E6-15257. Designation of Voluntary Disclosure Reporting Program (VDRP) Information as Protected From Public Disclosure

ACTION:

Notice of order.

SUMMARY:

On August 17, 2006, the Federal Aviation Administration (FAA) issued FAA Order 8000.89, Designation of Voluntary Disclosure Reporting Program (VDRP) Information as Protected from Public Disclosure under 14 CFR Part 193. There is a regulatory requirement to print the order in its entirety in the Federal Register. The entire order follows after the subtitle, SUPPLEMENTARY INFORMATION.

DATES:

Effective August 17, 2006.

FOR FURTHER INFORMATION CONTACT:

Dr. Thomas Longridge, Manager, Voluntary Safety Programs, Flight Standards Service; Telephone: [phone]; E-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

1. Purpose

This order designates information received by the agency from a Voluntary Disclosure Reporting Program (VDRP) as protected from public disclosure in accordance with the provisions of Title 14 of the Code of Federal Regulations (14 CFR) part 193.

2. Distribution

This order is distributed to the branch level in the Washington headquarters Flight Standards Service; Aviation System Standards; all Regional Administrators; to the Directors of the Mike Monroney Aeronautical Center and the Europe, Africa, and Middle East Area Office; to the Regulatory Standards Division at the FAA Academy; to the branch level in the regional Flight Standards Divisions; to all Flight Standards District Offices; to all International and Aeronautical Quality Assurance Field Offices; to all Flight Standards Certificate Management Offices; and to all Aircraft Evaluation Groups.

3. Background

Under Title 49 of the United States Code (49 U.S.C.) 40123, certain voluntarily provided safety and security information is protected from disclosure in order to encourage persons to provide the information to the Federal Aviation Administration (FAA). The FAA must first issue an order that specifies why the agency finds that the information should be protected in accordance with 49 U.S.C. 40123. The FAA's rules for implementing that section are in 14 CFR part 193. If the Administrator issues an order designating information as protected under 49 U.S.C. 40123, that information will not be disclosed under the Freedom of Information Act (Title 5 of the United States Code (5 U.S.C.) 552) or other laws, except as provided in 49 U.S.C. 40123, 14 CFR part 193, and the order designating the information as protected. This order is issued under part 193, § 193.11, which sets out the notice procedure for designating information as protected.

4. Applicability

This order is applicable to any FAA office that receives information covered under this designation from a VDRP. The order also is applicable to any other government agency that receives such information from the FAA. In order for any other government agency to receive VDRP information covered under this designation from the FAA, each such agency must first stipulate, in writing, that it will abide by the provisions of part 193 and this order.

5. Summary of the VDRP Voluntary Information Sharing Program

a. Qualified Participants. Regulated entities as provided in Advisory Circular (AC) 00-58, as amended, or, for hazardous materials, in accordance with AC 121-37, as amended.

b. Voluntarily Provided Information Protected from Disclosure Under This Designation. The content of all submissions by a regulated entity that are accepted under the VDRP, including, but not limited to, all of the following items:

(1) Information contained in an initial notification to the FAA:

(a) A brief description of the apparent violation, including an estimate of the duration of time that it remained undetected, as well as how and when it was discovered;

(b) Verification that noncompliance ceased after it was identified;

(c) A brief description of the immediate action taken after the apparent violation was identified, the immediate action taken to terminate the conduct that resulted in the apparent violation, and the person responsible for taking the immediate action;

(d) Verification that an evaluation is underway to determine if there are any systemic problems;

(e) Identification of the person responsible for preparing the comprehensive fix; and

(f) Acknowledgment that a detailed written report will be provided to the designated FAA official within 10 working days.

(2) Information contained in a detailed written report:

(a) A list of the specific FAA regulations that may have been violated;

(b) A description of the apparent violation, including the duration of time it remained undetected, as well as how and when it was detected;

(c) A description of the immediate action taken to terminate the conduct that resulted in the apparent violation, including when it was taken, and who was responsible for taking the action;

(d) An explanation that shows the apparent violation was inadvertent;

(e) Evidence that demonstrates the seriousness of the apparent violation and the regulated entity's analysis of that evidence;

(f) A detailed description of the proposed comprehensive fix, outlining the planned corrective steps, the responsibilities for implementing those corrective steps, and a time schedule for completion of the fix; and

(g) Identification of the company official responsible for monitoring the implementation and completion of the comprehensive fix.

(3) FAA generated documentation and electronic information that is directly associated with an accepted VDRP submission, including, but not limited to:

(a) Acknowledgement of receipt of a VDRP submission.

(b) Notification of VDRP acceptance, request for modification, or rejection.

(c) Routine correspondence directly associated with a VDRP submission.

(d) FAA records directly associated with FAA monitoring of a comprehensive fix.

(e) FAA Letter of Correction for an accepted VDRP submission.

(f) A FAA electronic database of VDRP submissions and FAA responses.

Note:

The type of information or circumstances under which the information listed above would not be protected from disclosure is discussed in paragraph 6e(2) of this order.

c. Ways to Participate. Regulated entities may participate by submitting a voluntary disclosure in accordance with the procedures in Advisory Circular 00-58, as amended, or, for hazardous materials, in accordance with Advisory Circular 121-37.

d. Duration of this Information-Sharing Program. This information sharing program will continue in effect indefinitely, unless the FAA terminates the VDRP, or until the order of designation under 14 CFR part 193 for the VDRP is withdrawn by the FAA.

6. Findings

The FAA designates information received from an accepted VDRP submission as protected under 49 U.S.C. 40123 and part 193, § 193.7, based on the following findings:

a. Summary of Why the FAA Finds that the Information Will Be Provided Voluntarily. The FAA finds that the information will be provided voluntarily. No certificate holder is required to participate in the VDRP. Initiation of submissions under the VDRP are indicative of the willingness of regulated entities to identify and correct their own instances of regulatory noncompliance, develop long term comprehensive fixes, and foster safe operating practices.

b. Description of the Type of Information that may be Voluntarily Provided Under the Program and a Summary of Why the FAA Finds that the Information is Safety or Security-Related.

(1) The information that would be voluntarily submitted under a VDRP is described in AC 00-58, as amended, or AC 121-37, as amended. VDRP information submitted by a certificate holder includes:

(a) Initial notification to the FAA of a VDRP submission.

1. A brief description of the apparent violation, including an estimate of the duration of time that it remained undetected, as well as how and when it was discovered;

2. Verification that noncompliance ceased after it was identified;

3. A brief description of the immediate action taken after the apparent violation was identified, the immediate action taken to terminate the conduct that resulted in the apparent violation, and the person responsible for taking the immediate action;

4. Verification that an evaluation is underway to determine if there are any systemic problems;

5. Identification of the person responsible for preparing the comprehensive fix; and

6. Acknowledgment that a detailed written report will be provided to the designated FAA official within 10 working days.

(b) Information contained in a detailed written report submitted by the certificate holder to the FAA:

1. A list of the specific FAA regulations that may have been violated;

2. A description of the apparent violation, including the duration of time it remained undetected, as well as how and when it was detected;

3. A description of the immediate action taken to terminate the conduct that resulted in the apparent violation, including when it was taken, and who was responsible for taking the action;

4. An explanation that shows the apparent violation was inadvertent;

5. Evidence that demonstrates the seriousness of the apparent violation and the regulated entity's analysis of that evidence;

6. A detailed description of the proposed comprehensive fix, outlining the planned corrective steps, the responsibilities for implementing those corrective steps, and a time schedule for completion of the fix; and

7. Identification of the company official responsible for monitoring the implementation and completion of the comprehensive fix.

(2) Because the Federal Aviation Regulations specify the minimum requirements for safety, and VDRP submissions entail possible violations of those regulations, the FAA finds that the information is inherently safety related.

c. Summary of Why the FAA Finds that the Disclosure of the Information Would Inhibit Persons from Voluntarily Providing that Type of Information.

(1) The FAA finds that disclosure of VDRP information would inhibit the voluntary provision of that type of information because regulated entities have stated they are reluctant to voluntarily disclose instances of regulatory noncompliance if such submissions might be subject to public disclosure. A significant impediment to participation in the VDRP is concern over public disclosure of the information, and, if disclosed, the potential for it to be used for other than the system safety enhancement purposes for which the VDRP was created. Withholding such information from disclosure is consistent with the FAA's safety and security responsibilities because, unless the FAA can provide assurance that it will not be disclosed, regulated entities will be reluctant to participate in the program.

(2) Although regulated entities have voluntarily disclosed information under the VDRP for several years, they did so after the FAA promised that such information would be deidentified in the Enforcement Information System (EIS), which is the FAA's central and national database of enforcement action information. The entities were reluctant to participate in the VDRP without this promise for fear that information they disclosed would be readily available to the public through a FOIA request for records in the EIS. So that entities continue to use the VDRP, the FAA has not kept the identity of persons reporting, or detailed information about disclosures, under that program in the EIS or any other central database.

(3) The FAA finds that by virtue of designating information provided under the VDRP as protected under 14 CFR part 193, the reluctance of regulated entities to participate due to concerns about possible disclosure of the information will be mitigated. In addition, FAA will be able to retain more information about the disclosures, including the identity of the reporters, in an FAA database, without negatively impacting participation in the VDRP. Disclosures under the VDRP enable the FAA to become aware of many more instances of regulatory noncompliance than it otherwise would, and moreover, the VDRP permits the FAA to assure that appropriate corrective action is taken. If regulated entities do not participate, the FAA and the public will be deprived of the opportunity to make the system safety improvements that receipt of the information otherwise enables.

d. Summary of Why the Receipt of that Type of Information Aids in Fulfilling the FAA's Safety and Security Responsibilities. The FAA finds that receipt of VDRP information aids in fulfilling the FAA's safety and security responsibilities. A primary purpose of FAA regulations is to assure public safety. Because the VDRP identifies and corrects instances of regulatory noncompliance of which the FAA may be otherwise unaware, the program offers significant potential for enhancement of public safety. Receipt of this otherwise unavailable information would also provide the FAA with an improved basis for modifying procedures, policies, and regulations to improve safety and efficiency.

e. Consistencies and Inconsistencies with FAA Safety and Security Responsibilities.

(1) The FAA finds that withholding VDRP information provided to the FAA is consistent with the FAA's safety responsibilities. The VDRP specifically provides that appropriate corrective action must be taken by the regulated entity for all instances of regulatory noncompliance accepted under the program. To be accepted by the FAA, apparent violations disclosed under the program must be inadvertent, and, where applicable, must not indicate a lack, or reasonable question of a lack, of qualification of the regulated entity. Corrective action under the VDRP can be accomplished by the regulated entity and verified by the FAA without disclosure of the protected information. If the FAA determines that the steps taken by the entity are not those documented in the written report, the submission may be excluded from the VDRP, and appropriate legal enforcement action may be initiated.

(2) The FAA will release information submitted under a VDRP as specified in part 193 and this order. To explain the need for changes in FAA policies, procedures, and regulations, the FAA may disclose de-identified (i.e., the identity of the source of the information and the names of the certificate holder, employees, and other persons, as well as any other information that could be used to ascertain the identity of the submitter, redacted) summary information that has been extracted from submissions accepted under the VDRP. The FAA may disclose de-identified, summarized VDRP information that identifies a systemic problem in the aviation system, when other persons need to be advised of the problem so that they can take corrective action. The FAA may disclose de-identified aggregate statistical information concerning VDRP submissions. The FAA may disclose independently obtained information relating to any event disclosed in a VDRP report, unless the FAA determines that in the case of an accepted VDRP submission, release of such independently obtained information would be inconsistent with the provisions of this order, or would otherwise be prohibited by public law or regulation. The FAA also may disclose information concerning enforcement action taken for a regulatory violation initially identified in a VDRP submission, when that submission is not accepted by the FAA, or if accepted, it is later excluded by the FAA, because of the regulated entity's failure to comply with the criteria of the VDRP.

f. Summary of How the FAA will Distinguish Information Protected under Part 193 from Information the FAA Receives from Other Sources. In accordance with AC 00-58, all VRDP submissions must be clearly identified as such by the regulated entity making the submission. Any other information received by the FAA from the regulated entity concerning the content of a VDRP submission must be clearly labeled as follows to be eligible for protection under this designation: “WARNING: The Information in this Document is Protected from Disclosure under 49 U.S.C. 40123 and 14 CFR part 193.” If the information is submitted electronically, the warning notice must be appropriately embedded in the electronic submission in a fashion that assures the visibility of the warning to any viewer.

7. Designation

The FAA designates the information described in paragraph 5b of this order to be protected from disclosure in accordance with 49 U.S.C. 40123, and 14 CFR part 193, when obtained by the FAA pursuant to an accepted VDRP submission.

Appendix 1.—Summary of Significant Comments Received and the FAA's Response

A proposed Federal Aviation Administration (FAA) order designating Voluntary Disclosure Reporting Program (VDRP) information as protected from disclosure under Title 14 of the Code of Federal Regulations (14 CFR) part 193 was published in the Federal Register on May 25, 2006 (Federal Register, Volume 71, Number 101, pages 30094—30097). Comments were received from five commenters, including two major trade associations, and two large manufacturers. All commenters supported the FAA proposed action to protect VDRP information from disclosure under 14 CFR part 193. However, some commenters provided additional recommendations concerning the proposed FAA action. These comments and the FAA responses are as follows:

1. Documents that the FAA generates in response to a voluntary disclosure should be exempt from public disclosure.

a. Comment.

(1) We agree with the proposed findings in the order. They describe in some detail the FAA's reasoning for the program and its operation. These conclusions fulfill the findings requirement of 49 U.S.C. 40123(a), which is the statutory foundation for the VDRP.

(2) We, however, urge that the scope of the VDRP be clarified in one important respect. Documents that the FAA generates in response to a carrier's voluntary disclosure, such as Letters of Correction, should be exempt from public disclosure. The self-reporting that the VDRP encourages will be imperiled if agency documents tied to a disclosure are subject to public release. For that reason, we urge that the final order that the FAA issues in this docket make clear that the agency's work product that could identify a carrier be designated as exempt from disclosure. The same policy should also apply to carrier disclosures made under AC 121-37, which contains the voluntary disclosure reporting program for hazardous materials.

b. The FAA Response. The FAA concurs that the recommendation in the comment is consistent with the intent of this order. FAA generated documentation that is directly associated with an accepted VDRP submission has now been explicitly listed in the FAA order as protected from disclosure under part 193.

2. The proposed provision that the FAA may disclose independently obtained information related to any event disclosed in a VDRP report may undermine the purpose of the VDRP.

a. Comment. The [production certificate holder] supports the intent of the Proposed Order to protect information from disclosure. However, [the production certificate holder] has the following comment relating to the Proposed Order: “The FAA may disclose independently obtained information relating to any event disclosed in a VDRP report.” We recommend this sentence be removed from the Proposed Order because it could potentially undermine the purpose of the VDRP. For example, a certificate holder's proprietary information should not be disclosed outside of established processes under FOIA, regardless of the source of the information. In addition, there are circumstances under which the FAA may disclose information it believes was independently obtained when, in fact, it had already been provided to the FAA by the certificate holder. For example, the certificate holder could have disclosed the information to a local FAA office, and subsequently the same or related information could have been obtained by another FAA office from another source; in this situation, the second FAA office could disclose without knowing the first FAA office already had the information.

b. The FAA Response. The FAA does not concur. The FAA routinely receives proprietary information. When such proprietary information is submitted to any FAA office, whether associated with a voluntary disclosure or otherwise, it will be protected from disclosure to the extent permitted by law and with associated long standing FAA policy, provided that the propriety claim concerning that information is prominently displayed in the submission, as is a standard procedure in such cases. With regard to the example cited (in which information voluntarily disclosed to a local FAA office might also have been obtained by another FAA office “from another source”): if the other source did in fact entail information independently obtained by the FAA (as could occur, for example, through FAA surveillance activities, or through an independent FAA investigation, or through third party notification to the FAA), then the fact that such information was also contained in a voluntary disclosure would not ordinarily warrant the protection from release of that information independently obtained by the FAA. FAA policy prohibits acceptance of a submission under the VDRP when the FAA has already learned of the violation on its own. In that example, therefore, if the FAA had obtained this information from another source prior to the VDRP submission, then FAA VDRP policy would preclude acceptance under the VDRP. If, however, the “other source” for information received by the FAA is in fact the production approval holder that submitted the same information in an associated voluntary disclosure, or submitted it outside of a voluntary disclosure wherein the relevance of the information to the regulatory violation was not recognized by the FAA or the production approval holder at the time, it is incumbent upon the submitter to alert the FAA to that fact. To accommodate that hypothetical situation, the language in paragraph 6e of this order now states: “The FAA may disclose independently obtained information relating to any event disclosed in a VDRP report, unless the FAA determines that in the case of an accepted VDRP submission, release of such independently obtained information would be inconsistent with the provisions of this order, or would otherwise be prohibited by public law or regulation”. For accepted submissions under the VDRP, the information contained therein must be protected from disclosure in accordance with the provisions of this FAA order and 14 CFR part 193.

3. The proposed text that suggests or allows release of disclosure information that has been obtained from another source, beyond the control of the “regulated entity,” should be struck from the proposed FAA order.

a. Comment: [The production certificate holder] has similar reservations as those voiced by another production certificate holder, who also has provided comments to this same proposed order: The proposed text that suggests or allows release of disclosure information that has been obtained from another source, beyond the control of the “regulated entity,” should be struck from the proposed FAA order. To adhere to the requirements of FAA Order 2150.3, Compliance/Enforcement Bulletin 92-2, Advisory Circular 00-58 and 121-37, and to assure that the intent of the VDRP remains robust and without reservation, the production approval holder must step up and be accountable to ensure that immediate and long term corrective action plans developed to mitigate the circumstances of an escape are sound, effective, and implemented as pledged. The “regulated entity” does not have control of information sources outside the chain of the disclosure proper. By the same token, the “regulated entity” making the disclosure actually becomes the expert and information funnel for all factual matters associated with the disclosure. In sum, we consider that provisions for release of information without the counsel of the regulated entity would undermine the intent of the VDRP. It could allow information to be made public that could have negative connotation for, and actually hamper, ongoing investigations and airworthiness evaluations associated with the disclosure.

b. The FAA response. The FAA does not concur. There are at least two situations in which the FAA cannot assure independently obtained information relating to a voluntary disclosure will not be released. One such situation occurs when a regulatory violation, initially identified in a VDRP submission, is not accepted by the FAA, or if accepted, is later excluded by the FAA, because of the regulated entity's failure to comply with the requirements of the VDRP. In such situations the FAA will conduct an independent investigation of the event, and if warranted, the resulting enforcement record based on the information independently obtained by the FAA is subject to disclosure under FOIA. No change in that policy is deemed necessary or appropriate. Another circumstance under which independently obtained information relating to an event reported under the VDRP may not be fully protected by the FAA occurs when an outside party has observed and reported a regulatory violation to the FAA. In such situations, the FAA must be permitted to assure the reporting party that the FAA has responded to their report(s) and that action has been taken to prevent recurrence of the violation. Such action is necessary to maintain public confidence. The comment expresses concern about the release of information from another source beyond the control, and outside of the chain of command, of the regulated entity. Clearly the FAA also has no control over the submission to the FAA of information related to the voluntary disclosure by a source outside the control or chain of command of the regulated entity. The FAA does not believe that such independently obtained information would ordinarily qualify for protection from public release under this order and part 193. However, in order to accommodate a hypothetical situation in which protection from release is warranted, paragraph 6e of this order now states: “The FAA may disclose independently obtained information relating to any event disclosed in a VDRP report, unless the FAA determines that in the case of an accepted VDRP submission, release of such independently obtained information would be inconsistent with the provisions of this order, or would otherwise be prohibited by public law or regulation.”

4. Depending upon how the proposed right of disclosure is interpreted and put into practice, the following proposed provision could have a negative impact on encouraging voluntary disclosure: “The FAA also may disclose any information about a disclosure initially submitted under the VDRP that is not accepted, or accepted, but later excluded because of the regulated entity's failure to comply with the criteria of the VDRP.”

a. Comment. [The company] recommends that this sentence be removed from the Proposed Order because, depending upon how the proposed right of disclosure is interpreted and put into practice, it could potentially have a negative impact upon sound FAA policy encouraging voluntary disclosure of information by certificate holders. For example, the local FAA office has approved [the company's] procedure for submittal of voluntary disclosures meeting the intent of AC 00-58. [The company] has various data systems to track information drawn from different databases. Such information drawn from multiple sources could be included in a voluntary disclosure. In that circumstance, the information and the format in which the information is provided meets the intent of the VDRP, but would not necessarily strictly comply with every technical requirement of AC 00-58, where the VDRP criteria is contained. As noted above, the local FAA office has approved a [company] procedure for submittal of voluntary disclosures that meets the intent of AC 00-58. However, if this sentence remains in the Proposed Order, then the FAA could decide to disclose information submitted in connection with a voluntary disclosure because of a technical deviation from the criteria in AC 00-58. If this occurs, certificate holders could potentially be disincentivized [sic] from providing the FAA with information because of the possibility of disclosure absent discussion and consensus. [The company] believes a better practice would be to permit local FAA offices to maintain flexibility to work with certificate holders relating to the format in which information voluntarily disclosed is received.

b. The FAA Response. The FAA does not concur. Nothing in this order changes the discretionary authority of a local FAA office to accept or reject a voluntary disclosure. Information contained in an accepted voluntary disclosure will be protected in accordance with the provisions of this order and 14 CFR part 193, regardless of its format. The FAA acknowledges industry concerns regarding sensitive information. This FAA order will establish explicit protections concerning disclosure of such information when it is provided in conjunction with an accepted VDRP submission.

Issued in Washington, DC, on August 17, 2006.

James J. Ballough,

Director, Flight Standards Service.