What should an operator's training data access and security policy include to prevent the disclosure of crew identity?

The policy should include a procedure to prevent disclosure of crew identity.

Does the guidance require the operator to have a training data access and security policy?

No, the operator may have such a policy; it is not mandatory.

What is the purpose of the training data access and security policy regarding blame or liability?

The policy should ensure that training data is not made available or used to attribute blame or liability.

GM1 ORO.FC.145(d) Provision of training, checking and assessment

Q: Who must agree to the operator's training data access and security policy if the operator decides to have one?

The policy should be agreed by all parties involved, including operator management and flight crew member representatives nominated either by the union or the flight crew themselves.

Q: How should the training data access and security policy align with the organisation's safety policy?

The policy should be in line with the organisation's safety policy in order to not make available or to not make use of the training data to attribute blame or liability.

Q: Can the training data access and security policy restrict access to training data to specific individuals?

Yes, the policy may include a policy for access to information only to specifically authorised persons identified by their position in order to perform their duties.

Q: What is the regulatory basis for the guidance on confidentiality and protection of training data in CAT operations with aeroplanes and helicopters and in IAM operations with VCA?

The guidance is based on ED Decision 2025/010/R and relates to GM1 ORO.FC.145(d).

Navigate / EASA

Ask question Discover more Add to collection

GM1 ORO.FC.145(d) Provision of training, checking and assessment

ED Decision 2025/010/R

CONFIDENTIALITY AND PROTECTION OF TRAINING DATA IN CAT OPERATIONS WITH AEROPLANES AND HELICOPTERS AND IN IAM OPERATIONS WITH VCA

(a) Without prejudice to applicable Union law on the protection of individuals with regard to the processing of personal data, for the training conducted in accordance with point ORO.FC.145, the operator may have a training data access and security policy (including the procedure to prevent disclosure of crew identity).

(b) If the operator decides to have such a policy, it should:

(1) be agreed by all parties involved (operator management and flight crew member representatives nominated either by the union or the flight crew themselves);

(2) be in line with the organisation’s safety policy in order to not make available or to not make use of the training data to attribute blame or liability.

(c) The training data access and security policy may include a policy for access to information only to specifically authorised persons identified by their position in order to perform their duties.

Details

Source-Title: GM1 ORO.FC.145(d) Provision of training, checking and assessment View latest amendments

Erulesid: ERULES-1963177438-20159 Compare versions

Domain: Air operations

Applicabilitydate: 9 July, 2025

Entryintoforcedate: 9 July, 2025

Regulatorysource: ED Decision 2025/010/R Navigate

Regulatorysubject: Part-ORO

Typeofcontent: GM to IR (Guidance material to implementing rule)

Parentir: ORO.FC.145 Provision of training, checking and assessment

Origin: EASA

Category: EAR