EN Official Journal of the European Union C 132/1

Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council on investigation and prevention of accidents and incidents in civil aviation

2010/C 132/01

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular its Article 16,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

1. On 29 October 2009, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council on investigation and prevention of accidents and incidents in civil aviation (3). The proposed Regulation is intended to replace Council Directive 94/56/EC establishing the fundamental principles governing the investigation of civil aviation accidents and incidents (4).

2. The EDPS has not been consulted as required by Article 28(2) of Regulation (EC) No 45/2001. The current opinion is therefore based on Article 41(2) of the same Regulation. The EDPS recommends that a reference to this opinion is included in the preamble of the proposal.

3. As a general comment, although the EDPS regrets that he has not been consulted in due course, he notes with satisfaction that data protection aspects are included in the proposal. Some provisions insist on the fact that the measures foreseen are without prejudice to Directive 95/46/EC and the confidentiality of data is one of several important aspects of the proposal.

4. The EDPS has nevertheless identified some shortcomings and unclarities as far as the protection of personal data is concerned. After a description of the context and background of the proposal in Chapter II, those comments will be developed in Chapter III.

II. CONTEXT AND BACKGROUND OF THE PROPOSAL

5. The purpose of the proposal is to update the existing regulation in the field of air accident investigation. Previous rules, adopted 15 years ago, would no longer be adapted to the new common aviation market, and to the expertise needed for more complex aircraft systems. The growing divergences in the investigation capacities of Member States would also be a justification for a new framework supporting collaboration and coordination of national investigation authorities.

6. The proposal thus focuses on the establishment of a Network of Civil Aviation Safety Investigation Authorities to facilitate a more structured cooperation. It also provides for binding rules with the main purposes of defining the mutual rights and obligations of national investigation authorities and the European Aviation Safety Agency (EASA), ensuring the protection of sensitive information, and establishing uniform requirements in terms of processing of safety recommendation.

7. The EDPS has no observations on the general objective of the proposal and he fully supports the initiative taken, which is intended to improve the efficiency of investigations and hence prevent the occurrence of future aircraft accidents. The observations below will concentrate on the aspects of the proposal which have an impact on the protection of personal data, including in particular the processing of data from passengers lists, about victims, their families and witnesses as well as cabin crew, during the different stages of the investigation and in the context of an exchange of information between investigation authorities.

III. ANALYSIS OF THE PROPOSAL

III.1. Objective of the proposal

8. Recital 3 and Article 1 recall the limitation already stated in the explanatory memorandum of the proposal, according to which the sole objective of safety investigations should be the prevention of future accidents and incidents without apportioning blame or liability. The EDPS welcomes this precision which is in line with the purpose limitation principle of Article 4 of Regulation (EC) No 45/2001 and Article 6 of Directive 95/46/EC. According to these provisions, personal data shall be processed for specified, explicit and legitimate purposes, and not further processed in a way incompatible with those purposes.

9. Although this purpose limitation is explicitly stated in the beginning of the proposal, it is important that no derogation deprives this principle from its substance, as will be examined under Chapters III.4 to III.6.

10. The EDPS notes that besides the main purpose to improve aviation safety, the draft regulation also provides for the collection of personal data in the context of assistance to victims and their families (Article 23). The EDPS does not see any issue of compatibility between this purpose and the purpose of safety investigation. However, Article 1 of the Regulation could be complemented in order to reflect properly both aspects of the Regulation.

III.2. Collection of information

11. The proposal describes in detail the broad range of information which can be accessed by those responsible for the investigation. It includes notably personal data such as those contained in flight recorders and any other recording, results of examination of bodies of victims or people involved in the operation of the aircraft, and examination of witnesses who can be required to produce relevant information or evidence.

12. This information is available to the investigator-in-charge as well as to his experts and advisers and those of the accredited representatives, on a need to know basis. EASA also has the right to access some of this information while participating in the investigation under the control of the investigator-in-charge, with a few exceptions including when the witness refuses his/her statement being released.

13. The proposal also provides for the conditions under which the list of passengers should be made available. The purpose here does not relate only to the conduct of an investigation but also to the need to liaise with families and in relation to medical units.

14. The EDPS welcomes the level of detail provided in the proposal as to the conditions for collection of personal data in relation to the purpose followed, which is in line with the necessity principle (5) of data protection law.

III.3. Storage of personal data

15. While the EDPS understands the need for a wide collection of information including personal data, as specified above, he emphasises the need for strict rules when it comes to their storage and divulgation to third parties.

16. As far as storage is concerned, the proposal foresees in its Article 14 the need to preserve documents, materials and recordings, for obvious reasons linked with the conduct of the investigation. However the proposal does not provide for any indication as to the duration of storage of this information. According to data protection principles (6), personal data must be kept ‘in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed’. Accordingly, personal data should in principle be deleted as soon as the investigation is terminated, or should be kept in an anonymous format if complete deletion is not possible (7). Any reasons for which identifiable data should be kept longer should be indicated and justified, and should include criteria identifying those entitled to keep the data. A provision should be inserted in the proposal in that sense, which should apply in a horizontal way to any personal information exchanged through the network.

III.4. Availability and publication of information

17. Although the proposal states as a principle that personal information should only be used for investigation purposes and by the parties responsible for such investigations, the text includes some broad derogations (8).

18. This is the case for the statements of witnesses which can be made available or used for purposes other than safety investigations if the witness agrees (Article 15.1.a). The EDPS recalls that such consent of a witness should be free, specific and informed, and the further use of the information should not relate to a purpose which would be incompatible with safety investigations. If these conditions are not met, consent should not be used as a basis for further use of personal data. This comment is also valid with regard to the use of consent to derogate from the purpose limitation principle in the case of recordings (Article 16).

19. Article 15 of the proposal also includes a wide derogation which applies to any kind of sensitive safety information (9). This information, which is in principle subject to specific protection against misuse, can still be disclosed for any purpose other than safety investigations, if the competent authority for the administration of justice in a Member States decides so, considering the existence of an overriding interest and the balance between the benefits of disclosure and its adverse domestic and international impact on investigations and on the management of civil aviation safety. The EDPS considers that this derogation does not offer enough legal certainty. In particular, the notion of ‘competent authority for the administration of justice’ could lead to speculation. An administrative decision by a governmental body (for instance the department of justice) would not benefit from the same legitimacy as a decision by a judicial court on a case by case basis. Even in the case of a decision by a court, strict conditions should be provided: in addition to the fact that the purpose must be permitted by law and there is an overriding public interest (10), the interests and fundamental rights of data subjects should be taken into consideration. In particular, the fact that personal information given by the individual in the context of a safety investigation might be reused against him at the occasion of a court procedure could influence the legitimacy of the processing. The EDPS calls for a clarification of this derogation and for a detailed procedure including more stringent safeguards as to the protection of the fundamental rights of the data subject.

20. He also calls for a definition of one type of sensitive safety information mentioned in this Article, that is, information which is of a ‘particularly sensitive and private nature’. Directive 95/46/EC provides for a definition of sensitive data, but it is unclear whether the proposal refers to this definition. If the objective is to cover and go beyond sensitive data as defined in Directive 95/46/EC, a more appropriate terminology could refer to information which is of a particularly intimate and private nature, including sensitive data in the sense of Directive 95/46/EC as well as other examples of personal data to be listed in the definition. This should be made clear in Article 2 (the provision on definitions), or in Article 15 of the proposal.

21. Recordings are similarly protected as a principle, but they can be made available or used for other purposes in some cases including the use for airworthiness or maintenance purpose, if the records are de-identified or if they are disclosed under secure procedures. These exceptions are alternative and not cumulative. The EDPS questions why records should not be de-identified — i.e. anonymised (11) — as a rule: it should be justified why airworthiness or maintenance purposes require the processing of identifiable personal data. Moreover, the third exception, which allows for disclosure under secure procedures, is too vague and not proportionate. Unless specific legitimate purposes are mentioned, this exception should be deleted.

22. The same principle of de-identification should apply by default to the communication of information as foreseen in Articles 8, 17 and 18 of the proposal relating to the network and the communication of information. The EDPS welcomes in this spirit the mention of an obligation of professional secrecy, and the obligation to communicate only pertinent information to relevant stakeholders. He also supports the principle mentioned in Article 19.2 according to which the investigation report shall protect the anonymity of the persons involved in the accident or incident.

23. Finally, the publication of the list of passengers is also subject to some conditions. The principle is that the list can be made public only after all families of passengers have been informed, and Member States may decide to keep the list confidential. The EDPS considers that the principle should be reversed. The list should in principle be kept confidential, but Member States could decide in specific cases and on legitimate grounds to publish this list, after having informed all families and having obtained their consent as to the publication of the name of their relative. The EDPS recommends an amendment of Article 22.3 accordingly.

III.5. Exchange of information between Member States and with third countries

24. One of the main purposes of the draft regulation is to establish a network in order for investigating authorities to exchange information and experience. According to Article 8.6 of the draft proposal, the safety investigation authorities participating in the network shall exchange any information available to them in the context of the application of the Regulation. They shall take all necessary measures to ensure appropriate confidentiality of such information in accordance with applicable national or Community legislation.

25. The EDPS welcomes the measures foreseen as far as confidentiality of information is concerned, and especially the obligation not to disclose information which has been considered as confidential by the Commission. As far as personal information is processed through the network, the EDPS considers that these safeguards should be complemented by an obligation to guarantee the accuracy of these data and their possible correction and deletion in a synchronised way by all members of the network processing such personal data.

26. The role of the repository mentioned in Article 15.3 should be clarified in relation to the circulation of information within the network. In particular, it should be made clear, as informally communicated to the EDPS, that the central repository is in no way connected to the network and that it does not contain personal data. The EDPS notes in this respect that information such as flight numbers could allow indirect identification of individuals involved in an aircraft accident or incident. As a minimum rule, the Regulation should precise that the information stored in the repository cannot be used in order to trace back individuals involved in an aircraft accident or incident.

27. The EDPS notes that observers and experts, who might include representatives of airline companies or aircraft producers, can be invited to join the network. They would have access to the same kind of information as the members of the network, except if on a case by case basis the Commission decides that the information is confidential and that access to it shall be restricted. This provision might leave open the possibility for third parties to access personal data relating for instance to victims or witnesses, if these are not deemed as confidential. The EDPS considers that in the context of this proposal, personal data should always be considered as confidential. Would this not be the case, access to personal data should be limited as far as third parties are concerned.

28. This is all the more important if experts or observers represent third countries or if the investigation is done jointly with investigators of third countries which would not provide for an adequate level of protection. A provision could be added in the proposal recalling that no personal data should be transferred to representatives of a third country which does not provide an adequate level of protection, except when specific conditions have been fulfilled (12). It would apply in particular with regard to Article 8 on the network, and Article 18 on the conditions of communication of information.

29. These observations call again for a general principle of anonymisation of personal data at an early stage of the process, and as soon as identification is no longer necessary for the conduct of investigations, as already mentioned in Chapter III.3.

III.6. Role of the Commission and EASA

30. The EDPS notes that the Commission and EASA are involved in the functioning of the network (Articles 7 and 8) and that they will be entitled to participate to some extent in safety investigations (Article 9). The EDPS recalls that the processing of personal data by these two bodies is subject to compliance with Regulation (EC) No 45/2001 and to supervision by the EDPS. A provision should be added in the Regulation on this point.

31. The EDPS calls for clarification on the extent to which the network will be managed by the Commission and through European Unions’ technical infrastructure. Would the purpose be to use an already existing network, any plan to allow for interoperability with existing databases should be clearly mentioned and motivated. The EDPS emphasises the need to provide for a secure network, accessible only for the purposes described in the proposal and to entitled stakeholders. The respective roles and responsibilities of the Commission and of EASA (13) as well as any other Union body which would be involved in the management of the network, should be clarified in the text for reasons of legal certainty.

IV. CONCLUSIONS

32. The EDPS welcomes the fact that the regulation explicitly applies without prejudice to Directive 95/46/EC, and thus, to some extent, takes data protection principles into account. However, considering the context in which personal data are processed, he considers that specific provisions should be added in order to ensure a fair processing.

33. This is all the more necessary considering the circumstances in which these data are processed: they will mostly relate to individuals directly or indirectly affected by a serious accident and/or with the loss of relatives. This supports the need for an effective protection of their rights, and for a strict limitation of the transmission or publication of personal data.

34. Considering that the purpose of the proposal is to allow the investigation of accidents or incidents and that personal data are relevant only where necessary in the framework of such investigation, such data should in principle be deleted or anonymised, as soon as possible, and not only at the stage of the final report. This should be guaranteed by the insertion of a horizontal provision in the Regulation.

35. The EDPS also advises to: — strictly define and limit the exceptions to the purpose limitation principle, — provide for a limited period of storage of personal data, — ensure a coordinated procedure for access, rectification and/or deletion of personal data, especially in the context of their transmission to Member States through the network, — submit the transmission of personal data to representatives of third countries to the condition that they provide an adequate level of protection, — clarify the roles and responsibilities of the Commission and of EASA, in the perspective of the application of Regulation (EC) No 45/2001.

Done at Brussels, 4 February 2010. Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) COM(2009) 611 final.

(4) OJ L 319, 12.12.1994, p. 14.

(5) Article 4 of Regulation (EC) No 45/2001 and Article 6 of Directive 95/46/EC.

(6) Article 4(e) of Regulation (EC) No 45/2001 and Article 6(e) of Directive 95/46/EC.

(7) Anonymisation should be understood as rendering impossible any further identification of the individual. For some types of information, like voice recording, complete anonymisation will not be possible, which supports the need for stricter safeguards to avoid any misuse.

(8) The EDPS has been consulted in November 2008 at the occasion of a conciliation procedure on a proposal for a Directive establishing the fundamental principles governing the investigation of accidents in the maritime sector. Considering the analogy between the two contexts, similar issues have been raised and the comments in Chapter III.4, like the reply to the previous consultation, focus on the balance to be found between disclosure of information in the course of an investigation and data protection.

(9) It includes information relating to witnesses, communication between persons having been involved in the operation of the aircraft, or recording from air traffic control units. It also applies to information which is of a ‘particularly sensitive nature’, such as health information.

(10) It should be noted that Directive 95/46/EC allows for derogations from the purpose limitation principle, only if this is done by law and is necessary to safeguard certain public interests in accordance with the conditions of its Article 13.

(11) De-identification would satisfy the proportionality principle if it is to be understood as complete anonymisation, in other words, if it is impossible to re-identify the individual (see footnote 5).

(12) See Article 9 of Regulation (EC) No 45/2001 and Article 26 of Directive 95/46/EC.

(13) Including precisions on aspects such as who is managing the access rights to the network and who guarantees its integrity.