Drones and privacy?

Key Points
  • If you fly a drone for money or any other form of economic gain, you are flying for commercial purposes according to CASA.
  • Individuals in their private capacity that fly drones are exempt from the Privacy Act.
  • Individuals that fly drones for the purpose of disclosing personal information about another individual to anyone else for benefit, service or advantage or who are providing a benefit, service or advantage to collect personal information about another individual from anyone else are not exempt from the Privacy Act.

The Commonwealth Government recently announced it will be spending almost $7 billion on 6 long-range MQ-4C Triton surveillance drones to assist with border security and intelligence gathering.  The use of drones (remotely piloted aircraft) both in commercial and recreational (flying for fun) settings has dramatically increased in recent years.  Whilst most of those drones will not have the sophistication or expense of those the government is buying, they generally all have one thing in common – they contain GPS and flight recorders that can record voice and pictures.  We thought this a good time to remind our readers of some of the rules they should be familiar with if intending to use a drone in their business.

Drones use in Australia is governed by the Civil Aviation Safety Authority (CASA).  CASA determines drone safety rules that every user must follow, no matter if you are using your drone commercially or just for fun. 

Using for Fun

Generally most people flying drones for fun will be following the provisions for model aircraft.  These provisions include (but are definitely not limited to):

  • not flying at night;
  • not flying higher than 120 metres from ground level;
  • not flying within 30 metres of people;
  • must be in sight of the operator;
  • not flying over or near an area affecting public safety or where emergency operations are underway; and
  • not flying in a way that creates a hazard to another aircraft, person, or property.

Using Commercially

If you intend to fly for money or any other form of economic gain, you may be flying for commercial purposes.  In this instance, you may need to be licensed and / or certified by CASA.  We recommend contacting CASA or visiting their webpage at https://www.casa.gov.au/standard-page/flying-drones-commercially to determine if this is the case.

Privacy Act 1988 (Cth)

Whilst there are differences between flying a drone commercially and for fun from CASA’s perspective, the reasons for this difference may not be the same under the Privacy Act 1988 (Cth) (Privacy Act).  Breaches of the Privacy Act may result in more daunting consequences to drone operators than breaches of CASA.

The Australian Privacy Commissioner in his letter dated September 2012 to the Attorney-General stated that “where an agency or private sector organization covered by the Privacy Act 1998 (Cth) intends to use drone technology, it must do so in accordance with the Privacy Act….The Privacy Act does not however cover the actions of individuals in their private capacity, including any use of drones by individuals.”

This blanket statement by the Australian Privacy Commission should be read in conjunction with the Privacy Act as not all individuals will be exempt from it.  Under the Privacy Act, a Small Business Operator is usually exempt.  A Small Business Operator must have an annual turnover of less than $3 million and can be an individual, body corporate, partnership, unincorporated association or trust.  But there are exceptions which may make some Small Business Operators not exempt from the application of the Privacy Act.  Under Section 6D(4) of the Privacy Act, an  individual, body corporate, partnership, unincorporated association or trust is not considered a Small Business Operator for the purposes of the Privacy Act if he, she or it:

a. has an annual turnover of more than $3 million; or
b. provides a health service to another individual and holds any health information except in an employee record; or
c. discloses personal information about another individual to anyone else for a benefit, service or advantage; or
d. provides a benefit, service or advantage to collect personal information about another individual from anyone else; or
e. is a contracted service provider for a Commonwealth contract (whether or not a party to the contract); or
f. is a credit reporting body.

Parts (c) and (d) above are particularly important for drone operators and may mean that even if they are an individual, if these activities are the reason for the drone use, then they will not be a Small Business Operator under the Privacy Act and therefore, not exempt from the Privacy Act’s application. 

In recent years, real estate agents in particular, are an example of small businesses that do not qualify for the small business exemption because of the exclusions in c) and d).  This is because when capturing aerial images of client’s properties for selling and marketing purposes they may accidently capture images of unsuspecting neighbours who were unaware photos were being taken and whose consent was not asked for or given before less than appropriate photos have been published.

Any (small) business that uses drones to capture images for marketing purposes needs to have a process in place to ensure that those images do not contain the personal information of other individuals.

Breaches of the Privacy Act can attract both civil and criminal penalties, which can include large fines. 

The laws relating to drone use are constantly expanding and are not limited to those from CASA or that contained in the Privacy Act.  It is not the use of a drone that is a problem from a privacy perspective; it is the capturing of personal information via images that may cause a breach.  We recommend seeking advice before you start using a drone for your business.

Post by John Kell, Joanne Gream and Joshua Yan 

Most Popular Articles


When can the unqualified be qualified? Non-lawyers engaging in legal practice - when is it OK and when is the law broken

Only lawyers can provide legal advice, but anyone can provide legal information. When thinking of the difference, you might ask your friend or colleague to provide information about a serious illness; however you would seek out a qualified medical professional in relation to its treatment.

Service of Notices by Registered Post

Where service of a notice is authorised or required by post, unless the contrary intention appears, service will be deemed to be effected at the time when the notice would be delivered in the ordinary course of post: see the various Acts Interpretation acts of the States and Commonwealth.

Thanks, but no thanks – I don’t want to inherit

It seems odd that anybody would reject an inheritance, but for some beneficiaries, there are valid reasons they do not wish to receive their inheritance.

Subscribe to Our Blog

Keeping you connected, Hicksons regularly publishes articles to keep you up to date on the latest developments. To receive these updates via email, please subscribe below and indicate which areas of law you would like to receive information on.