The Digital Agenda for Europe

Opinion of the European Data Protection Supervisor

on the Commission Proposal for a Regulation on occurrence reporting in civil aviation and repealing Directive No 2003/42/EC, Commission Regulation (EC) No 1321/2007, Commission Regulation (EC) No 1330/2007 and Article 19 of Regulation (EU) No 996/2010

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article 28(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 18 December 2012, the Commission adopted a Proposal for a Regulation on occurrence reporting in civil aviation and repealing Directive No 2003/42/EC, Commission Regulation (EC) No 1321/2007, Commission Regulation (EC) No 1330/2007 and Article 19 of Regulation (EU) No 996/2010 (‘the Proposal) . This Proposal was sent to the EDPS for consultation on 8 January 2013.

2. The EDPS welcomes the fact that he is consulted by the Commission and that a reference to this Opinion is included in the Preamble of the Proposal. Before the adoption of the Proposal, the EDPS was given the opportunity to provide informal comments to the Commission. 1.2. Objectives and scope of the Proposal

3. The three instruments to be repealed by the Proposal organise occurence reporting in the following way: Directive 2003/42/EC requires each Member State to set up a mandatory occurrence reporting system (hereinafter "MORS"). Under this legislation, aviation professionals are obliged to report occurrences in their daily operational work 6 through the system established by their organisation . In addition, Member States are requested to collect, store, protect and disseminate among themselves information on occurrences. Two implementing rules complete this legislation: Commission Regulation 7 No 1321/2007 , which establishes a European Central Repository (ECR) regrouping all civil aviation occurrences collected by Member States, and Commission Regulation (EC) No 1330/2007 , which lays down rules regarding the dissemination of the information contained in the ECR.

4. The Proposal builds on Directive 2003/42/EC to improve the existing occurrence reporting systems in civil aviation both at national and European level. Amongst other changes, it proposes the following:  ensuring that all relevant occurrences are reported and that the data reported and stored are complete and of high quality;  adding a voluntary reporting system to the mandatory system;  requiring not only Member States but also organisations to report occurrences and to organise the transmission of these reports to the ECR;  encouraging the reporting through a harmonised protection from hierarchical punishment or prosecution of individuals reporting occurrences;  ensuring adequate access to information contained in the ECR. 1.3. Aim of the EDPS Opinion

5. It follows from the Proposal that occurrences will be reported by employees to their organisations, who will then store them in a database and report them to national designated competent authorities or to the European Aviation Safety Agency (EASA). These authorities, together with EASA and the Commission, will transfer information on civil aviation occurrences to the ECR, managed by the Commission. In addition, the Commission will process data relating to interested parties requesting access to the information stored in the ECR.

6. The EDPS acknowledges the fact that the purpose of the Proposal is not to regulate the processing of personal data. However, the information that will be stored, reported and transferred may relate to natural persons who are either directly or indirectly identifiable, such as reporters, third parties involved in the reported occurrence and interested parties applying for access. The reported information might not only involve technical problems but also, for instance, violent passengers, crew incapacitation or 10 health incidents .

7. Therefore, the present Opinion will analyse the elements of the Proposal which concern 11 the processing of personal data. It builds on a previous EDPS Opinion on one of the Regulations which are being repealed by the Proposal .

2. GENERAL REMARKS

8. The EDPS welcomes the fact that most processing operations relating to occurrence reporting will concern 'disidentified' data. However, he reminds that disidentified data in the context of the proposal will still be personal data, as explained below, and thus EU data protection requirements apply.

9. The EDPS also welcomes the fact that the Proposal already incorporates certain data protection principles such as purpose limitation, the obligation of confidentiality and the principle of data quality. However, additional safeguards are needed, especially as regards 'non-disidentified' data.

3. SPECIFIC REMARKS 3.1. EU data protection legislation is applicable to all personal data

10. Directive 95/46/EC and Regulation (EC) No 45/2001 apply to the processing of personal data, which are defined as "any information relating to an identified or identifiable natural person ('data subject')". This identification might be direct, e.g., by a name, or indirect, e.g., by an identification number or other factors . As long as there is a reasonable possibility that natural persons involved can be identified, either directly or indirectly, the relevant data are considered personal data, and thus EU data protection legislation is applicable.

11. Recital 29 of the Proposal states that occurrence reports "should be disidentified and details related to the reporter should not be registered into databases". Article 16(2) of the Proposal states that Member States shall ensure that personal identifiers are not recorded in the national databases and Article 16(1) adds that "disidentified information shall be disseminated within the organisation". Disidentification is defined in Article 2(1) of the Proposal as "removing from occurrence reports submitted all personal details pertaining to the reporter and technical details which are leading to the identity of the reporter, or of third parties, being inferred from the information".

12. It is probable that persons involved in occurrence reporting, members of the crew or even passengers might be identifiable to those having access to the mentioned databases. In this regard, the EDPS would like to underline the phenomenon of unique or rare combinations, where different pieces of information combined together allow data subjects to be differentiated from others or "singled out" and thus to be identified, 15 as it has been pointed out by the Article 29 Working Party . For example, disidentified reports or aggregated information could still allow someone working in the organisation to combine pieces of information and deduct, for instance, the name(s) of the reporting pilot(s) and/or of members of the cabin crew.

13. In any case, according to Article 16(1) of the Proposal, personal data - including direct identifiers - relating to occurrence reports will still be available to the independent handlers referred to in Article 6(1). Individuals will thus still be identifiable, at least by these handlers. As the concept of "identifiability" refers to identification "by any (...) person" , EU data protection legislation is applicable to all personal data, disidentified or not. In other words, what is provided for in the Proposal amounts at best to partial anonymisation.

14. Therefore, the EDPS welcomes Recital 38 of the Proposal which states that "the rules on data processing and the protection of individuals as defined in Directive 95/46 (...) and in Regulation (EU) No 45/2001 (...) should be fully respected in the application of this Regulation". He also welcomes Article 20(2) of the Proposal, according to which "this Regulation shall apply without prejudice to national legislations implementing Directive 95/46/EC and in accordance with Regulation (EC) No 45/2001". 3.2. The controllers of the processing should be identified

15. Directive 95/46/EC states that "where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law" . The EDPS understands that the controller of every organisation's database is the organisation itself or the handler referred to in Article 6(1) in case of non-disidentified data. Similarly, the competent authority, body or entity designated by each Member State according to Article 6(2) will be the controller of the national databases and the Commission will be the controller of the ECR. This should be specified in the Proposal.

16. Directive 95/46/EC will thus apply to the processing of data by organisations (including handlers referred to in Article 6(1) of the Proposal) and by national competent authorities (see Article 16(2)), while Regulation (EC) 45/2001 will apply to the processing of data by EASA and by the Commission, namely in the context of the ECR. 3.3. The scope of disidentification should be clarified

17. Article 16(1) of the Proposal states that organisations "shall ensure that all personal data such as names or addresses of individual persons are only available to the independent handlers referred to in Article 6(1). This sentence is confusing because (i) it might give the impression that only direct identifiers (such as names and addresses) are personal data, dismissing the possibility of indirect identification and (ii) it is narrower than the definition of disidentification in Article 2(1). The latter does not only refer to the removal of personal details but also to the removal of technical details "which are leading to the identity of the reporter, or of third parties, being inferred from the information".

18. In order to clarify the scope of disidentification, the EDPS recommends replacing in Article 16(1) and 16(2) "personal data" by "personal details" and adding a reference to the possibility of identification through technical details, in accordance with Article 2(1).

19. Article 5(6) allows Member States and organisations to establish additional reporting systems. It should be specified that this information should also be disidentified. The EDPS therefore recommends clarifying in Article 16(2) that personal data contained in the safety information collection and processing systems established in accordance with Article 5(6) should also be disidentified.

20. The EDPS would like to remind that, even if Articles 16(1-2) and 5(6) are clarified as recommended, identification would still be possible, as at least independent handlers will have access to the full data, including personal details. However, he welcomes the obligation of disidentification as a measure complying with the principles of necessity, proportionality and data minimisation and contributing to data security requirements.

21. Before its publication, information should not only be disidentified but fully anonymised . This should be specified in Article 13(10). In addition, information made available to interested parties listed in Annex III and not relating to their own equipment, operations or field of activity, should also not only be aggregated or disidentified, as requested by Article 11(4), but fully anonymised. Article 11(4) should be amended accordingly.

22. As regards data available to independent handlers, the EDPS recommends disidentifying or deleting these data as soon as possible, unless the necessity of storing the data is justified, e.g., to comply with other legal obligations of the organisations. Article 16 should be amended accordingly and any storage of personal data by the handler after their recording in the organisations' databases should be justified in the Preamble.

23. Finally, it should also be clarified in the Preamble that disidentification in the sense of the Proposal is relative and does not correspond to full anonymisation. In addition, in line with the above recommendations, the Preamble should also explain that disidentification and full anonymisation measures are to be applied in different contexts. 3.4. The categories of data to be processed should be defined

24. The EDPS welcomes the fact that the list of information to be included in occurrence reports is described in Annex II. However, Article 7(1) provides that occurrence reports may contain other information . The EDPS recommends making the list exhaustive or at least better defining the additional information.

25. In addition, Article 5(3) states that voluntary reporting systems shall allow the collection of details on occurrences which are not listed in Annex I. The EDPS regrets the fact that the types of occurrences that can be voluntarily reported are not specified. The EDPS therefore recommends specifying in Annexes I and II all the occurrences and related data fields that might be collected under mandatory and voluntary reporting systems, or at least better defining the additional information.

26. This reasoning also applies to Article 5(6), which allows Member States and organisations to "establish other systems to collect details on occurrences that may not be captured" by mandatory and voluntary reporting systems. The EDPS recommends specifying or at least better defining in the Annex which details could be collected under these additional systems, especially those involving personal data. Only those strictly necessary should be collected.

27. The list of data to be provided by interested parties in order to request access to the ECR is laid down in Annex IV of the Proposal. Similarly to Article 7(1), Article 11(1) states that this list is not exhaustive. The EDPS recommends completing the list of Annex IV if necessary and clarifying in Article 11(1) that the list is exhaustive. In addition, the open fields contained in Annex IV (information requested) should be better specified or defined in order to avoid the collection of unnecessary personal data.

28. If it is not possible to specify or define all the occurrences and data fields to be processed according to Article 7(1), 5(3), 5(6) and 11(1), these Articles should at least mention that additional personal information not required by the Proposal should not contain special categories of data as defined by Article 8 of Directive 95/46/EC and Article 10 of Regulation (EC) No 45/2001 ('sensitive data') . 3.5. Provisions on data quality are welcomed

29. The EDPS welcomes the fact that the Proposal already incorporates some of the main data quality requirements , such as the principle of purpose limitation, the obligation of confidentiality, and the requirements of accuracy and of keeping the data updated. As the Commission acknowledges, this will not only contribute to the protection of privacy and data protection but will also serve the purposes of the Proposal. Purpose limitation and confidentiality will avoid that employees be discouraged to report occurrences by the fear of possible retaliations or sanctions . The accuracy and updating of the data will ensure a better quality and completeness of the reports, enabling a better identification of risk areas and needs for action .

30. In this regard, the EDPS welcomes the provisions on purpose limitation contained in Recital 28, which states that the information collected "should strictly be used for the purpose of maintaining or improving aviation safety and should not be used to attribute blame or liability" and in Articles 15(2-3), 11(7), 16(1-6). He also welcomes Recital 10 and Article 7(3) on data quality, and Article 9(1) on updating. 3.6. Retention periods should be specified

31. Article 6(3) states that organisations shall store occurrence reports in a database. This Article should specify the period during which the data shall be stored in the organisations' databases. It should also specify for how long the data received by handlers but not recorded in the databases (e.g., direct and/or indirect identifiers) will be stored. Once these data are not necessary any more, they should be deleted (see point 22 above).

32. Occurrence reports collected by organisations should in turn be stored by Member States' competent authorities in national databases. Article 6 should thus also specify the period during which data will be stored in national databases. The same comment is valid for the data stored in the ECR. Only if the data were completely anonymised, the information could be stored without limit. The need to store the data for a determined period should be justified in the Preamble of the Proposal. 3.7. Provisions on data subjects' rights and transparency should be added

33. According to Directive 95/46/EC and Regulation (EC) 45/2001 , controllers (organisations, national designated authorities and the Commission) should inform data subjects about the identity of the controller of the databases; the purposes for which the data collected are processed and any other information such as to whom the data will be transferred. Adequate procedures should also be established to grant individuals the rights of access, correction, blocking and (as far as possible) deletion of the data relating to them, and to inform individuals about these procedures.

34. The EDPS is aware that in the case of disidentified or aggregated information, it might be very difficult or even impossible for the controller to grant the rights of access, correction, blocking and deletion; and that this could require processing more personal data than needed for the purposes of the Proposal. These rights should nevertheless be fully granted as regards the data including personal details that will be available to independent handlers. Although the rights of individuals and the obligation to inform them are already laid down by Directive 95/46/EC and Regulation (EC) 45/2001, it would be useful to clarify these in Article 6 or in the Preamble, to ensure that all controllers are aware of their obligations. 3.8. Security measures should be foreseen

35. The EDPS welcomes the provisions on confidentiality in Recital 28 and Articles 11(7), 15(1) and 15(3). In addition, the Proposal should provide that organisations, Member States' competent authorities and the Commission shall establish specific privacy and security measures for the organisations' and national databases and for the ECR respectively. These could include general data protection measures such as a manual or guidelines for officers and employees having access and entering information in the databases, appropriate training for such officers and the requirement to establish a 28 security policy for the system after having carried a risk assessment . 3.9. Access by third parties should be subject to adequate safeguards

36. Article 5(6) allows Member States and organisations to report occurrence details to entities other than the designated national competent authorities. The possible categories of recipients should be specified and limited to organisations based in the EU and subject to Directive 95/46/EC.

37. Article 10(1) provides that any entity entrusted with regulating civil aviation safety or with investigating civil aviation accidents and incidents within the Union shall have online access to the ECR. Interested parties listed in Annex III may also obtain access to certain information contained in the ECR. The EDPS welcomes the fact that the categories of third parties are specified. However, Annex III includes third parties not established in the EU, such as third country organisations and international aviation organisations .

38. The EDPS would like to remind that as a matter of principle, the transfer of personal data to third countries which do not ensure an adequate level of data protection is prohibited. Although some exceptions apply, for example if the transfer is necessary or 31 legally required (in the EU) on important (EU) public interest grounds , these exceptions seem difficult to apply in this case, as at least transfers to third countries are likely to be based on these third countries' interests. In any case, exceptions cannot be 32 the legal basis for repeated transfers .

39. However, transfers could take place in accordance with EU data protection law if it is ensured that the recipient provides adequate data protection safeguards . These safeguards could be based on the data protection principles contained in the Standard Contractual Clauses for the transfers of personal data to third countries adopted by the Commission and should be binding to third parties, e.g., by means of a contract or an agreement. Such safeguards, to be signed by third country organisations or international organisations requesting the data, should be included in the Proposal, for example in a new Annex.

40. As regards the processing of data of interested parties requesting access to the ECR, the EDPS welcomes the fact that Annex IV determines the categories of data to be collected for this purpose. He recommends specifying in the Proposal the data protection measures that will apply to the processing of data relating to third parties (e.g., for how long the data will be stored after access has been granted or denied and who has access to these data).

41. The form contained in Annex IV should include, apart from the notice on access to information , a privacy notice. This should include information about the identity of the controller, the purpose of the processing and the recipients of the data. 3.10. The processing of sensitive data should be subject to additional safeguards

42. The EDPS notes that Annex I listing the incidents to be reported under the mandatory occurrence reporting system includes sensitive data relating e.g. to injuries, "severe health event affecting crew member or passengers" or " difficulty in controlling intoxicated, violent or unruly passengers". Some of these categories might be related to offences and to the evaluation of the conduct of individuals.

43. According to Article 8 of Directive 95/46/EC and Article 10 of Regulation (EC) No 45/2001 the processing of personal data concerning health is only allowed if certain exceptions apply. The necessity of processing sensitive data for one of the exceptions (e.g., if needed "for reasons of substantial public interest" ) should be justified in the Preamble of the Proposal.

44. Article 8(5) of Directive 95/46/EC and Article 10(5) of Regulation (EC) No 45/2001 only allow the processing of personal data relating to offences, criminal convictions or security measures if laid by law and subject to the provision of suitable safeguards. The Proposal might imply the processing of these categories of data, for example in relation to employees involved in an occurrence or as regards violent passengers.

45. The EDPS recommends implementing additional safeguards for the processing of special categories of data, such as the prohibition to disclose these categories of data to third parties not subject to EU data protection law and the restriction of their disclosure to other interested parties. In addition, the processing of these categories of data may be subject to prior check by EU national data protection authorities and by the EDPS . Stricter security measures might also be needed, according to the results of the risk assessment mentioned in point 35.

4. CONCLUSIONS

46. The EDPS welcomes the attention paid to the protection of personal data, particularly through the engagement taken to 'disidentify' a major part of the data processed under occurrence reporting. However, he reminds that the data processed will still be personal data and thus welcomes the references to the applicability of EU data protection legislation. What is provided for amounts at best to partial anonymisation.

47. The EDPS recommends clarifying the scope of 'disidentification'. In particular, he proposes the following improvements to the text:  in the Preamble, clarifying that disidentification in the sense of the Proposal is relative and does not correspond to full anonymisation. In addition, in line with the above recommendations, the Preamble should also explain that disidentification and full anonymisation measures are to be applied in different contexts;  in Article 16: specifying that data available to independent handlers should also be disidentified or deleted as soon as possible, unless the necessity of storing the data is justified, e.g., to comply with other legal obligations of the organisations;  in order to clarify the scope of disidentification, the EDPS recommends replacing in Article 16(1) and 16(2) "personal data" by "personal details" and adding a reference to the possibility of identification through technical details, in accordance with Article 2(1);  Article 5(6) allows Member States and organisations to establish additional reporting systems. It should be specified that this information should also be disidentified. The EDPS therefore recommends clarifying in Article 16(2) that personal data contained in the safety information collection and processing systems established in accordance with Article 5(6) should also be disidentified;  in Article 13(10): specify that the information should be anonymised before its publication;  in Article 11(4): specify that information made available to interested parties listed in Annex III and not relating to their own equipment, operations or field of activity, should not only be aggregated or disidentified, as requested by Article 11(4), but fully anonymised.

48. The EDPS advises specifying in the Proposal who will be the controller of every database. He also recommends defining in the Annexes I and II, in Article 5(6) all the categories of data to be processed and clarifying Articles 7(1) and 11(1) accordingly. If it is not possible to specify all the occurrences and data fields to be processed according to Article 7(1), 5(3), 5(6) and 11(1), these Articles should at least mention that additional information not required by the Proposal should not contain special categories of data as defined by Article 8 of Directive 95/46/EC and Article 10 of Regulation (EC) No 45/2001 ('sensitive data').

49. The EDPS also recommends specifying the periods during which data shall be stored in the databases, the rights of data subjects and the security measures to be implemented.

50. In case of transfers to third country organisations or international organisations, these should commit to respect adequate safeguards to be provided in a binding instrument. These safeguards could be based on the data protection principles contained in the Standard Contractual Clauses for the transfers of personal data to third countries adopted by the Commission and could be added in the Annex of the Proposal.

51. As regards the processing of data of interested parties requesting access to the ECR, the EDPS recommends specifying in the Proposal the data protection measures that will apply to the processing of data relating to third parties (e.g., for how long the data will be stored after access has been granted or denied and who has access to these data). In addition, the form contained in Annex IV should include, apart from the notice on access to information , a privacy notice.

52. Finally, the necessity of processing sensitive data for any of the grounds contained in Article 8(2-4) of Directive 95/46/EC and Article 10(2-4) of Regulation (EC) No 45/2001 should be justified in the Preamble. The EDPS also recommends adopting additional safeguards as regards the processing of special categories of data, such as stricter security measures, the prohibition to disclose the related categories of data to third parties not subject to EU data protection law and the restriction of its disclosure to other interested parties. In addition, the processing of these categories of data may be subject to prior check by EU national data protection authorities and by the EDPS. Done in Brussels, 10 April 2013 (signed) Giovanni BUTTARELLI Assistant Supervisor