3.16How shall information collected be handled?

• GM to Reg. (EU) No 376/2014 and its IRs found in: Occurrence Reporting (376/2014) (Dec 2022)

3.16 How shall information collected be handled? GM to Reg. (EU) No 376/2014 and its IRs Detailed information on those aspects is contained in Sections [2.12](#_DxCrossRefBm2103820821) and [2.13](#_DxCrossRefBm2103820822). <table border="1" cellpadding="0" cellspacing="0"><tr><td valign="top" width="599"><p align="center">Key principle</p><p>Organisations are required to take the necessary measures to ensure appropriate confidentiality of occurrences they collect and to comply with rules on the processing of personal data.</p></td></tr></table> It is notably recognised by Regulation 376/2014 that a clear separation between the departments handling occurrence reports and the rest of the organisation may be an efficient way to achieve this objective ([*Recital 34*](#_DxCrossRefBm2103820732))*.* This should therefore be encouraged where practicable. In addition Regulation 376/2014 requires organisations to process personal data only to the extent necessary for the purposes of this Regulation and in accordance with applicable personal data rules ([*Article 15*](#_DxCrossRefBm2103820752)*(1)*). Regulation 376/2014 prevents certain actions to be taken against reporters and persons mentioned in an occurrence report while identifying unacceptable behaviours that are not covered by this protective framework. <table border="1" cellpadding="0" cellspacing="0"><tr><td valign="top" width="599"><p align="center">Key principle</p><p>Employees and contracted personnel who report or are mentioned in occurrence reports shall not be subject to any prejudice by their employer or by the organisation for which the services are provided on the basis of the information supplied by the reporter except in cases of unacceptable behaviour (<a href="#_DxCrossRefBm2103820751"><b><i>Article 16</i></b></a><i>(9)</i>).</p></td></tr></table> This principle is implemented by several provisions which prevent certain actions to be taken against reporters and persons mentioned in an occurrence report while identifying unacceptable behaviours that are not covered under this protective framework. It means that if a person reports an occurrence to his/her organisation, the organisation is not allowed to blame that person or to impose prejudice on him/her on the basis of the occurrence reported. This rule also applies if the person is not the reporter but is mentioned in the occurrence report. <table border="1" cellpadding="0" cellspacing="0"><tr><td valign="top" width="599"><p align="center">Key principle</p><p>Regulation 376/2014 recognises two exceptions to this principle (<a href="#_DxCrossRefBm2103820751"><b><i>Article 16</i></b></a><i>(10)</i>):</p><p>— wilful misconduct; and</p><p>— situations where there has been a manifest, severe and serious disregard of an obvious risk and profound failure of professional responsibility to take such care as is evidently required in the circumstances, causing foreseeable damage to a person or property, or which seriously compromises the level of aviation safety.</p></td></tr></table> The objective is to clearly set, in the legislation, the line between acceptable behaviours (which shall not be punished) and unacceptable behaviours (which can be punished). Furthermore, Regulation 376/2014 states additional principles limiting the possibility for an organisation to disclose or use occurrence reports. <table border="0" cellpadding="0" cellspacing="0" width="595"><tr><td width="595"><p align="center"><b>Key principle</b></p><p><b>Organisations can only use an occurrence report for the purpose for which it has been collected (</b><a href="#_DxCrossRefBm2103820752"><b><i>Article 15</i></b></a><b><i>(1))</i>.</b></p><p><b>Organisations are not allowed to make available or use occurrence reports:</b></p><p>— in order to attribute blame or liability; or</p><p>— for any purpose other than the maintenance or improvement of aviation safety (<a href="#_DxCrossRefBm2103820752"><b><i>Article 15</i></b></a><i>(2)</i>).</p></td></tr></table> Those limitations to the disclosure or use of occurrence reports apply within the organisation as well as outside of it. It is therefore understood that sharing information on occurrences with press and media is not allowed by the Regulation. Disclosure of information on occurrence reports to judicial authorities is similarly not allowed. It is understood from this principle that organisations can use the information with the view to maintain or improve aviation safety. This covers in particular the measures and actions foreseen under [Article 13](#_DxCrossRefBm2103820749). It also includes existing procedures and actions (e.g. safety recommendations, airworthiness directives, safety information bulletin etc), including sharing of lessons learnt with the organisation personnel. It is also understood that ‘for the purpose of maintaining or improving aviation safety’ includes any measure necessary for safety and therefore can include the suspension of a licence or requesting a person to do additional training. <table border="1" cellpadding="0" cellspacing="0"><tr><td valign="top" width="599"><p align="center">Key principle</p><p>In addition, there are however few exceptions to those principles.</p><p>Firstly, it is understood that in a situation where safety might be endangered, information on occurrences may be shared or used with a view to maintain or improve aviation safety. It is therefore understood that sharing or using information on occurrences in the cases detailed in <a href="#_DxCrossRefBm2103820751"><b>Article 16</b></a>(10) with the view to address the risks to safety is allowed by the Regulation.</p><p>Secondly, exception may apply in a situation where an investigation under Regulation (EU) No 996/2010 has been instituted, as the provisions of Regulation 996/2010 have precedent in such case (<a href="#_DxCrossRefBm2103820752"><b><i>Article 15</i></b></a><i>(2)</i>).</p></td></tr></table> Regulation 996/2010 foresees in its Article 14(2) and (3) that, in cases where it applies (opening of a formal technical accident or incident investigation), occurrences reports shall not be made available or used for purposes other than aviation safety unless the administration of justice or the authority competent to decide on the disclosure of records according to national law decides that the benefits of the disclosure of the occurrence report outweigh the adverse domestic and international impact that such action may have on that or any future safety investigation (balancing test). If this balancing test concludes that the information on occurrences should be disclosed, then the organisation should make it available to the requesting authority. An organisation shall only disseminate personal details within the organisation in those cases where it is essential to progress the investigation or to ensure the safety actions are properly taken ([*Article 16*](#_DxCrossRefBm2103820751)*(2)*). In this regards, the organisation may use the same protocols and agreements than the ones established and consulted with staff representatives to deal with other safety information (e.g. Flight Data Monitoring). In order to support all these legal provisions, each organisation is required to adopt internal rules describing how Just Culture principles are guaranteed and implemented within that organisation ([*Article 16*](#_DxCrossRefBm2103820751)*(11)*). It is specified that staff representatives shall be consulted before the adoption of these internal rules. The body designated pursuant to [Article 16](#_DxCrossRefBm2103820751)(12) may ask to review the internal rules of organisations before those internal rules are implemented. With the support of the Commission and of EASA, staff and employers representatives across aviation domains have developed a European Corporate Just Culture Declaration which contains principles to be implemented in each organisation and reflected in its internal Just Culture rules, with a view to ensure an effective Just Culture within the organisation. This initiative is expected to support a proper and harmonised implementation of this legal provision and should guarantee a similar level of protection across European organisations. In addition a best practice issued from experience in a number of operators is the setting up an ‘occurrence review committee’ within the organisation whose role is to support the practical implementation of the protection principles.