Safety information is a main source for the permanent enhancement of safety in aviation. But there are many risks of its inappropriate use. As a result safety information is very sensitive and needs special protection.

1.1. Safety information is contained in safety data collection and processing systems. These are established for the sole purpose of enhancing aviation safety. However worldwide neither common law nor legislation delivers sufficient protection for this information. So the question arises to how safety information shall be protected and to what extent.

2.1.  The goal of the protection of safety information from inappropriate use is to ensure its continued availability in future. The use of safety information for reasons other than safety-related purposes, may lead to a reduction in the availability of such information, with an undesirable effect on safety.

2.2.  Safety data collection and processing systems

2.2.1. Safety data in aviation is derived from:

• Records pertaining to accidents and incidents;
• Mandatory incident reporting systems;
• Voluntary incident reporting systems;
• Self-disclosure reporting systems.

2.3. Records pertaining to accidents and incidents

2.3.1. According to ICAO Annex 13 – Aircraft Accident and Incident Investigation, States shall investigate or delegate the investigation of accidents occurred on their territory. Serious incidents should be investigated by States or by other organisations, such as dedicated accident/incident investigation bodies or aviation service provider organisations. The gathering of factual information is part of that investigation. Different information sources like recordings and interviews will be used. These sources may provide useful information for determining the sequence of events and to find out the reasons why they happened. They are not collected for any judicial or administrative proceedings and they need to be protected for the purpose of aviation safety improvement.

2.4. Mandatory incident reporting systems

2.4.1.  Para 8.1 of ICAO Annex 13 says:

“A State shall establish a mandatory incident reporting system to facilitate collection of information on actual or potential safety deficiencies.”

2.4.2.  Therefore operational personnel are required to report accidents and certain types of incidents on an obligatory basis. But safety reports will only be delivered if the regulatory authority and the employer assure that prosecution or punitive actions such as suspension of licence will not be sought unless the unsafe occurrence is deliberately committed or gross negligence is demonstrated. The reported data is solely to be employed for safety improvement. Reporting must be confidential and the identities in the reports must be protected (IFATCA TP Manual page 4421/4424).

2.4.3.  This state may be reached by application of “Just Culture” in an organisation. However as soon as an incident is also subject to legal proceedings, protection of identity and confidentiality of the report is not assured.

2.5. Voluntary incident reporting systems

2.5.1.  The aim of a voluntary incident reporting system is to enable the identification of hazards and unsafe conditions that have not yet caused an incident. It shall be non- punitive and afford protection of the sources of information. ICAO recommends that States should adjust their applicable legislative and regulatory frameworks and policies to embolden and to promote voluntary occurrence reporting.

2.5.2.  Voluntary reporting works best within a Just Culture environment. Preconditions are trust and confidentiality. Reporters must have no doubts regarding the use of their reports and that they are protected against legal, administrative or disciplinary sanctions, except in case of criminal activity or intent. Therefore, the reports must be treated absolutely confidentially. The identity of the reporter or information that make it possible to identify other involved persons must not be disclosed.

2.5.3.  The organisation operating the voluntary reporting system should be independent from the State regulatory authorities. It may also be established within an ANSP.

2.5.4.  Simple procedures to submit a report may foster voluntary reporting. The reporting form should be easily available to anyone wishing to file a report and it should be easy to fill out. Suggestions for safety improvements to prevent reoccurrence of a hazard or how to deal with it may also be included in the report.

2.5.5.  The reporting person shall get feedback on the measures taken as a result of the report. Furthermore, the aviation community should have access to de-identified information received from the voluntary reporting system.

2.6. Self-disclosure reporting systems

2.6.1. Data is derived from automatic and manual capture systems such as data from flight data recorder (FDR) and cockpit voice recorder (CVR), EUROCONTROL’s Automated Safety Monitoring Tool (ASMT) etc. While FDR and CVR are flight recorders ASMT provides an automatic monitoring facility for safety related occurrences based on operational data. It will supply ATM providers more accurate reporting and data to support investigations.

2.7. Protection of safety information

2.7.1. The protection of safety information refers to their protection against inappropriate use, e.g. disclosure of the information to the public. It also includes the use of this information for disciplinary, civil, administrative and criminal proceedings against ATC-personnel or assessing the competence or performance of these personnel.

2.7.2.  If safety information is disclosed or used in an improper manner it should be considered that a negative impact on the readiness to report safety related events in the future could be a consequence.

2.7.3.  The Delta Air Lines incident that happened in 1998 is an example of this. A Delta Air Lines Boeing 767 taking off in low visibility conditions from Amsterdam’s Schiphol airport aborted its take-off roll when the pilots spotted a Boeing 747 being towed across the runway in front of them. Nobody was hurt. The Incident Investigation Department of ATC The Netherlands (LVNL) and the Dutch Transport Safety Board (DTSB) investigated the incident independently. LVNL issued in its report from March 1999 23 recommendations to rectify systematic arrangements. In its report from January 2001 the DTSB came to nine, quite similar, recommendations – a good example of how the incident cycle should work. The people involved delivered their reports of what had happened. They helped also to find why. And they did assist in finding ways to improve the system for the benefit of all. The subsequent criminal prosecution, in which three controllers were found “not to be devoid of blame”, but not punished, resulted in a 50% reduction in the number of reports received from controllers about ATM incidents. The prosecutor had introduced the internal incident investigation report of ATC The Netherlands as part of the legal material while the official report of the DTSB was protected by Dutch law according ICAO Annex 13.

2.8. Public disclosure

2.8.1.  Public disclosure of safety information should always be justified; for example to correct conditions that compromise safety and/or to change policies and regulations.

2.8.2.  Safety information shall be published in a de-identified, summarized or aggregated

form. Negative impacts on future occurrence reports caused by the disclosure of safety information have to be avoided. Relevant personal information should be reduced to an absolute minimum. Audio, visual and area recordings shall not be released to the public (IFATCA TP Manual page 4425).

2.9. Protection against misuse of safety information

2.9.1.  ICAO ANNEX 13 3.1 says:

“The sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.”

As a consequence ICAO ANNEX 13 5.4.1 recommends separating the investigation from any judicial or administrative proceedings to apportion blame or liability – proceedings, which may have the aim of looking to find someone guilty and to take actions against them. Unfortunately ICAO ANNEX 13 is not as restrictive as it should be. Chapter 5.12 of ANNEX 13 demands a non-disclosure of records:

“…unless the appropriate authority for the administration of justice in that State determines that their disclosure outweighs the adverse domestic and international impact such action may have on that or any future investigations…”.

Chapter 2.2 of Attachment E of ANNEX 13 (Legal Guidance for the Protection of Information from Safety data Collection and Processing systems) says:

“It is not the purpose of protecting safety information to interfere with the proper administration of justice in States.”

In neither documents is there a reference to “Just Culture” and the necessary legal framework.

2.9.2.  The past shows impressively how different States interpret these ICAO recommendations differently. While in the Ueberlingen case the judges made their own investigation separately from the accident investigation, in Milan they did not only use the accident report but also nominated the head of the accident investigation as court expert.

2.9.3.  EU-Regulation No 996/2010 on the investigation and prevention of accidents and incidents in civil aviation mentions at least in the introduction that “The civil aviation system should equally promote a non-punitive environment facilitating the spontaneous reporting of occurrences and thereby advancing the principle of ‘just culture’. But then (Article 14) it gives the last decision on the protection of sensitive safety information to the national administration of justice. So prosecution can intervene at any time and overrule all promises made by other parties. IFATCA is strongly against this possible procedure and demands “just culture” to be reinforced by a national legal framework.

2.9.4.  Safety information from mandatory incident reporting shall be inaccessible to prosecutors as long as there are no signs of gross negligence, wilful violations or destructive acts. Reports or interviews, which may enclose self-accusations of the involved parties, shall be especially protected, because everybody has the right to refuse a statement as soon as they are accusing themselves. According to ICAO ANNEX 13 it is important to get a complete picture from the investigation about what did happen. It includes also wrong actions or omissions that are admitted by the parties involved.

2.9.5.  Additionally, within a Just Culture environment, safety information from mandatory reporting should not be used by the ANSP for disciplinary measures or performance assessment of ATCOs. That would compromise the whole reporting system and could prevent further reports even if they are for mandatory events.

2.9.6.  Safety information deriving from voluntary incident reporting system is essential for a proactive approach to safety and should not lead to legal, administrative or disciplinary sanctions against the reporting person. Because trust is the main precondition for voluntary reporting, the protection of the sources of information is very important. Voluntary incident reporting shall be run by an organisation different from the State regulatory authorities and must be separated from mandatory reporting. That includes different databases and restricted access. Voluntary Reports shall be treated absolutely confidentially. Possible ways to achieve it are de-identification or not to record any identifying information of the occurrence.

2.9.7.  Protection of safety information within an ANSP may be reached by an agreement between ANSP and MA, which clearly excludes the use of safety information for competence and performance assessment or disciplinary measures.

2.10. Legal requirements

2.10.1.  Error reporting, error analysis and, as a consequence, the improvement of the system is highly developed in aviation compared to other systems like health care for example. However to continue on this way and to make the next step – the change from a mostly reactive approach to safety to a more proactive – national laws and regulations are needed to protect safety information and to prevent its inappropriate use.

2.10.2.  The commitment of ANSP and of the national supervisory authority to “Just Culture” is the first step. It should provide ATCOs with confidence that their identity, or the identity of any person implicated in a report will not be disclosed without their permission or unless this is required by law. The latter should only be given in case of a deliberate act or gross negligence. But that could interfere with the “Freedom of Information Act” which requires all information submitted to a State authority/State owned legal entity to be released to the public upon request. In such case, the law shall provide exemptions applicable to safety-sensitive information.

2.10.3.  Regarding mandatory reporting, protection from punishment or prosecution should be granted if the offence was unpremeditated and unintentional, and would not have come to light except for the report. In case of prosecution, all self-incriminating statements made by the involved persons during the accident or incident investigation, should not be accessible by the prosecutor because of the privilege to refuse to give evidence in case of self-incrimination. Investigators should have the right to refuse to give evidence as soon as sources of safety information are concerned.

2.10.4.  Voluntary reporting systems require the highest possible protection. Access for prosecutors shall not be allowed. Investigators and safety instructors involved in the voluntary reporting system shall have the right to refuse to give evidence.

2.10.5.  A Data Protection Act has the purpose to protect a person against the fact that the use of his personal data may interfere with his personal rights. Because personal rights are defined differently worldwide, Data Protection Acts will differ from State to State depending on the form of government and the legal system. However, such an act might be applicable for personal data deriving from automatic safety data collecting systems as long as neither an accident nor an incident is concerned.

2.10.6.  It is important to state that as “Just Culture” is not a law, the best way to achieve a sufficient protection of safety information would be the introduction of special procedures or specific aviation legislation by the States. This legislation shall clearly describe that accident and incident investigation shall be separated from any judicial or administrative proceedings to apportion blame or liability. The law shall limit access of prosecution to safety information to such cases where a fair trial cannot be reached without it. It shall contain the right of investigators and safety instructors to refuse to give evidence. Reports or interviews with self-incriminating statements shall not be used as admissible evidence.

3.1.  Safety information is essential to enhance aviation safety. It may be derived from:

• Records pertaining to accidents and incidents
• Mandatory incident reporting systems;
• Voluntary incident reporting systems;
• Self-disclosure reporting systems,

Possible information sources may be recordings, questionnaires, interviews or hearings.

3.2.  Mandatory incident reporting systems will only work if they are confidential and non- punitive. Based on the application of “Just Culture”, the regulatory authority and the employer shall assure that prosecution or punitive actions such as suspension of licence will not be sought unless the unsafe occurrence is deliberately committed or gross negligence is demonstrated.

3.3.  Different to mandatory reporting, voluntary reporting is completely discretionary. These reports need special treatment and shall never be used against the reporting person.

3.4.  Voluntary incident reporting systems as part of a proactive approach to safety have to demonstrate the following aspects:

• Trust
• Non-punitive
• Confidentiality
• Independence
• Ease of reporting
• Acknowledgement
• Promotion (dissemination of de-identified information in a proper manner dissemination of de-identified information in a proper manner)

3.5.  MAs shall seek agreements with their ANSPs clearly describing the use of safety information and that it will not be used for competence and performance assessment or for disciplinary measures.

4.1.  On page 4 4 2 1:

“Just Culture requires a corresponding national legal framework because the administration of justice is in the responsibility of States. IFATCA shall encourage ICAO to foster the establishment accordingly in its Member States”.

Shall be added after the definition of Just Culture.

4.2.  On page 4 4-A-2:

“Member Associations shall promote the creation of Air Safety Reporting based on confidential reporting in a just culture among their service provider(s), Civil Aviation Administration(s), National Supervisory Authority(ies) and members.“

Shall be deleted and replaced by:

“Member Associations shall promote the creation of mandatory incident reporting systems based on confidential reporting in a just culture among their service provider(s), Civil Aviation Administration(s), National Supervisory Authority(ies) and members.

Member Associations shall promote the creation of voluntary incident reporting systems provided that the reported information will never be used against the reporting person.

IFATCA shall not encourage Member Associations to join Incident Reporting Systems unless provisions exist that adequately protect all persons involved in the reporting, collection and/or analysis of safety-related information in aviation.

Any incident reporting system, including the collection, storage and dissemination of safety related data, shall be based on the following principles:

a) in accordance and in cooperation with pilots, air traffic controllers and Air Navigation Service Providers;

b) the whole procedure shall be confidential, which shall be guaranteed by law;

c) adequate protection for those involved, the provision of which be within the remit of an independent body.

Air Navigation Service Providers and their respective employee groups shall develop mechanisms that foster an environment of trust and mutual respect in order to improve the capability to compile, assess and disseminate safety- related information with each other, as well as with other national and international aviation organizations.”