GM2 ORO.FC.231(c) Evidence-based training

• ED Decision 2021/002/R found in: Air Operations (965/2012) Part-ARO Part-ORO Part-CAT Part-SPA Part-NCC Part-NCO Part-SPO (Feb 2025)

GM2 ORO.FC.231(c) Evidence-based training ED Decision 2021/002/R FEEDBACK PROCESS — DATA PROTECTION – GRADING SYSTEM (a) The data access and security policy may, as a minimum, define: (1) a policy for access to information only to specifically authorised persons identified by their position in order to perform their duties. The required authorised person(s) does (do) not need to be the EBT manager; it could be the EBT programme manager or a third party mutually acceptable to unions or staff and management. The third party may also be in charge of ensuring the correct application of the data access and security policy (e.g. the third party is the one activating the system to allow access to the authorised persons); (2) the identified data retention policy and accountability; (3) the measures to ensure that the security of the data includes the information security standard (e.g. information security management systems standard e.g. ISO 2700x-ISO 27001, NIST SP 800-53, etc.); (4) the method to obtain de-identified crew feedback on those occasions that require specific follow-up; and (b) When there is a need for data protection, it is preferable to de-identify the data rather than anonymise it. GM2 ORO.FC.231(c) Evidence-based training ED Decision 2021/002/R FEEDBACK PROCESS — DATA PROTECTION – GRADING SYSTEM (a) The data access and security policy may, as a minimum, define: (1) a policy for access to information only to specifically authorised persons identified by their position in order to perform their duties. The required authorised person(s) does (do) not need to be the EBT manager; it could be the EBT programme manager or a third party mutually acceptable to unions or staff and management. The third party may also be in charge of ensuring the correct application of the data access and security policy (e.g. the third party is the one activating the system to allow access to the authorised persons); (2) the identified data retention policy and accountability; (3) the measures to ensure that the security of the data includes the information security standard (e.g. information security management systems standard e.g. ISO 2700x-ISO 27001, NIST SP 800-53, etc.); (4) the method to obtain de-identified crew feedback on those occasions that require specific follow-up; and (b) When there is a need for data protection, it is preferable to de-identify the data rather than anonymise it. ##### GM2 ORO.FC.231(c) Evidence-based training *ED Decision 2021/002/R* **FEEDBACK PROCESS — DATA PROTECTION – GRADING SYSTEM** (a) The data access and security policy may, as a minimum, define: (1) a policy for access to information only to specifically authorised persons identified by their position in order to perform their duties. The required authorised person(s) does (do) not need to be the EBT manager; it could be the EBT programme manager or a third party mutually acceptable to unions or staff and management. The third party may also be in charge of ensuring the correct application of the data access and security policy (e.g. the third party is the one activating the system to allow access to the authorised persons); (2) the identified data retention policy and accountability; (3) the measures to ensure that the security of the data includes the information security standard (e.g. information security management systems standard e.g. ISO 2700x-ISO 27001, NIST SP 800-53, etc.); (4) the method to obtain de-identified crew feedback on those occasions that require specific follow-up; and (b) When there is a need for data protection, it is preferable to de-identify the data rather than anonymise it.