ICAO doc 9859 Safety Management Manual

Description

7.1.1 This chapter describes the basic principles governing the protection of safety data and safety information captured by or derived from safety reporting systems, as well as the sources of such data and information.0F It also provides guidance a... 7.1.2 The chapter includes the following topics: 7.2.1 The objective of protecting safety data, safety information and their related sources is to ensure their continued availability, with a view to using it for maintaining or improving aviation safety, while encouraging individuals and organization... 7.2.2 Aviation safety is not the sole responsibility of States or service providers. It is a shared responsibility to which all stakeholders should contribute by, among other things, providing relevant data and information through safety reports. 7.2.3 While data and information can come from various sources, reporting of safety data and safety information by individuals and organizations in the aviation system is fundamental to safety management. Effective safety reporting systems help to ens... 7.2.4 Annex 19 does not provide protection to individuals or organizations mentioned in the report. However, States can extend the protection to individuals or organizations mentioned in the report. 7.2.5 It is important that both individuals and organizations are protected, as well as the safety data and safety information they report. Individuals and organizations are protected by: 7.2.6 Annex 19 requires States to ensure that safety data and safety information are not used for the purposes other than those set out in the principles of protection unless a principle of exception applies. The principles of exception set out the ci... 7.2.7 Preventive, corrective or remedial action, based on reported safety data and safety information, may necessarily be taken by States and service providers for the purposes of maintaining or improving safety — that is, to allow States and service ... 7.2.8 Because such actions are fundamental to the objectives and efficacy of any safety management system, Annex 19 expressly provides that preventive, corrective or remedial action to maintain or improve aviation safety shall not be prevented. Such a... 7.2.9 Preventive, corrective or remedial action may entail restricting, limiting or preventing1F the exercise of certain privileges2F , the performance of services or the operation of aircraft, until the safety risks identified have been effectively ... 7.2.10 The principles related to the protection of safety data and safety information, and of their sources, contained in Annex 19 provide for more clarity and transparency, as well as a level playing field, with a view to facilitating the exchange of... 7.3 SCOPE OF PROTECTION 7.3.1 Scope of safety data and safety information covered by the principles of protection 7.3.1.1 Protection applies to safety data captured by, and safety information derived from, voluntary safety reporting systems and related sources. This may apply to mandatory safety reporting systems where it is applicable (refer to 7.4.3 below). Sou... 7.3.1.2 In some States, safety reporting systems may include the reporting of data to safety investigations by State authorities or aviation service providers, data and information captured by self-disclosure reporting systems (including automatic dat... 7.3.1.3 There are other cases when the principles of protection and exception will apply. For example, Annex 6 — Operation of Aircraft, Part I — International Commercial Air Transport – Aeroplanes provides that sources of flight data analysis (FDA) pr... 7.3.1.4 The type of safety data and safety information that can be captured by, and the kinds of systems that can be part of, safety reporting systems may evolve over time along with the evolution of safety management systems themselves. Safety data, ... 7.3.2 Interaction with the principles of protection contained in other Annexes 7.3.2.1 Certain types of safety data and safety information that are protected under Annex 19 may, in certain circumstances, be subject to other protection requirements. 7.3.2.2 In particular, Annex 19 specifies that when an investigation under Annex 13 has been instituted, accident and incident investigation records listed in Annex 13 are subject to the protections accorded in Annex 13, not those in Annex 19. 7.3.2.3 This principle applies from the time an accident or incident under Annex 13 occurs and remains applicable even after the publication of the Final Report. Guidance on protection of accident and incident investigation records is provided in the ... 7.3.2.4 Similarly, while Annex 19 provides protection to recorded data when it is used for safety management purposes, Annex 6 affords protection to the flight recorder recordings in normal operations, outside of Annex 13 type investigations. 7.3.2.5 Annex 6 addresses the use of cockpit voice recorders (CVRs) and airborne image recorders (AIRs) which should be limited to safety-related purposes with appropriate safeguards for inspections of flight recorder systems, or when associated recor... 7.3.2.6 Likewise, the use of flight data recorders (FDRs), aircraft data recording systems (ADRS) as well as Class B and C AIR and airborne image recording systems (AIRS) should be limited to airworthiness or maintenance purposes, including FDA progra... 7.3.2.7 The following flow chart provides general guidelines regarding the interaction between the protective frameworks in Annexes 6, 13 and 19 and is meant to be used in consultation with applicable provisions. 7.3.2.8 With respect to FDA programmes, the sources remain, in any situation, protected by the principles contained in Annex 19. 7.3.3 Application of Annex 19 principles to service providers 7.3.3.1 Annex 19 describes a reporting environment that fosters trust as an environment “where employees and operational personnel may trust that their actions or omissions that are commensurate with their training and experience will not be punished”... 7.3.3.2 Encouraging people to report relevant safety data or safety information requires that the sources of those reports are protected from actions taken by a State in accordance with Annex 19, as well as from actions taken within their working envi... 7.3.3.3 The Annex provisions are designed to provide the minimum requirements to be met by all States, regardless of the size and complexity of their civil aviation activities. Individual States are responsible for developing requirements sufficient t... 7.3.3.4 The principles of protection and exception applied to safety data, safety information and related sources under Annex 19 should be implemented by States and service providers alike. To ensure the achievement of this objective, States are expec... 7.4.1 Conditions to qualify for the protection under Annex 19 7.4.1.1 Annex 19 requires States to determine the conditions under which safety data and safety information qualify for protection. In doing so, States are expected to consider whether: 7.4.2 Actions necessary for maintaining or improving aviation safety 7.4.2.1 Annex 19 ensures that States and service providers are not prevented from using safety data or safety information to take any preventive, corrective, or remedial action that is necessary to maintain or improve aviation safety. Consistent with ... 7.4.2.2 Preventive, corrective or remedial action aims to address circumstances or conditions that present unacceptable risks to aviation safety. 7.4.2.3 Preventive action may be understood to involve action taken to prevent the occurrence or recurrence of an event or a hazard that poses a risk to safety. 7.4.2.4 Corrective action may be understood to involve action taken to address particular safety related shortcomings or deficiencies, such as an authorization holder who is unable to demonstrate compliance with applicable safety or competency standar... 7.4.2.5 Remedial action may be understood to involve action taken to address the underlying causes of particular safety-related shortcomings or deficiencies, such as training. Remedial action might also involve restricting, limiting, suspending or rev... 7.4.2.6 Although they may be specified as serving one or another purpose, such actions may serve more than one purpose. For example, action may be taken by a regulator or a service provider, requiring the holder of a licence or certificate to undertak... 7.4.2.7 Safety data or safety information might reveal hazards or deficiencies that necessitate remedial or corrective action to maintain safety or identify areas where preventive action would enhance aviation safety by addressing potential or emergin... 7.4.2.8 Depending on the circumstances, preventive, corrective or remedial actions, while not intended to be, may be perceived as punitive by the individual or the service provider, subject to such action. Indeed, some may view any license actions tak... 7.4.2.9 Despite these perceptions, Annex 19 does not prevent States from using safety data and safety information to support action necessary to maintain or improve aviation safety. Where actions are needed to maintain or improve the level of aviation... 7.4.3 Protection of mandatory reporting systems 7.4.3.1 Annex 19 specifies different requirements for the protection of safety data, safety information and related sources captured by voluntary and mandatory safety reporting systems. Protecting safety data and safety information captured by volunta... 7.4.3.2 In certain jurisdictions, safety data and safety information captured by mandatory and voluntary safety reporting systems are subject to different levels of protection, offering greater protection to safety data and safety information from vol... 7.4.3.3 Other States offer the same high level of protection to safety data and safety information in both mandatory and voluntary safety reporting systems. This can be justified by the recognition that requiring reporting by law may not, in itself, b... 7.4.3.4 If a State extends the protection afforded to safety data and safety information captured by voluntary safety reporting systems to mandatory safety reporting systems, the principles of protection and exception contained in Annex 19 should appl... 7.4.4 Protection of data and information that are in public domain 7.4.4.1 There may be cases in which safety data or safety information is available in the public domain. In some cases, it may be that such safety data or safety information is not sensitive and its further disclosure will not adversely impact the con... 7.4.4.2 In other cases, safety data and safety information normally subject to the principles of protection may find its way into the public domain, for instance, through a leak to the media. In such cases, States should refrain from further disclosur... 7.5 PRINCIPLES OF PROTECTION 7.5.1 Application of the principles of protection 7.5.1.1 The protection of safety data, safety information and related sources should be the default position for a State. A State may provide effective protection by law, supported by comprehensive and clear procedures. 7.5.1.2 The basic purpose of providing protection is to ensure the continued availability of safety data and safety information by encouraging individuals and organizations to identify, report, analyse and correct deficiencies. This requires that all ... 7.5.1.3 In protecting safety data or safety information, consideration should be given to the objective such protection is meant to achieve. The objective may be evident from the type of data and information to be protected. In many cases, protection ... 7.5.1.4 State action is central to creating protective provisions. In formal proceedings where there are rules governing what evidence is allowed to be presented, only State action can provide the necessary protection by the enactment of appropriate l... 7.5.1.5 In civil proceedings against a service provider, a rule should, at a minimum, require a rebuttable presumption3F that protected information may not be used. In an action against an airline for damages sustained as a result of an occurrence, a... 7.5.1.6 In administrative proceedings where particular operational or technical qualifications, competencies and capabilities of an individual or an organization are in question, safety will almost invariably be at issue. Use of safety data or safety ... 7.5.1.7 An example of such a situation might be a report by an air traffic controller who lost consciousness for a short period of time while working. No separation was lost and the only proof that the event occurred was the controller’s own report. F... 7.5.1.8 Up to this point, the focus has been on direct State action to provide necessary and appropriate protection. In practice, much of the safety data and safety information for which protection is required is within the operational environment of ... 7.5.1.9 One way of providing for such protection might involve de-identification of the reporter. While confidentiality of reports is a useful strategy, complete de-identification, where possible, removes the opportunity for follow-up during the analy... 7.5.1.10 The capture of safety data and safety information by automatic means, such as FDRs, voice or video recorders or air traffic environment recorders, should be part of any protection policy or regulation. Use of these devices as a part of SMS da... 7.5.2 Proceedings 7.5.2.1 Annex 19 requires States to ensure that safety data and safety information are not used in disciplinary, civil, administrative and criminal proceedings against employees, operational personnel or organizations, unless a principle of exception ... 7.5.2.2 The term “proceeding” may be more comprehensive and broader in scope than the term “action”. It may also refer rather more narrowly to the processes of a particular body to review or enforce “actions” that have been taken by another authority ... 7.5.2.3 Other authorities may be involved in the actions and proceedings mentioned above, such as administrative tribunals, professional, ethical bodies or other review bodies within an organization. 7.5.2.4 It is important to remember that the principles of protection do not apply when States take a preventive, corrective or remedial action that is necessary to maintain or improve aviation safety (refer to 7.4.2 above). This also applies to any p... 7.5.2.5 While there may be cases when safety data or safety information is used in litigation initiated by a third party against the source of the report, States are encouraged to take all necessary measures to ensure that safety data and safety infor... 7.5.3 Authoritative safeguards 7.5.3.1 Certain factors may mitigate the negative consequences associated with the disclosure or use of safety data or safety information for purposes other than maintaining or improving aviation safety. It might be possible to limit any potential dam... 7.5.3.2 De-identification of the source of the safety data and safety information is another safeguard that may be used before release for purposes other than maintaining or improving aviation safety is granted by a competent authority. De-identificat... 7.5.3.3 If the safety data or safety information is proposed to be used in a forum where knowledge of the persons or organizations connected to the data or information is limited, then the competent authority might be confident that de-identification ... 7.5.3.4 If the competent authority considers that the de-identification of the safety data and safety information may prevent the intended or otherwise permissible use of safety data or safety information, de-identification will not be appropriate. T... 7.5.3.5 States and organizations may also adopt best practices such as ensuring that the environment in which information is collected, stored, processed and transmitted is sufficiently secure, and that controls over access and authorization are suffi... 7.6 PRINCIPLES OF EXCEPTION 7.6.1 The principles of protection apply to safety data, safety information and related sources, unless a competent authority determines that one of three principles of exception applies. The custodian of SDCPS should be aware of the protections appli... 7.6.2 Designation of a competent authority 7.6.2.1 As the principles of exception will be administered for a range of different purposes, the competent authority will be different depending on the nature of the data or information in question and the type of use that is being sought. In each p... 7.6.2.2 States and organizations will need to identify competent authorities appropriate to the task of applying the principles of exception for different purposes. Table 9 below provides examples of possible competent authorities and situation examples. 7.6.2.3 Where an organization identifies its competent authority, the responsible exercise of discretion of the competent authority on the application of the principles of exception and the principles of protection may well provide sufficient self-pol... 7.6.2.4 Permanent designation of the office and jurisdiction of the competent authority (e.g., judicial authorities for matters involving litigation, the CAA for matters involving regulatory actions) may be considered to allow for expeditious decision... 7.6.3 Application of the principles of exception 7.6.3.1 The first case in which a competent authority may determine that an exception to the protection applies is where there are “facts and circumstances reasonably indicating that the occurrence may have been caused by an act or omission considered... 7.6.3.2 Because an assessment of the substance of the safety data or safety information in question will often determine whether the conduct involved satisfies one or another of the conditions for exceptional use, it is not, therefore, necessary that ... 7.6.3.3 Different legal systems may have different understandings under national law as to what is meant by these terms. In general, gross negligence refers to an act or omission undertaken with a serious disregard or indifference to an obvious risk, ... 7.6.3.4 The second case in which a competent authority may determine that an exception to the protection rule applies is where, having reviewed the safety data or safety information in question, the competent authority determines that release of such ... 7.6.3.5 This involves a two-step assessment process, in which the competent authority must consider first, whether the data or information is “necessary for the proper administration of justice”, which may not be the case if alternative sources for th... 7.6.3.6 If the safety data or safety information is proposed for use in an action or proceeding (civil, administrative, criminal or disciplinary), then the potential negative impact of such use may relate to the source of such data or information. Eve... 7.6.3.7 On the individual level, making the information public can have prejudicial detriment to the person involved such as the potential loss of livelihood and/or embarrassment. On a broader level, the publication or dissemination of safety data or ... 7.6.3.8 In making a determination regarding the first two principles of exception, the competent authority must be satisfied, that: 7.6.3.9 The competent authority will determine whether the safety data, safety information or the identity of the source of such data or information is necessary to the case. If a competent authority can reasonably make a decision without referring to... 7.6.3.10 Adverse consequences might flow from the disclosure or use of safety data, safety information and related sources, such as the reluctance of aviation operational personnel to willingly cooperate with inspectors. If such data, information or d... 7.6.3.11 Similarly, if a competent authority in a State that does not have a right-to-know law is asked to decide whether the safety data or safety information should be disclosed to the public (for example, in response to a request from the media), t... 7.6.3.12 The third exception involves cases in which, “after reviewing the safety data or safety information,” the competent authority “determines that its release is necessary for maintaining or improving safety, and that the benefits of its release ... 7.6.3.13 The circumstances contemplated by Annex 19 involve consideration by a competent authority of the benefits of releasing the safety data or safety information for more general purposes related to the maintenance or improvement of safety, includ... 7.6.3.14 In considering the second step of this analysis, Annex 19 encourages competent authorities to take into account the “consent of the source of the safety data and safety information”. The importance of this recognition underscores the critical... 7.6.3.15 In keeping with the spirit of the principles of protection, when considering the use of safety data or safety information in support of preventive, corrective or remedial actions taken for the purpose of maintaining or improving safety, it ma... 7.6.3.16 However, such a consideration of practicability does not require or invite the formal application of a principle of exception called up in Annex 19. This is because the principle of exception applies where the interest of maintaining or impro... 7.6.4 Additional considerations in applying a principle of exception 7.6.4.1 In deciding whether a principle of exception applies in a case, the competent authority should always take into account the consent of the source of the safety data or safety information. If a person has been given assurances of confidentialit... 7.6.4.2 To avoid undesirable situations of the kind mentioned in 7.6.4.1 from arising, it will be prudent to ensure that individuals and organizations clearly understand in advance how, when, where and for what purposes the data and information they p... 7.6.4.3 The following diagram provides general guidelines regarding the application of the principles of exception by the competent authority consistent with the provisions of the Annex 19.5F 7.7 PUBLIC DISCLOSURE 7.7.1 The public has an overarching interest in safety data or safety information. The public’s interest is in openness, transparency and accountability so that it has a general awareness of the safety of the system and can be assured that everything ... 7.7.2 If safety data or safety information is disclosed publicly, it is not usually possible to limit how the information would be used. Certainly, openness and transparency should be encouraged but, at the same time, the rights and legitimate expecta... 7.7.3 Many States have legislation which in effect mandates release of all information held by State institutions. Such laws are sometimes referred to as right-to-know laws. Under these laws, unless there is an exemption for a particular type of infor... 7.7.4 Right-to-know laws generally apply to information held by the government. Since most safety data and safety information requiring protection from disclosure is obtained from operational personnel or a service provider, a practical approach would... 7.7.5 Failure to properly assess the competing claims made for access to safety data or safety information can impact current and future efforts in two ways. Public disclosure of certain data or information can be perceived as a violation of the priva... 7.7.6 If a competent authority determines that safety data or safety information may be disclosed to the public, the State is expected to ensure that any public disclosure is made in accordance with applicable privacy laws or in a de-identified, summa... 7.8 PROTECTION OF RECORDED DATA 7.8.1 Protection of ambient workplace recordings 7.8.1.1 Ambient workplace recordings should be part of any protection policy or regulation. The use of these recordings as a part of safety management where allowed by regulation or policy should fully respect the principles of protection and exceptio... 7.8.1.2 Provisions contained in Annex 19 are applicable to safety management functions related to, or in direct support of, the safe operation of aircraft. Ambient workplace recordings may be governed by national privacy laws that are not defined in A... 7.8.1.3 Ambient workplace recordings may include CVRs, AIRs, other flight recorder recordings, or recordings of background communication and the aural environment at air traffic controller work stations. 7.9 SAFETY INFORMATION SHARING AND EXCHANGE 7.9.1 Protection of information shared between States 7.9.1.1 Taking into account that one of the main objectives of sharing and exchange of safety information is to ensure a consistent, fact-based and transparent response to safety concerns at the State and global levels, in the process of sharing and e... 7.9.1.2 A legal framework for sharing and exchange of information can be based on bilateral arrangements between States inserted, for instance, into their air transport (air services) agreement. For facilitating sharing and exchange of information, St... 7.9.1.3 States should promote and facilitate the establishment of safety information sharing and exchange networks among users of its aviation system. The sharing and exchange of safety information is fundamental to ensuring a consistent, fact-based a...