access to and protection of confidential data – annex 13 ... · such information is distributed,...

1

Access to and Protection ofConfidential Data –Annex 13, Legislation, Liabilityand Litigiousness

Kym Bills

Executive Director ATSB

Chiefs of Aircraft Accident Investigation

Singapore, 23 August 2007

2

Annex 13

As you know Annex 13 paragraph 5.12 is central:– ‘The State conducting the investigation shall not make

the following records available for purposes other thanaccident or incident investigations, unless theappropriate authority for the administration of justice inthat State determines that their disclosure outweighs theadverse domestic and international impact such actionmay have on that or any future investigation:(a) all statements taken from persons by the investigation authorities in the course of their investigation;(b) all communications between persons having been

involved in the operation of the aircraft;

3

Annex 13

– (c) medical or private information regarding personsinvolved in the accident or incident;

(d) cockpit voice recordings and transcripts from suchrecordings; and

(e) recordings and transcripts of recordings for air trafficcontrol units; and

(f) opinions expressed in the analysis of information,including flight recorder information.’

– 5.12.1 ‘These records shall be included in the final reportor its appendices only when pertinent to the analysis ofthe accident or incident. Parts of the records not relevantto the analysis shall not be disclosed.’

4

Annex 13

• ‘Note 1 – Information contained in the records listed above,which includes information given voluntarily by personsinterviewed during the investigation of an accident orincident, could be utilized inappropriately for subsequentdisciplinary, civil, administrative and criminal proceedings. Ifsuch information is distributed, it may, in the future, nolonger be openly disclosed to investigators. Lack of accessto such information would impede the investigation processand seriously affect flight safety.’

• ‘Note 2 – Attachment E contains legal guidance for theprotection of information from safety data collection andprocessing systems.’

5

Annex 13• Before looking at Attachment E, it is worth reminding

ourselves of the potential conflict between paragraph5.4 under which the Annex 13– ‘accident investigation authority shall have independence

in the conduct of the investigation and unrestrictedauthority over its conduct’

• and paragraph 5.10 whereby

– ‘The State conducting the investigation shall recognize theneed for coordination between the investigator-in-chargeand the judicial authorities.’

• ‘Note 2 – possible conflicts between investigating and judicialauthorities regarding the custody of flight recorders and theirreading out may be resolved by an official of the judicialauthority carrying the recordings to the place of readout, thusmaintaining custody.’

6

Annex 13 Attachment E

• Following ICAO Assembly resolutions A33-17 andA35-17 on protection of accident, incident and othersafety data, after consideration in the Air NavigationCommission, in March 2006 the ICAO Counciladopted legal guidance for the protection ofinformation from safety data collection andprocessing systems (SDCPS)

• The applicability date was 23 November 2006 via anew Attachment E to Annex 13 which covers bothgeneral principles and more specific guidance

7


– ‘The sole purpose of protecting safety information frominappropriate use is to ensure its continued availability sothat proper and timely preventative actions can be takenand aviation safety improved. It is not the purpose ofprotecting safety information to interfere with the properadministration of justice in States.’

• ‘SDCPS’ include Annex 13 para 5.12 records, ch. 8mandatory & voluntary incident reporting systems,and self-disclosure reporting systems includingautomatic data capture, and ancillary databasesand storage and exchange and transmission media

8


• ‘Safety information should qualify for protection frominappropriate use according to specified conditions thatshould include but not necessarily be limited to: thecollection of information was for explicitly safety purposesand the disclosure of the information would inhibit itscontinued availability.’

• ‘inappropriate use refers to the use of safety information forpurposes different from the purposes for which it wascollected, namely, use of the information for disciplinary,civil, administrative and criminal proceedings againstoperational personnel, and/or disclosure of the information tothe public’

9


• ‘Formal criteria for disclosure of safety information shouldbe established and should include, but not necessarily belimited to, the following:

a) disclosure of the safety information is necessary tocorrect conditions that compromise safety and/or tochange policies and regulations;

b) disclosure of the safety information does not inhibitits future availability in order to improve safety;

c) disclosure of relevant personal information includedin the safety information complies with applicableprivacy laws; and

d) disclosure of the safety information is made in ade-identified, summarized or aggregate form.’

10

Annex 13

• I have discussed with my South Korean ARAIB andInternational Transportation Safety Associationcolleagues the possible merit of upgradingRecommended Practice 5.4.1 to a Standard

• This would mean that any judicial or administrativeproceedings to apportion blame or liability ‘shall’(rather than ‘should’) be separate from anyinvestigation conducted under Annex 13

• The proposal has been listed for discussion at theAIG 2008 Divisional meeting, as is more FDRprotection (but basics of existing Annex critical)

11

ICAO Assembly

• The next Assembly in September 2007 will provide anopportunity to embed a sensible framework for protection ofsafety information that can inform the October 2008 AIGDivisional meeting- the ATSB has drafted a paper to assist in this process

• Clearly, it will take some time to develop the right balancebetween protection related to human factor linked accidents,incidents and other events, and more culpable acts thatshould be dealt with

12

Global Aviation Safety Roadmap

• As you know, GASR is a 2006 strategic action planto 2013 developed for ICAO by ACI, Airbus, Boeing,CANSO, FSF, IATA & IFALPA and complementedby a 2007 implementation plan

• GASR seeks

– ‘an “open reporting” environment and a “just culture” forthe systematic collection, analysis and dissemination ofsafety reports and information that will be used solely forthe prevention of accidents. … This does not preclude theuse of other safety-related information gathered fromother sources being used in a judicial proceeding.’

13


• In the GASR implementation plan

– ‘A “Just Culture” is defined as an atmosphere of trust inwhich people are encouraged and even rewarded forproviding essential safety-related information, even if self-incriminating, but in which all parties clearly understandwhich types of behaviours are acceptable orunacceptable.’

• The GASR emphasises that sharing safetyintelligence and data between state and industry candrive further accident reductions, particularly if this isin a structured form

14


• This data includes IATA’s Operational Safety Audit(IOSA) & Safety Trend Evaluation Analysis and DataExchange System (STEADES), Flight OperationsQuality Assurance (FOQA), de-identified LineOperations Safety Audit (LOSA), ADREP, USOAP…

• GASR emphasises that

– ‘learning safety lessons from safety-related accidentsand incidents requires a legal basis that enablesindependent, impartial accident and incidentinvestigations and protects safety data from use inprosecutions.’

15


• To deal with the impediments to reporting of errorsand incidents, GASR includes from 2006– ‘States introduced legislative changes to support the “Just

Culture”, encourage open reporting systems, and protectdata collected solely for the purpose of improving aviationsafety’

to enable better international sharing from c. 2011

• Industry is also from 2006 to introduce ‘just culture’reporting of incidents and errors to remove fear ofreprisal by involved parties and from 2007 adoptcommon metrics for analysis with integration anddatabase sharing from 2008

16

Global Aviation Safety Roadmap• To deal with ineffective incident and accident investigation

from 2006

– ‘States that have not done so, implement ICAO Annex 13principles and the introduction of, or access to, anindependently funded, professionally trained, independentand impartial investigative body. Action taken on SafetyRecommendations.

• Further

– ‘In order to avoid undue influence over the investigation,the State’s safety accident investigators should beorganizationally independent from its Transportationauthorities (from the Civil Aviation Authority, CAA) andany other party to the investigation. Investigations shouldbe conducted functionally independent from political orother interference or pressure.’

17


• Among other things, States conductinginvestigations are to provide Preliminary and Interimreports in a timely manner, and in accordance withAnnex 13 Para 6.5, publicly release final reports assoon as possible, provide funding, and enactappropriate legislation

• GASR includes from 2010:

– ‘Institute legal framework for the protection of safety data,with purpose of accident prevention not assignment ofblame thereby eliminating the criminal aspect of accidentinvestigation’

18

Importance of good legislation

• Robust legislation and legal adoption of Annex 13SARPS is essential to facilitate internationalinvestigation cooperation & sharing of safety data

• Australia’s legislation provides for mandatory andcomprehensive accident and incident reporting

• Recent legislation establishes a complementaryvoluntary confidential incident reporting scheme(REPCON) that replaces the old CAIR schemewhich had no legal backing to protect the identity ofreporters or to manage the de-identification process

19

Australian legislation

• Transport safety investigations are not intended tobe the means to apportion blame or liability, inaccordance with the Transport Safety InvestigationAct 2003 and Annex 13 to the Chicago Convention

• Powers to investigate, including to compel evidenceeven if incriminatory, are delegated by theExecutive Director (ED) to modal professionals

• Reports/evidence can’t be used in civil courts otherthan in ‘coronial inquests’ unless an ED certificateand not at all in criminal courts

20

Australian legislation

• Crashes resulting from ‘unlawful interference’ wouldnot be investigated by the ATSB under theTransport Safety Investigation Act 2003

• However, CVRs are still routinely protected underthe Civil Aviation Act 1988 other than in the case ofserious criminality like terrorism or drug running

• The Australian Government and Parliamentconsider that if flight-deck crew are engaged in suchactivities they forego privileges of CVR protection

21

Legislative constraints

• US NTSB with its distinguished service since 1967is the sister body to all independent investigators

• I have learned a great deal from the NTSB andconsider many of its senior office-holders as friends

• As a respectful friend I consider several aspects ofthe NTSB’s operations worthy of reconsideration

• While the concept of a ‘probable cause’ is easy forthe media and public to digest, it has baggage andfor many accidents (and serious incidents) it is toosimplistic because of multiple causal factors

22


• In the US ‘probable cause’ is best known as thestandard by which a police officer may make an arrest,conduct a search, or obtain a warrant

• The term comes from the 4th Amendment to the USConstitution:

– ‘The right of the people to be secure in their persons, houses,papers, and effects, against unreasonable searches andseizures, shall not be violated, and no Warrants shall issue,but upon probable cause, supported by Oath or affirmation,and particularly describing the place to be searched, and thepersons or things to be seized.’

• It is also a standard of evidence between reasonablesuspicion and the standard for a criminal conviction

23


• Annex 13 refers to ‘causes’ defined as ‘actions,omissions, events, conditions, or a combinationthereof, which led to the accident or incident

• This clearly goes beyond one ‘probable cause’

• The latest variant of crew resource management(CRM) is based around threat and errormanagement (TEM) which might suggest that eventhe broad Annex 13 definition should be modified

24


• Most world-wide investigative bodies do not havethe suasion to get those who may have contributedto an accident to speak freely on-the-recordespecially if this may potentially incriminate them

• The NTSB usually can in part, because of a mediafollowing that will otherwise embarrass the witness

• The US Code chapter 11, title 49: 1114, 1131,1154; and Code of Federal Regulations parts 831,845, 801, 804 provide for most sensitive (Annex 135.12) material to be made public by the NTSB

25


• US law requires the NTSB to make available suchmaterial in a ‘public docket’ within 2 years of anaccident or after a final report is completed

• This includes CVR transcripts, communicationsbetween persons, air traffic recordings & statements

• It applies not only to US accidents, but alsosensitive material obtained as an accreditedrepresentative as country of manufacture/design etc

• US differences notified to ICAO are inconsistentwith GASR

26


• I look forward to the next presentation by myesteemed colleague Paul Arslanian, long-timeDirecteur of the BEA & passionate safety advocate

• He has done a huge amount internationally andespecially as accredited representative for Airbus, inFrench territory and across the EU

• This has not always been easy given the Frenchlegal system and broad powers given to prosecutors(and more recently EASA’s involvement)

• These can sit uncomfortably with Annex 13 & GASR

27

Liability and Litigiousness

• NTSB Bar Association member, James Crouse,writing in the ISASI Forum last year cites StuartSpeiser’s 1980 book Lawsuit concerning the publicinterest deterrent effect of civil tort litigation onmanufacturers both directly and via insurers

• Crouse argues that adversarial litigation aided byexperts is the

– ‘best way to find out what really happened in an aviationcrash … we frequently uncover facts that were missed ornever reached by the overworked and hurried’ NTSB andthe FAA.

28


• Crouse concedes

– ‘But there is a downside to this litigation process … thethreat of litigation can limit the willingness of individualsand companies to engage in full disclosure. Ever-expanding … data gathering … The potential of thisinformation getting into the hands of aggressive litigators,or prosecutorially minded government agents, has itschilling aspects. We must find a way to balance the fact-finding efforts and the privacy concerns so that theinformation can be shared in a way that benefits societywithout sacrificing the individuals involved. Clearly,lawyers have a role in striking that balance.’

• Yet perhaps adversarial litigation is not the best wayafter all cf better resourced investigators like NTSB?

29


• A few years ago when I last checked, the averagedamages recoveries in the US from aircraft crasheswas about $2.7 million per life lost

• Often the civil litigation takes many years

• In the Concorde case, with no right of involvementby US courts, I am told that a negotiated settlementof $1.6 million per passenger was reached within 11months of the accident (distributed among 700 nextof kin)

30


• Later speakers will no doubt discuss the disturbingcriminalisation involving US crew in Brazil

• I share the concern of flight crew being charged orincarcerated as a result of what most of us wouldregard as a fairly typical tragic major accident

• It is of little comfort to know that in the marinesector, officers of several ships have been gaoled

• Most recently the master of Zim Mexico III in the USafter bow thrusters malfunctioned at a critical timeresulting in the death of an electrician in Mobile port.

31


• Japan’s ARAIC faces a legal environment in whichprosecutors have enormous power and may useARAIC reports for criminal prosecution

• Previous charges against crew includemanslaughter in cases of clear air turbulence

• Pilot unions encourage crew to leave the countryrather than cooperate because of the risk of gaol

• In such an environment the investigator may ‘dumb-down’ reports to reduce usefulness in prosecutionsbut this risks investigator reputation and the clarityand persuasiveness of its safety message

32


• Canada’s Transportation Safety Board hasmanaged to continue to protect most confidentialsafety information including CVRs and to keepinvestigators out of criminal proceedings

• But the TSB recently lost a case in the SupremeCourt which required them, contrary to pastpractice, to release air traffic control tapes

33


• In New Zealand, CVR protections are much tightervia better legislation after a manslaughter chargeagainst a Dash-8 crew in a 1995 accident atPalmerston North

• Recent coronial inquest criticised the NZ CAA forinterpreting ‘just culture’ as self-regulation andemphasised the onus on regulators to regulate

• Coroners continue to criticise the NZ TAIC for notgiving fulsome evidence at inquests (blocked vialegislation)

34


• In Australia, the ATSB is not immune from legalpressures. In recent months we have facedunresolved constitutional challenge to our legislationand attempts to require the Executive Director toissue a certificate to allow the courts to determine ifrestricted investigation information can be used inadversarial civil damages proceedings

• We do provide coronial inquests with assistance,but often they want even more and if we don’t help,we risk public criticism and damaged reputation

35


• While other civil courts and all criminal courtscannot use ATSB investigation reports as evidence,often parties in coronial inquests will seek to usethese processes as ‘fishing expeditions’ for later

• The ATSB resists most of this and certainly neverreleases records of interview (which may becompelled), CVR or other sensitive investigationmaterial

• But it is an ongoing tension and battle in which weneed to work together internationally.

36

Trial by media

• I was astounded by last week’s Flightglobal.comarticle by David Kaminski-Morrow on the TAMAirbus A320 fatal accident at Sao Paulo on 17 July

• The article not only cites the CVR, but includes alink to what is purportedly the full CVR transcript

• As would be expected so soon after the accident,there is no accompanying FDR analysis or contextconfirmed by professional investigation

• Such release is totally out of line with Annex 13 andGASR

37

Growing challenges

• Using all available means to avoid major accidents isthe primary challenge

• Trade-off between investigation timeliness andthoroughness (eg media and societal expectations)

• Getting the balance right between no-blame andculpability in a ‘just culture’

• Striking the right balance between protecting safetydata and legal system

• The growing safety/security interface noted earlier

• Better use of tools/data like FOQA, LOSA etc

38

Conclusion

• Aviation is increasingly safe in most of the world

• Major accidents low probability, high consequenceevents and we can never afford to be complacent

• Human factors associated with well-known humanperformance continue to dominate

• Systemic investigations remain crucial, but pro-activereporting and data analysis also provide forevidence-based risk reduction which is essential

• Must underpin this by sharing data in a timely wayvia confidentiality and strong legislative protection toenforce Annex 13 and curb runaway litigiousness.

access to and protection of confidential data – annex 13 ... · such information is distributed,...

Documents