Accident investigation in civil aviation: EDPS insists on ensuring confidentiality of data from persons involved in accidents

Today, the European Data Protection Supervisor (EDPS) adopted an opinion on the European Commission's proposal to update the current rules for civil aviation accident investigation ^(*). The opinion focuses on the aspects of the proposal which have an impact on the protection of personal data, including the processing of data from passengers lists, victims, families and witnesses, during the different stages of the investigation and in the context of an exchange of information between investigation authorities.

The EDPS welcomes the fact that data protection aspects are taken into account in the proposal. However, considering the specific context in which personal data are processed – investigation of accidents to improve aviation safety - further safeguards should be foreseen to ensure confidentiality of the data. This should include provisions requiring the deletion or anonymisation of personal data as soon as possible when they are no more needed for the investigation.

Peter Hustinx, EDPS, says: "I am pleased to see that, to some extent, data protection aspects are included in the proposal. However, more stringent safeguards are needed to protect individuals who are directly or indirectly affected by a serious accident or the loss of relatives. Specific provisions should therefore be added to ensure an effective protection of the rights of those individuals and a strict limitation of the transmission and publication of personal data."

In order to improve the proposal from a data protection point of view, the EDPS recommends to:

• keep the list of passengers confidential as a principle, while providing the possibility to Member States to decide in specific cases and on legitimate grounds to make information available, after having informed all families and obtained their consent for the publication of the name of their relative;
• provide for a limited period of storage of personal data;
• ensure a coordinated procedure for access, rectification and deletion of personal data, especially in the context of their transmission to Member States through the proposed network allowing safety investigation authorities to exchange information;
• submit the transmission of personal data to third countries to the condition that they provide an adequate level of protection;
• clarify the role and responsibilities of the European Commission and of the European Aviation Safety Agency in the application of the Data Protection Regulation.

^(*) Proposal of 29 October 2009 for a Regulation of the European Parliament and of the Council on investigation and prevention of accidents and incidents in civil aviation