OPC comment to Transport Canada on Unmanned Aerial Vehicles
Submission of the Office of the Privacy Commissioner of Canada to the Canadian Aviation Regulation Advisory Council (CARAC)
August 27, 2015
Canadian Aviation Regulation Advisory Council (CARAC)
c/o Transport Canada Civil Aviation Communication Centre (AARCB)
330 Sparks Street
Ottawa ON
K1A 0N8
Dear members of the CARAC:
I am writing to provide comments regarding the notice of proposed amendment (NPA) to the Civil Aviation Regulations published by Transport Canada (TC) in the CARAC Activity Reporting Notice, no. 2015-12 (May 28, 2015). As the background section of the notice makes clear, TC has been actively engaged with our office regarding potential privacy implications of these technologies and related developments since 2012 (page 3). We realize this is an initial sounding of industry and a public view on regulatory work planned for the future, so that there will be further occasions to comment, and we believe privacy is a key part of the discussion.
We also appreciate the briefings and consultations that TC officials have held with our Office on this file in the past several years. Those meetings have been very useful in clarifying the technical language at play, the privacy concerns arising from the widening use of UAVs and the challenges that confront TC as a regulator in this context; we note the substance of some of these discussions is reflected in the background and regulatory framework sections (page 32) of the recent notice. We look forward to continuing this engagement with TC as program elements around use of UAVs are realized.
From the outset, we should make clear that when governmental organizations intend to embark upon detailed program design incorporating UAV options, our Office will, as a rule, provide departments with specific recommendations through our Privacy Impact Assessment (PIA) review process; therefore please consider the feedback in this letter as general comment on regulatory direction and strategy, as opposed to comment on specific applications.
Privacy context around UAV governance
The Office of the Privacy Commissioner (OPC) began to develop an interest in UAV technology in 2010, following a growing number of media articles and inquiries to our research group and information centre about their use in border security operations and police work. This led to internal research (2010), expert consultation (2011-2012), discussions with a variety of operators (2012-2013) and a published research paper (2013). As noted above, Transport Canada experts have kindly briefed us on developments over this period as well.
In all discussions and commentary our Office has provided on the technology, we have tried to emphasize the point that privacy risks arise from the unique combination of capabilities incorporated into evolving UAV applications – namely that they couple powerful imaging payloads (high-resolution, infrared, night vision), remote command capability (adding a covert potential) and the ability to linger for periods of time. As CARAC documentation has itself noted at various points, UAVs are not simply airframes, as their communications links and sensor payloads are plainly critical aspects of their operational capability. Where UAVs are in operation, proximity of device to subject and the optical power of imaging will clearly raise privacy concerns, quite independently of UAVs as a standalone device on their own.Footnote 1
As a consequence, where these components raise privacy questions, through either collection or transmittal of data, regulations or standards of licensing ought to point to relevant legal boundaries or policy controls where privacy rules are not made directly clear in regulations or flight rules. We believe strong technical safeguards and operating procedures need to acknowledge privacy risks quite plainly; on this point, we are very encouraged to see that “Respect for Privacy and Other Laws” will be specified piloting requirements across all UAV types covered by the 2016 regulations (page 32).
While we fully understand the primacy of TC concerns with ensuring safe, responsible use of Canadian airspace, we believe regulators and licensing officers should continue to emphasize relevant privacy laws and Criminal Code prohibitions related to collection of personal data, identity data, covert video surveillance, prohibitions on voyeurism and interception of private communications.
Markings, identification, registration and accountability
One of the widely acknowledged challenges by all regulators involved in UAV issues to date, indeed a foundational question for any regulatory regime be it safety, privacy or security – is the reliable ability to readily identify operators when problems arise. Attribution matters for any technology that can be deployed in communal, public or private spaces where individuals can be inappropriately targeted or technology misused and where complaints arise.
The practical question of how a member of the public or regulators would obtain accurate operator information in order to simply process a complaint is not an academic question. Just as automobiles and boats on public roads and waterways carry readily identifiable markings, if UAVs are going to operate in public airspace, TC must consider some manner of system to provide for their identification – whether this is through a physical plate (as on a car), painted number or decal (as on a plane) or emitted unique signature signal (as from a RFID device). While the OPC has no particular mode of identification to recommend here, we believe from an accountability and regulatory standpoint, some means must be standardized and in place to specify which commercial or government organizations might be operating UAVs.
Sensitive and protected areas
From a safety perspective, operation of UAVs in crowded areas, around aerodromes, airports and heliports has already been restricted, both in Canada and many other countries. Other jurisdictions, including many in the US, have placed outright bans on usage of UAVs in certain sensitive areas where people might congregate or other aircraft might be operating – certainly until such time as sense and avoid systems are better developed and more widely deployed.
We would encourage CARAC members to give thought to exploring a similar line of reasoning with regard to privacy concerns. Residential areas, schoolyards and shelters, hospitals and prisons, places of worship and memorial sites – all come to mind as spaces which, while perhaps public, carry with them some expectation of privacy when people use them.
As with identification methods noted above, we do not here have an exhaustive list of locations in mind, nor would we recommend an outright prohibition on usage in these areas, but would ask CARAC to consider developing a best practices approach to flag certain spaces like those mentioned as privacy sensitive (places where individuals’ sense of potential intrusion is generally heightened). Just as we would anticipate organizations concerned about their own security would be alarmed by sudden increases in the use of UAVs around their property, we would expect citizens could be similarly concerned if certain spaces were encroached upon.Footnote 2
For a recent specific example of regulation in this context, please see guidance issued this summer by Argentina’s Data Protection AuthorityFootnote 3, and where investigative use is contemplated, you might refer to our own Office’s Guidelines on the Use of Video surveillance by Public Authorities.Footnote 4
Purpose specification
Besides the question of operator identification noted above, appropriate usage of UAVs as they collect and relay personal information is one of the other foundational concerns that privacy regulators and civil society groups have globally been concerned with. Appropriate usage is a basic premise of both federal data protection laws in Canada, for both governmental and commercial organizations (i.e., where personal information is collected it should be for a defined “business need” or “program purpose.”).
It is our hope that new licensing regulations for UAVs might make reference to this essential condition in some manner, so as to have operators reflect this consideration as the technology is more widely adopted for various commercial and public-sector purposes. It is our view, shared we believe by both government and industry experts, that UAVs have enormous potential to assist in many sectors: for instance, in their ability to inspect property, facilities and infrastructure, monitor livestock and farm conditions, advance scientific research, further conservation efforts, augment surveying and mapping capabilities, and so forth. In a country the size of Canada, landscape, logistics and distance continue to present challenges for these various efforts and UAV use can offer real, demonstrable benefit.
We recommend CARAC consider in its views on TC regulations a distinction in licensing between the bona fide “public interest” uses (as noted above) in contrast to purely commercial applications, where privacy risks are higher relative to their societal benefit. This would be particularly true where a clear “business need” is left undefined, potential collection of personal information seems excessive or areas of UAV operation might be deemed privacy sensitive. In our experience, new commercial applications for data collection do not always emerge as a privacy risk from the outset; clear language in licensing about appropriate use and collection can provide an important signal to all operators before deployment.Footnote 5
Conclusion
Again, we would like to acknowledge the thoughtful work that TC officials have done over the past several years to help educate the public, oversee UAV use and further develop clear rules and procedures on the use of the technology. We have benefited from TC consultations with our Office and we appreciate this opportunity to provide further comment on the issue. Should you have any questions or require additional information on the points above, please feel free to contact me at (819) 994-5965 or Chris Prince at (819) 994-5914.
(Original signed by)
Sincerely,
Barbara Bucknell
Director, Policy and Research
- Date modified: