Commercial uses for drones, also known as unmanned aircraft systems (UAS), abound. From handling dangerous inspections to collecting soil and crop data for use in precision agriculture, drones can be extraordinarily helpful. However, safety and privacy concerns have hindered widespread commercial use, at least until now. New regulations now clear the way for American businesses to benefit from the many commercial uses for drones.

The Federal Aviation Administration’s (FAA) long-awaited regulations, known as Part 107, for non-hobbyist use of small unmanned aircraft systems (sUAS) took effect on August 29, 2016. Since 2012, the FAA has been working to establish a regulatory structure to allow for a wider use of sUAS for commercial purposes. The regulations, codified at Part 107 of Chapter 14 of the Code of Federal Regulations, represent a major milestone. Only 20,000 drones are in commercial operation right now but with the Part 107 regulations, the FAA predicts that 600,000 may be in commercial use within one year. The regulations should allow operators greater flexibility to use sUAS for routine activities without requiring case-by-case prior review and approval by the FAA. And the regulations allow operators to approach the FAA on a case-by-case basis to relax or remove certain Part 107 restrictions on the operation of sUAS. The new FAA regulations do not address privacy concerns, although a voluntary set of drone privacy best practices has been released by the National Telecommunications and Information Administration.

Before 2012, the FAA considered all drones to be civil aircraft, and all federal aviation regulations applied to drone operations in the National Airspace System (NAS) without regard to the size of the UAS or the altitude at which it was flying. Congress gives the FAA authority to regulate airspace use and air traffic control in the United States. The FAA regulates the flight of all civil aircraft in the NAS. The NAS includes six classes of airspace in the United States, extending from a few feet above ground level to an altitude of 60,000 feet.

In 2012, Congress passed the FAA Modernization and Reform Act of 2012. Section 336 of the Act exempted from FAA regulation model aircraft weighing not more than 55 pounds and flown strictly for hobby or recreational use, so long as the model aircraft is not flown within five miles of an airport. But the FAA interprets the “hobby or recreational use” exemption narrowly. The FAA considers any flight of an aircraft, including a sUAS, for a direct or indirect benefit to be a commercial use. To address commercial uses, Section 333 of the Act directed the FAA to set expedited operational authorization requirements for sUAS to operate safely in the NAS, and to follow those requirements with a rulemaking allowing the civil commercial operation of sUAS. In 2014, the FAA established a process allowing commercial sUAS to operate after obtaining a Section 333 exemption, but obtaining an exemption involved a lengthy and complicated case-by-case application process.

The Part 107 rules establish a much less complex regulatory framework allowing for routine commercial use of certain sUAS today while maintaining flexibility to accommodate future technological innovations. The regulations create a new type of pilot, known as the remote pilot in command. All operations of drones under Part 107 must be by a person holding a remote pilot in command certificate or under the direct supervision of a person holding such a certificate. To obtain the certificate, a person must pass an aeronautical knowledge test at an FAA-approved knowledge testing center, undergo a vetting process with the United States Transportation Security Administration, and be at least 16 years old. Persons holding a Part 61 pilot certificate who have completed a flight review in the past 24 months, other than student pilots, may obtain a remote pilot in command certification after taking an on-line training course instead of the taking the aeronautical knowledge test. Persons holding a foreign UAS pilot certificate must still obtain an FAA remote pilot in command certificate and must be able to read, speak, write, and understand English. Once issued, a remote pilot in command certificate is valid for 24 months.

Part 107 includes numerous requirements for safe sUAS operation. The regulations apply to any sUAS with a gross weight of 55 pounds or less at take-off, including all accessories or attachments. Part 107 allows the sUAS to carry cameras, probes, payload, cargo, and other accessories and attachments if they do not impair flight. All flights must be conducted within the unaided visual line of sight of the remote pilot in command, and each pilot in command may control only one drone at a time. Minimum weather visibility must be three miles from the control station. The sUAS must stay at least 500 feet below and at least 2,000 feet horizontally from any cloud. Part 107 authorizes flights only during daylight hours. However, if the sUAS is carrying anti-collision lighting it may also operate during “civil twilight,” which is 30 minutes before official sunrise and 30 minutes after official sunset. The maximum altitude of the sUAS flight is 400 feet; if a structure is taller than 400 feet, the sUAS may only fly within 400 feet of the top of the structure. Maximum ground speed is 87 knots or 100 miles per hour. Part 107 allows transporting property for compensation or hire so long the flight occurs wholly within the bounds of a state and follows the other requirements of the regulation. But Part 107 does not permit cross-state transportation of property or remote product deliveries conducted by autonomous technology.

Under Part 107, sUAS may fly only in certain classes of the NAS. Typically, sUAS operations will occur in Class G airspace, which is usually below an altitude of 700 feet in airspace not near an airport and not under the control of an air traffic control tower. Operations in Class B, C, D and E airspace—typically at altitudes above 700 feet and near an airport—require permission from air traffic control. There are several additional important Part 107 operational limits including: (i) no operations from a moving aircraft; (ii) no operations from a moving vehicle unless the operation is over a sparsely populated area; (iii) no carriage of hazardous materials as defined by the United States Department of Transportation; (iv) no operations over persons other than the remote pilot in command or visual observer unless those persons are protected by structures with roofs.

The FAA may waive certain Part 107 restrictions if an operator files a waiver petition. Restrictions subject to waiver under Part 107 include: (i) daylight operations; (ii) operations from a moving vehicle or aircraft, so long as the sUAS is not carrying property of another for compensation or hire; (iii) visual line of sight, but with the same prohibition on carrying property of another; (iv) operations over people; (v) operations in certain airspace; (vi) groundspeed; (vii) altitude; (viii) minimum visibility; and (ix) distance from clouds. In the first few days after Part 107 went into effect, the FAA granted over 80 waivers. Most of the FAA’s initial waivers authorized night flights but at least two allowed flights beyond the visual line of sight of the remote pilot in command. The FAA granted the waivers so quickly because after the new Part 107 rules became effective the agency treated numerous pending Section 333 exemption applications as Part 107 waiver requests.

The Part 107 rules and waiver process have largely supplanted but not replaced the Section 333 exemption process. Certain restrictions, including the 55-pound weight limit and the ban on carrying hazardous materials, are not subject to waiver under Part 107. If an operator wants to fly a drone weighing more than 55 pounds or carry hazardous materials, it must file a case-specific exemption application under Section 333.

One open question under the Part 107 regulations is the extent to which federal law preempts state and local laws governing drone use. Congress granted the FAA the statutory authority to regulate all aspects of air safety and aircraft in flight. Federal courts have frequently invalidated local attempts to regulate aircraft, holding that federal law preempts such local regulation. Many commenters on the Part 107 rules, fearing a patchwork of local restrictions, urged the FAA to include a federal preemption provision in the regulations. The FAA declined but referred to a December 2015 memorandum from FAA’s Office of Chief Counsel discussing preemption. The memorandum notes that state and local government police power is not subject to federal regulation. According to the FAA, laws requiring police to obtain a warrant before using a UAS for surveillance or prohibiting certain UAS uses (such as for voyeurism, hunting or fishing, or carrying weapons) are likely to fall within the traditional state and local police power. Therefore, state and local governments appear to be on solid ground if they attempt to regulate UAS operations based upon considerations of land use, zoning, privacy, trespass, and law enforcement. However, the FAA noted federal courts carefully scrutinize state and local regulation of aircraft overflight. Federal law would likely preempt operational UAS restrictions on flight altitude or flight paths, outright flight bans, regulation of navigable airspace, and mandated UAS equipment, certification, registration, or training beyond federal requirements.

Visions of drones hovering outside bedroom windows and over fenced backyards drove many to lobby the FAA to add privacy requirements to its sUAS regulations, but the FAA declined. Drone privacy was included in the FAA Reauthorization Act passed by the Senate in April 2016, but Congress removed most of the privacy provisions from the FAA Extension, Safety, and Security Act of 2016, as enacted. One privacy provision that survived requires the FAA to convene industry stakeholders to develop standards allowing remote identification of drone operators and owners. The stakeholder meeting, once it occurs, should assist in allowing persons to identify drones that violate privacy. But privacy advocates believe a stakeholder meeting and drone identification standards are not nearly enough federal privacy protection.

Existing federal privacy standards will apply to sUAS that collect, use and share personal information such as the precise geolocation data of an individual or mobile device, including but not limited to GPS-based, WiFi-based, or cell-based location information, or photos or videos of identifiable individuals. A company should address the collection, use and sharing of such information in privacy policies just as it would if information is collected through means other than drones. A challenge for industry will be how to deliver real-time notices concerning the collection of sensitive information such as exact geolocation. In addition, several states have passed drone laws that may impact privacy, if those state laws are not preempted.

On the federal level, privacy guidance specific to sUAS is not completely lacking. In May, the National Telecommunications and Information Administration (NTIA) released a voluntary set of drone privacy best practices. In June, the NTIA updated its best practices in connection with FAA’s release of the Part 107 sUAS rules.

The NTIA best practices include several key actions sUAS operators can take to protect privacy. Those actions are: (i) making a reasonable effort to provide prior notice to individuals of the general time and area where a sUAS operator will be collecting data and providing a privacy policy if the operator anticipates collecting personal information; (ii) avoiding the collection of personal information from places where a person has a reasonable expectation of privacy; (iii) avoiding use of sUAS for persistent and continuous collection of personal information; (iv) minimizing operation of sUAS over private property without property owner consent or appropriate legal authority; (v) establishing a process to receive privacy-related complaints; (vi) obtaining consent before using sUAS to collect information to be used in connection with employment eligibility, promotion, or retention; credit eligibility; or health care treatment eligibility; (vii) making a reasonable effort to obscure or de-identify personal information prior to public release; (viii) making a reasonable effort to avoid using or sharing personal information for marketing purposes; (ix) providing appropriate administrative, technical, and physical security safeguards for personal information collected by sUAS; and (x) monitoring and complying with evolving federal, state and local laws.

In addition to these privacy best practices, the drone industry is developing technological solutions to assist operators in avoiding the collection or misuse of personal information from acquired data. The Future of Privacy Forum, Intel, and PrecisionHawk collaborated to release a report on some of those technological solutions, see Drones and Privacy by Design: Embedding Privacy Enhancing Technology in Unmanned Aircraft.

With the new Part 107 sUAS regulations in force, the FAA has laid the foundation for a period of rapid development and launch of new business uses for drones in the United States. All commercial operators are advised to review their existing and proposed operations with a legal advisor familiar with the newly effective the FAA regulations, federal and state privacy laws and regulations, and other relevant laws so they may begin to take advantage of the opportunities drones present for their businesses.