Toronto, Vancouver and Montreal camera, drone and facial recognition rules under provincial privacy laws

What to take away

Who regulates municipal surveillance in each city

Canada has no single municipal surveillance law. Each city operates inside a provincial privacy statute, and each province has its own commissioner. The federal law, PIPEDA, mostly covers private companies, not city hall.

The overview of federal and provincial privacy laws and oversight bodies explains which regulator handles which sector. For city cameras and drones, that is almost always the provincial commissioner.

Toronto sits in Ontario. Vancouver sits in British Columbia. Montreal sits in Quebec.

The City of Toronto Act, 2006, the Vancouver Charter and the Charter of Ville de Montreal give each city its municipal powers. None of the three sets camera rules. The provincial privacy statute is the instrument that binds a city camera or a city drone.

All three cities also fall under the federal surveillance guidance relevant to camera and drone bylaws when a project touches federal jurisdiction, such as airports or ports.

Toronto: street cameras, drone rules and the IPC Ontario

Toronto runs closed-circuit television in transit stations, on some streets and around city property. The TTC, Toronto Police Service and various city divisions each operate their own cameras.

Every city division that collects personal information through video must follow Ontario's municipal privacy rules and report to the IPC Ontario. The IPC has repeatedly told Ontario institutions to complete a privacy impact assessment before installing cameras.

Its Guidelines for the Use of Video Surveillance Cameras in Public Places, issued in 2001, set out the signage, notice and retention tests the city is expected to meet.

Toronto camera rules: MFIPPA, R.S.O. 1990, c. M.56

MFIPPA is the instrument. Section 29(2) requires a division to tell you its legal authority for the collection, the purpose, and a contact for questions. That notice has to be available at or before the point of collection.

Across Canadian municipal camera programs, a published retention window of a few days to about 30 days is typical. Treat that as a typical range. The notice for the exact system in front of you is the figure that binds the city.

MFIPPA adds a floor on top. Footage used to make a decision about you must be kept for at least one year, so a short deletion policy cannot be used to erase a record you have asked for.

For residents, the practical point is that a camera on a city building and a camera on a private shop are governed by different laws. The city camera answers to the IPC Ontario. The shop camera answers to PIPEDA or Ontario's private-sector rules.

Toronto drone rules under CARs Part IX and MFIPPA

Toronto Police have used drones for scene documentation and search work. City divisions have also used drones for inspection tasks such as roof and bridge checks. Transport Canada rules cover the flight itself.

Those flight rules sit in the Canadian Aviation Regulations, Part IX, in force since June 1, 2019. They cover altitude, distance from bystanders and pilot certification. They say nothing about how long footage may be kept.

The privacy question is separate. Any city drone flight that captures identifiable people triggers Ontario's privacy obligations, including a notice and a retention limit.

The same consent logic applies to devices you run yourself. Our browser tracking methods compared walks through how consent is handled for other always-on collection.

Toronto facial recognition

The Toronto Police Service stopped using Clearview AI in 2020 after the IPC Ontario and other commissioners reviewed the practice. The service has not run a public facial-recognition program since.

Toronto's street camera network does not run facial recognition as a standard feature. Any proposal to add it would require a new privacy impact assessment and public notice.

Vancouver: camera policy, drone use and the OIPC BC

Vancouver operates cameras in public spaces, transit areas and city facilities. The city publishes a privacy policy for each camera system and names the purpose, such as traffic monitoring or crime prevention.

The binding statute is the Freedom of Information and Protection of Privacy Act, S.B.C. 1992, c. 61. Section 26(2) requires the city to give you the purpose, the legal authority and a contact before or at the time of collection.

The OIPC BC oversees these systems under British Columbia's privacy law. The office has issued guidance on video surveillance and expects a privacy impact assessment before a new system goes live.

Section 30.1 is where B.C. splits from the other two provinces. It requires public body personal information to be stored and accessed only in Canada. A camera archive held on a foreign cloud service breaches that rule, whatever the retention policy says.

British Columbia also maintains provincial rules on how public bodies manage data. The data and information management guidance from the Province of British Columbia sets out how that data is stored and protected.

Vancouver drone rules under FIPPA section 30.1

Vancouver has used drones for engineering inspections, emergency response and bylaw work. Police drone use has been the subject of OIPC BC scrutiny and public reporting.

The OIPC BC position is that drone footage of identifiable people is personal information. That means the city must limit collection, store footage securely and delete it on schedule.

Transport Canada flight rules apply here too. The B.C. difference is storage, not flight. FIPPA expects deletion once the purpose ends, and the city's notice for the system states the window.

The City of Vancouver has also faced questions about drone use near protests and public gatherings. If a private company, not the city, holds the footage, our data services compared covers retention and access basics.

Vancouver facial recognition

The Vancouver Police Department ran a facial-recognition pilot that ended in 2020. The OIPC BC reviewed the pilot and raised concerns about legal authority and accuracy.

In 2021 the OIPC BC reported on the department's use of Clearview AI. It concluded that the collection lacked authority under the Police Act and that images were stored outside Canada, contrary to FIPPA section 30.1.

Any new deployment would trigger a fresh OIPC BC review and a public privacy impact assessment.

Montreal: surveillance cameras, drones and the CAI

Montreal runs one of the denser municipal camera networks in Canada. The city publishes a map and a policy for its surveillance cameras, and each borough handles some installations.

The governing statute is Quebec's Act respecting access to documents held by public bodies and the protection of personal information, CQLR c. A-2.1. Law 25, formally the Act to modernize legislative provisions as regards the protection of personal information, amended it.

The CAI, Quebec's privacy commissioner, oversees these systems. Quebec's Law 25 strengthened consent rules and added biometric privacy protections, which makes Montreal's framework the strictest of the three cities.

Quebec's justice system also shapes how complaints move through the province. The Quebec justice and civil status portal is the starting point for understanding how a privacy dispute can proceed.

A-2.1 requires written notice of the purpose of a collection. Retention is tied to that purpose, and the city's records schedule sets the actual number of days. The borough access officer can give you the figure that applies to the camera near you.

Montreal surveillance cameras

Montreal's camera policy requires a stated purpose, a retention period and a privacy impact assessment. The city has expanded its network in some boroughs and scaled it back in others after public consultation.

Quebec Law 25 adds a requirement that biometric information be treated as sensitive. A camera that identifies faces, gait or other biometric markers faces a higher bar than a plain video camera.

Montreal drone rules under A-2.1 and Law 25

Montreal has used drones for inspection and emergency work. Police drone use has been reported in the city and is subject to the same Law 25 rules as any other collection of personal information.

Montreal also has a dense AI research sector, which has kept drone and camera policy in public debate. Residents can ask the CAI how a specific program complies with Law 25.

Montreal facial recognition

Montreal paused facial-recognition work after public and regulatory concern. The CAI has been clear that biometric data needs a strong legal basis and explicit consent in most cases.

That position makes a future Montreal deployment harder than in the other two cities. A city division would need to justify the program under Law 25, not just under a general safety mandate.

Facial recognition: bans, pilots and reversals compared

All three cities pulled back from facial recognition around the same period, but for different reasons and with different legal consequences.

A worked example shows how the difference plays out. Suppose a business improvement area in each city wants to install a camera that flags known shoplifters.

The same camera idea produces three different compliance paths. That is the core of how municipal surveillance bylaws Canada differ by city.

If you run a small business and want to avoid the biometric problem entirely, our mobile app privacy checklist guide covers cameras that do not identify people.

What to do if you believe a municipal camera or drone captured you unlawfully

Start with the city. Every division that runs cameras or drones has a privacy officer or an access-to-information contact. Ask what was collected, why, and how long it is kept.

Then decide which regulator fits. The city's provincial commissioner handles public-body complaints. The OPC handles federal matters. A private business falls under PIPEDA or the provincial private-sector law.

Filing and tracking a complaint in each province

Each province runs its own clock. File with the city first, then escalate. The order is the same in all three.

Tracking works the same way in each province. Keep a dated copy of every request. Note the day the clock starts. If the deadline passes with no answer, escalate to the commissioner and cite the missed date.

The OPC accepts complaints about federal bodies at any time and charges no fee.

If the footage ended up on a home or small-business system instead, the weak point is usually the account protecting it. Our authentication methods compared guide covers exposed feeds and default passwords. For how footage is stored and processed, see our comparison of personal data categories.

Common questions