorized collection of personal information by UAVs are likely to give rise to clear legal grounds for a claim. By contrast, legal remedies for unauthorized access to sensitive business information are limited and will depend largely on the facts and circumstances of each case. Property law, and specifically the concepts of trespass and nuisance, may offer the best remedy against intentional, unauthorized UAV intrusions into a business' airspace (noting that the height and extent of what constitutes airspace rightfully belonging to a business remains unclear in Canadian jurisprudence).7 If a UAV intrudes into a business' airspace and interferes with the business' operations, the business may also have grounds to seek an injunction or damages. As for potential criminal law remedies for unauthorized drone use in a commercial context, this specific question remains unanswered, and depending on the facts at hand, recourse to more traditional criminal law concepts may be available, such as corporate espionage, trade secrets and criminal fraud.
Given the limited legal avenues for recourse and the potential for significant fines if found in violation of the law, both operators of UAVs and their potential victims should proactively protect their sensitive commercial information and ensure that their use of UAVs is conducted in accordance with explicit guidelines and accompanied by the necessary training to ensure compliance with the law.
Footnotes
1. Global Guardian, Unmanned Aerial Systems: How Drones Are Impacting Corporate Espionage, Global Digest (25 March 2025), online: Global Guardian.
2. See for example Regulations Specifying Publicly Available Information, SOR/2001-7.
3. See British Columbia's Privacy Act, RSBC 1996, c 373; Saskatchewan's The Privacy Act, RSS 1978, c P-24; Manitoba's The Privacy Act, CCSM c P125; and Newfoundland and Labrador's Privacy Act, RSNL 1990, c P-22.
4. Lyndsay A. Wasser, Seclusion Intrusion: A Common Law Tort for Invasion of Privacy, McMillan LLP (January 2012), online: McMillan LLP.
5. Privacy Act, RSBC 1996, c 373, s 1.
6. Criminal Code, (R.S.C., 1985, c. C-46), s. 184.
7. Similar remedies exist under Articles 1457 and 976 of the Quebec Civil Code.
The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.
© McMillan LLP 2025
