Police drone programs just got an oversight checklist

Oversight arrived with the programs Ontario's Information and Privacy Commissioner published updated guidance on police use of drones on August 17, replacing a version that had been in circulation since 2012.

The timing is not abstract. Municipal forces have been standing up programs through the summer, and the Saanich Police Department announced its own remotely piloted aircraft program on August 6. For commercial operators this is not another agency's compliance file. Public sector drone work is frequently contracted out, and the guidance sets expectations for documentation, retention, transparency and reporting that sit behind the flights. If you fly for a police service, a municipality or an emergency management agency, those expectations are now part of your scope of work.

Lawful authority comes before the aircraft

The guidance is direct: a police service must establish lawful authority before deploying drones and must operate lawfully. A service that has already deployed a program and is unsure whether its authority holds is expected to stop and bring the program into compliance before continuing. For a contractor the translation is simple. Ask which lawful authority covers the mission before the first flight, and get the answer in writing. In Ontario that means the access and privacy statutes, plus an independent authority wherever a reasonable expectation of privacy attaches to the personal information being gathered. A client instruction is not a legal basis.

The disclosure list is public facing

The guidance recommends that services make a specific set of material easily available to the public, including current policies and procedures, a plain-language summary of what the program does, the technical attributes of the aircraft, planned or retroactive flight paths, summaries of privacy impact assessments, and statistics on how the drones are used. That list doubles as a template for any drone program touching the public. If you can assemble those items for your own operation, you can answer most of what a client, insurer or regulator will eventually ask. If you cannot, better to find the gap yourself.

Records, retention and the aircraft that does not come home

The guidance treats a lost or compromised aircraft as a potential privacy breach, which is a useful framing for teams that file a flyaway under maintenance and insurance. The data on the aircraft, including recorded imagery, is part of the incident. It also sets expectations for handling information: collection limited to what is necessary for a legitimate purpose, care around sensitive locations such as residences and healthcare settings, encryption and access controls, protection for transmitted data, and incident response procedures. Operators are expected to complete privacy training, and services are expected to document completion of that training every year.

What to put in the paperwork

Three additions to public sector scopes of work. Request the client's privacy impact assessment and retention rules, then align your own handling with them instead of defaulting to your standard archive period. Log flight purpose and paths at the level of detail the public disclosure list implies, because your records may be summarized in material the service publishes. And if a client wants to add facial recognition, automated tracking or analytics to the payload, treat that as a change in scope requiring its own authority rather than a software update. Oversight rarely arrives as one enforcement decision. It arrives as a checklist that someone expects you to be able to answer.