Duncan-AFX-1-2 2018

Page 1

Federal Aviation Administration Memorandum

Date: JuL· 11 io1a

To:

From:

J<W° S . ~~utive Director, Flight Standards Service, AFX-1 ~eYB. Peter, Assistant Chief Counsel for Regulations, AGC-200

Prepared by:

Subject:

Francisco E. Castillo, Attorney, AGC-220 Legal interpretation of 49 USC § 44735(b)(4) - Limitation on disclosure of safety information related to safety management systems This is in response to your memo dated March 9, 2018. You requested our interpretation of 49 USC§ 44735(b)(4). For your convenience, we restated the pertinent facts and your questions prior to issuing our interpretation of the statute. I. Facts:

1. Certain entities regulated by the FAA are - or may be - required to develop and implement a safety management system (SMS) to improve the safety of their operations by identifying and mitigating hazards. For example, as of March 9, 2018, 14 CFR part 119 certificate holders authorized to conduct operations in accordance with the requirements of 14 CFR part 121 must have an SMS that meets the requirements of 14 CFR part 5.

2. 49 USC§ 44735 offers statutory protection to certain reports, data, or other information that are submitted to the FAA voluntarily and that are not required to be submitted to the Administrator under any other provision of law. Section 4473 5(b)(4) extends the limitation on disclosure to "reports, data, or other information produced or collected for purposes of developing and implementing" an SMS acceptable to the Administrator. Section 44735(b)(5) also extends the limitation on disclosure to "reports, analyses, and directed studies, based in whole or in part on reports, data or other information" related to the development and implementation of SMS.

3. Regulated parties have expressed their concern that the protections afforded by § 44735 might be limited by the statutory use of the phrase "developing and implementing" an SMS. They believe that SMS-related data, gathered or developed

Page 2

after the SMS is "accepted" by the FAA or after all facets of an SMS implementation plan are first put into place, may fall outside of the scope of the§ 44735 protection. 4. The perceived lack of protection - and the potential negative repercussions, which could stem from the public disclosure of safety related information -impairs the willingness of regulated parties to voluntarily disclose SMS related data to the FAA. U. Applicable Statutory Provision:

Section 44735 states in relevant part:

(a) IN GENERAL.--Except as provided by subsection (c), a report, data, or other information described in subsection (b) shall not be disclosed to the public by the Administrator of the Federal Aviation Administration pursuant to section 552(b)(3)(B) of title 5 if the report, data, or other information is submitted to the Federal Aviation Administration voluntarily and is not required to be submitted to the Administrator under any other provision of law.

(b) APPLICABILITY.--The limitation established by subsection (a) shall apply to the following:

(4) Reports, data, or other information produced or collected for purposes of developing and implementing a safety management system acceptable to the Administrator.

(5) Reports, analyses, and directed studies, based in whole or in part on reports, data, or other information described in paragraphs (1) through (4), including those prepared under the Aviation Safety Information Analysis and Sharing Program (or any successor program).

(c) EXCEPTION FOR DE-IDENTIFIED INFORMATION.- (1) In general.--The limitation established by subsection (a) shall not apply to a report, data, or other information if the information contained in the report, data, or other information has been de-identified.

(2) De-identified defined.--In this subsection, the term "de-identified" means the process by which all information that is likely to establish the identity of the specific persons or entities submitting reports, data, or other information is removed from the reports, data, or other information.

Page 3

HI.Analysis:

When engaging in statutory interpretations, the FAA will look at the plain language of the statute to determine whether the terms are clear and unambiguous. Merriam-Webster dictionary defines the terms "develop" as "to create or produce especially by deliberate effort over time," and "implement" as "to carry out, to accomplish, and to give practical effect to and ensure of actual fulfillment by concrete measures."

In the context of§ 44735, the terms "developing and implementing" are unambiguous. "Developing" an SMS means to create an SMS framework, while "implementing" an SMS means putting the SMS into effect and use.

The question to answer is whether the data gathered or developed after the SMS is "accepted" by the FAA, or after all facets of an SMS implementation plan are first put into place, falls outside of the scope of the§ 44735 protection. Based on the plain language of the statute, it does not. The intrinsic nature of SMS requires flexibility and scalability, so regulated parties may develop and modify their systems according to their size, scope, and complexity of operations. SMS entails regular assessment, monitoring, analysis, and review of programs, policies, systems, or procedures. This could lead to systemic modifications or revisions to accommodate changes in each organization and overarching environment. The development and implementation of continuous improvements enhances an entity's ability to identify and mitigate hazards, and contributes to the improvement of aviation safety. The need for a continuous systemic execution and improvement of SMS denotes that SMS precepts must be developed and implemented on an ongoing basis rather than only at the point in time when all of the facets identified in an SMS plan are first put into place. The opposite conclusion would contravene the intent of SMS. Thus, the FAA has concluded the use of the terms "developing" and "implementing" in§ 44735(b)(4) is meant to be read in a non-restrictive way, and includes the ongoing development and implementation of SMS. We therefore conclude that the data is protected. Based on the statutory authority delegated to the FAA through§ 44735(b)(4), the FAA should protect from disclosure any SMS-related data produced or collected for purposes of - or as a result of - the ongoing development and implementation of SMS, as long as it is voluntarily submitted to the FAA and is not required to be submitted to the Administrator under any other provision of law.

Page 4

. i ... :-.- :····· .: ··-:._.· ... . ~ ·. ,.__ - : I Federal Aviation Administration .. ··.. ··1 ······.·' .....

Memorandum

Date:

To:

From :

Prepared by:

Subject:

Background:

March 9, 2018 Manager Aircraft Maintenance Division, AFS-300 \ Joseph C. Dipalmo, Manager, NYFSDO EA- 15 ?(' John Pieraccini, Supervisory PMI, NYFSDO EA-1 f ) Request Legal for Interpretation of 49 USC§ 4473 - limitation on Disclosure of Safety Information 14 CFR §5.1 requires that all Part 121 air carriers have a Safety Management System (SMS) that meets the requirements of 14 CFR Part 5, and is acceptable to the Administrator by March 9, 2018. U.S. Code § 44735 protects certain types of safety information data produced or collected from Part 121 air carriers from disclosure to the public.

49 U.S. Code § 44735 - limitation on disclosure of safety information states (a) IN GENERAL.- Except as provided by subsection (c), a report, data, or other information described in subsection (b) shall not be d isclosed to the public by the Administrator of the Federal Aviation Administration pursuant to section 552(b)(3)(8) of title 5 if the report, data, or other information is submitted to the Federal Aviation Administration voluntarily and is not required to be submitted to the Administrator under any other provision of law.

(b) APPLICABILITY.-The limitation established by subsection (a) shall apply to the following: (1) Reports, data, or other information developed under the Aviation Safety Action Program. (2) Reports, data, or other information produced or collected under the Flight Operational Quality Assurance Program.

(3) Reports, data, or other information developed under the Line Operations Safety Audit Program. (4) Reports, data, or other information produced or collected for purposes of developing and implementing a safety management system acceptable to the Administrator.

Page 5

(5) Reports, analyses, and directed studies, based in whole or in part on reports, data, or other information described in paragraphs (1) through (4), including those prepared under the Aviation Safety Information Analysis and Sharing Program (or any successorprogram}.

(c) EXCEPTION FORDE-IDENTIFIED INFORMATION.- (1) INGENERAL.- The limitation establ ished by subsect ion (a) shall not apply to a report, data, or other information if the information contained in the report, data, or other information has been de-identified. (2) DE-IDENTIFIED DEFINED1n this subsection, the term "de-identified" means the process by which all information that is likely to establish the identity of the specific persons or entities submitting reports, data, or other information is removed from the reports, data, or other information.

(Added Pub L. 112- 95. title Ill § 310(a}, Feb. 14, 2012, 126 Stat. 64.) Issue:

Air carriers are concerned that information and data developed by their SMS is not protected from public disclosure and are reluctant to make it available to their FAA Certificate Holding District Offices (CHOO}. This data is vital for FAA CHDO's and other FAA Lines of Businesses to identify hazards and mitigate risks in the National Airspace System. Specifically, 49 U.S. Code§ 44735 (4) states, "Reports, data, or other information produced or collected for purposes of developing and implementing a safety management system acceptable to the Administrator." This implies that the SMS information gathered is only protected from disclosure during development and implementation of the SMS. There is no provision in the Statute that protects the information after an SMS is implemented at an air carrier. Clarification Request:

All Part 121 air carriers are required by regulation to have an SMS implemented by March 9, 2018. We are requesting clarification of whether the protection provided by 49 U.S. Code§ 44735 (4) also applies to future information gathered by an air carrier under their FAA "accepted" SMS.