Protection of Voluntarily Submitted Information

[Federal Register Volume 66, Number 122 (Monday, June 25, 2001)] [Rules and Regulations] [Pages 33792-33808] From the Federal Register Online via the Government Publishing Office [www.gpo.gov] [FR Doc No: 01-15853]

[[Page 33791]]

-----------------------------------------------------------------------

Part III

Department of Transportation

-----------------------------------------------------------------------

Federal Aviation Administration

-----------------------------------------------------------------------

14 CFR Part 193

Protection of Voluntarily Submitted Information; Final Rule

Federal Register / Vol. 66, No. 122 / Monday, June 25, 2001 / Rules and Regulations

[[Page 33792]]

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 193

[Docket No. FAA-1999-6001; Amendment No. 193-1] RIN 2120-AG36

Protection of Voluntarily Submitted Information

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The FAA is adding a new part to its regulations to provide that certain safety and security information submitted to the FAA on a voluntarily basis will not be disclosed. This rule implements a new statutory provision. It is intended to encourage people to provide information that will assist the FAA in carrying out its safety and security duties.

DATES: Effective July 25, 2001.

FOR FURTHER INFORMATION CONTACT: Marisa Mullen, Office of Rulemaking, ARM-205; or Mardi Ruth Thompson, Office of Assistant Chief Counsel, AGC-200, Federal Aviation Administration, 800 Independence Avenue, SW., Washington, DC 20591, telephone (202) 267-7653 or (202) 267-3073, respectively.

SUPPLEMENTARY INFORMATION:

Availability of Rulemaking Documents

You can get an electronic copy using the Internet by taking the following steps: (1) Go to the search function of the Department of Transportation's electronic Docket Management System (DMS) web page (http://dms.dot.gov/search). (2) On the search page type in the last four digits of the Docket number shown at the beginning of this notice. Click on ``search.'' (3) On the next page, which contains the Docket summary information for the Docket you selected, click on the document number for the item you wish to view. You can also get an electronic copy using the Internet through FAA's web page at http://www.faa.gov/avr/arm/nprm/nprm.htm or the Federal Register's web page at http://www.access.gpo.gov/su_docs/aces/aces140.html. You can also get a copy by submitting a request to the Federal Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence Avenue SW., Washington, DC 20591, or by calling (202) 267-9680. Make sure to identify the docket number, notice number, or amendment number of this rulemaking.

Small Business Regulatory Enforcement Fairness Act

The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires FAA to comply with small entity requests for information or advice about compliance with statutes and regulations within its jurisdiction. Therefore, any small entity that has a question regarding this document may contact their local FAA official, or the person listed under FOR FURTHER INFORMATION CONTACT. You can find out more about SBREFA on the Internet at our site, http://www.gov/avr/arm/sbrefa.htm. For more information on SBREFA, e-mail us at [email protected].

Background

Statement of the Problem

The FAA is committed to make continuing improvements in aviation safety and security. To do so, the FAA must have an increasing amount of information regrading current safety and security systems and how they are functioning today. The FAA is developing information-sharing programs in which persons in the aviation community may share with the FAA information related to safety and security. In one such program, Flight Operations Quality Assurance (FOQA), participating air carriers routinely collect data from flight data recorders and perform trend analyses, which are made available for FAA inspection. See the General Statement of Policy, 63 FR 67505 (December 7, 1998), and the Notice of Proposed Rulemaking, 65 FR 41528 (July 5, 2000). In the Aviation Safety Action Program (ASAP), certain employees for participating air carriers or major repair stations voluntarily report safety issues and events. ASAP is described in Advisory Circular 120-66A. An impediment to further development of voluntary information sharing programs is the reluctance of some persons to share information that, when in the hands of a government agency, may be required to be released to the public through FOIA or other means. There is a strong public policy, and laws such as the Freedom of Information Act (FOIA) (5 U.S.C. 552), in favor of Federal agencies releasing information to the public, to ensure that the public is informed as to how the government is doing business. Carriers participating in FOQA will not permit the FAA to remove information from their premises for further study, because the carriers do not want the information from their premises for further study, because the carriers do not want the information subject to disclosure by the FAA under FOIA or other laws. The Federal Aviation Reauthorization Act of 1996 (Pub. L. 104-264) provides relief from these concerns by adding new section 40123 to Title 49, United States Code. The new section provides:

(a) IN GENERAL.--Notwithstanding any other provision of law, neither the Administrator of the Federal Aviation Administration, nor any agency receiving information from the Administrator, shall disclose voluntarily-provided safety or security related information if the Administrator finds that-- (1) The disclosure of the information would inhibit the voluntary provision of that type of information and that the receipt of that type of information aids in fulfilling the Administrator's safety and security responsibilities; and (2) Withholding such information from disclosure would be consistent with the Administrator's safety and security responsibilities. (b) REGULATIONS.--The Administrator shall issue regulations to carry out this section.

In the legislative history, Congress cited the data-sharing programs being developed that could help improved safety by allowing the FAA to spot trends before they result in accidents. It noted the concern in the aviation community about the confidentiality of the data. ``Much of the information could be incomplete, unreliable, and quite sensitive. There will be a reluctance to share such information if it will be publicly released because it could easily be misinterpreted, misunderstood, or misapplied.'' H.R. Rep. No. 104-714, 104th Cong., 2d Sess. 41. Congress noted that protecting this information from public disclosure will not reduce the information available to the public, because the information is not provided to the public now. It further noted that the information ``should be useful in the development of safety policies and regulations.'' H.R. Rep. No. 104-714, 104 Cong., 2d Sess. 42. In addition, in the February 23, 1997 final report, the White House Commission on Aviation Safety and Security issued a recommendation on this subject. In Recommendation 1.8 the Commission noted that the most effective way to identify problems is for the people who operate the system to self-disclose the information, but that people will not provide information to the FAA unless it can be protected. It

[[Page 33793]]

recommended that the FAA expeditiously complete rulemaking to implement the legislation for protecting voluntarily provided information. Section 40123 reflects a recognition that there is a significant benefit to providing exceptions to the laws and policies calling for release of information in order for the FAA to receive additional safety and security information that it is not now receiving. On July 26, 1999, the FAA published a Notice of Proposed Rulemaking setting out how the FAA would implement this new authority (64 FR 40472.) After review of the comments, this final rule carries out section 40123. The FAA anticipates that information received in programs under this part will be used to carry out the FAA's safety and security responsibilities in a number of ways. These may include identifying potentially unsafe conditions and appropriate corrective action identifying a need for and the contents of rulemaking, identifying a need for and the contents of policies, and identifying a need for an investigation or inspection. It should be noted that there are several interrelated policy decisions that the FAA makes when it establishes an information sharing program. For instance, enforcement policy--what use the FAA will make of the information to take enforcement action--is of prime interest to persons who may be interested in submitting information. A favorable enforcement policy may encourage more participation. Information sharing programs also generally include procedures for corrective action to be taken if the information reveals a need. Part 193 does not dictate the enforcement policy and corrective action procedures for an information sharing program. However, if enforcement action or corrective action based on information received under part 193 may result in disclosure of information that is protected, the order designating the information as protected must state the circumstances under which this might happen.

Discussion of Comments and Section-by-Section Analysis

The FAA received some 34 comments on the proposed rule. The commenters included air carriers (America West Airlines, Continental Airlines, Inc., Northwest Airlines, Inc., Comair), airport operators (Denver International Airport, The Port Authority of New York and New Jersey), representatives of employees (Air Line Pilots Association, Association of Professional Flight Attendants, Independent Association of Continental Pilots, International Brotherhood of Teamsters), the media (USA Today, The Reporters Committee for Freedom of the Press, The Washington Post, The New York Times Company), associations (National Air Carrier Association, Inc., Air Traffic Control Association, Inc., Air Transport Association of America, American Association of Airport Executives, Airports Council International--North America, Regional Airline Association, OMB Watch), Embry-Riddle Aeronautical University, the National Transportation Safety Board, and individuals. The comments are discussed below along with the provisions of the final rule.

The Rule in General

Proposal: The proposed rule was intended to furnish a way for people to provide information to the FAA for safety or security purposes, yet protect the information from disclosure to others (with exceptions discussed below). Section 40123 requires that the FAA and other agencies not release information that meets the standards in the statute and implementing rules. The information that is protected is defined in section 40123 as information that is voluntarily provided and that is safety or security related. Section 40123 requires that the Administrator make certain findings before its protections apply. The FAA proposed to add a new part 193 that would describe how the Administrator would determine that the requirements of section 40123 are met, thereby making the information protected from disclosure. Comment: A number of commenters state that the best way to identify problems is let industry self-disclose. They state that if the data were released to the general public it could be misinterpreted or misused, which discourages the industry from submitting it to the FAA without protection. The National Transportation Safety Board strongly endorses programs that encourage the provision and sharing of safety information and supports the proposed rule. It states that similar regulations govern the Safety Board's handling of voluntarily provided information. FAA response: The FAA agrees that letting industry self-disclose can be a highly effective means for the FAA to gather safety and security information. Comment: A commenter states that withholding information because ``it could be misinterpreted or misused'' is not appropriate and is paternalistic. FAA response: The FAA agrees that the industry's concern that the public would misuse the information is not, in itself, grounds for the FAA to withhold it from public disclosure. However, section 40123 is not ``paternalistic.'' It responds to the industry's reluctance to submit information if ``it could be misinterpreted or misused,'' not the FAA's concerns. We will not receive this valuable information if the industry continues to have concerns about release of the information to the general public. Comment: Some commenters note the strong public interest in disclosure and in monitoring how the FAA is performing its duties. They point out that public confidence in how the agency handles safety issues is important and should be promoted by full disclosure. They sate that the public needs to be able to monitor safety and how to the government is responding to safety concerns. FAA response: The FAA agrees with these statements. However, in order to make more progress in aviation safety, the FAA must acquire much information from the industry. In addition to the public interest in disclosure, the FOIA and other disclosure laws have long made exceptions to disclosure, including to protect various private interests. Section 40123 made such an exception. Comment: Some commenters believe that the FAA should require by rule that safety and security information be submitted, and that the FAA should not request that it be submitted voluntarily. FAA response: The FAA agrees that it must, in each case, consider whether safety and security will best be served by mandatory reporting or by voluntary submission of information. We acknowledge, and section 40123 reflects, that voluntary cooperation between industry and the government often produces a more robust exchange of information and ideas, leading to more valuable insights. When the private sector is required by rule to report, it tends to report exactly what is required and nothing more. We recognize that people in the industry know a great deal of information that is valuable, and feel that in many cases we will have the most effective exchange of information and ideas if it is under a voluntary program rather than mandated. Further, the Final Report of the White House Commission on Aviation Safety and Security, issued on February 12, 1997, strongly urged that the FAA work in partnership with industry to develop the most effective ways to improve safety and security. Comment: Some urge that the FAA release de-identified, summarized versions of the information that will be submitted to the FAA under part 193.

[[Page 33794]]

FAA response: The FAA agrees that for each program under part 193 it will consider whether de-identified, summarized versions of the information can be released while maintaining an effective information sharing program. However, the industry was concerned that even de- identified information ``could be misinterpreted or misused,'' which was a basis for section 40123. It thus appears that if the FAA committed to releasing de-identified, summarized information in each case, we would have less participation. For each program the FAA will determine what we can release and have strong participation from submitters. The circumstances under which the FAA will disclose the information will be stated in the designation for each information sharing program so participants will know what to expect. Comment: Several commenters state that the FAA can obtain all necessary information now, and that people can and will report safety and security information, and can report anonymously if they wish. FAA response: It is true that over the years the FAA has received quite a bit of voluntarily provided information without providing any protection against disclosure of the information. The ability of the FAA to receive such information will not change, and the FAA expects to continue to receive such information without regard to part 193. However, we see that the industry will not submit some important information without the protections afforded under section 40123, such as the information in FOQA. Industry will not fully submit that information unless the FAA can provide protection against release. It is also true that people now can submit information anonymously. There are limits to the usefulness of such information, however. The information is in the form the commenter wishes, and there is little opportunity for the FAA to ask questions and clarify details. There also is no chance for the FAA to require that the person reporting take corrective action. Further, anonymous information is wholly inadequate for the FAA to obtain detailed technical data on a routine basis such as is involved in FOQA. Indeed, one of the most useful features of the FOQA program is that FAA experts can work closely with industry experts to extract and analyze safety information. This could not be done on an anonymous basis. Comment: Some state that the rule would allow industry to hide safety problems. FAA response: To the contrary, this rule will encourage industry to report safety information that otherwise the FAA would not hear about. This will give the FAA the opportunity to analyze it and initiate corrective measures when needed. The rule will not give the industry any new means to hide information. Comment: Several commenters noted that the rule does not address whistleblowers and the need to protect them if they report safety or security issues to the FAA. A commenter states that the rule should provide for protection of persons who report on an individual basis. FAA response: The proposed rule, and the final rule, provide for submission of information by any person, including individuals. It is true that the proposed rule did not include protection from retaliation from employers and others, that is, ``whistleblower'' protection. That was beyone the scope of sec. 40123 and this rulemaking. However, section 519 of the Wendell H. Ford Aviation Investment and Reform Act for the 21st Century (FAIR-21) (Pub. L. 106-181, new 49 U.S.C. 42121) does provide protection for employees of air carriers, contractors, and subcontractors who provide information to the Federal government regarding safety violations. Under this final rule, air carrier or contractor employees could submit safety or security information to the FAA and have their names designated as protected from disclosure. FAIR-21, in turn, would protect the employees from retaliation from the air carriers or contractors if they found through another means that the individuals had reported the problem. Comment: One commenter states that the FAA must have sophisticated, user friendly, networked computer systems that can be the conduit and repository of voluntarily disclosed data. FAA response: The FAA agrees that we must develop secure computer systems for voluntarily submitted safety related information. The design and development of such systems are already underway. Comment: One commenter states that the FAA should review all voluntary information programs to form a cohesive and consistent policy. The commenter states that there are subtle differences between existing programs that are confusing. FAA response: The FAA does have several programs (such as ASAP, ASRP, and the Voluntary Reporting Program under Advisory Circular 00- 58). While the programs all have the common goal of obtaining safety information, each program has different objectives and uses different methods to obtain that information from specified persons within the aviation community. The policies and procedures that govern each program are geared toward the program's objectives and what is necessary to make it effective. These are explained in advisory circulars, which are available to persons who may be covered under the programs and to any other interested persons. The FAA believes that each program must be unique to best accomplish its goals.

Section 193.1 What Does This Part Cover? (Proposed Sec. 193.1(a) Scope and Delegations)

Proposal: This section explained that part 193 implements 49 U.S.C. 40123, protection of voluntarily submitted information. It also provided for delegation of the authority under this part, which has been moved to new Sec. 193.15 and discussed under that section. No comments were received on this section. It is adopted essentially as proposed.

Section 193.3 Definitions

Proposal: This section proposed definitions for some of the terms used in part 193. Agency: No comments were received on this definition and it is adopted as proposed. Section 40123 refers to ``any agency receiving information from the Administrator,'' but does not define ``agency.'' There are many definitions of that term in the United States Code. It appears that in this context, the most appropriate definition is essentially the one in the Administrative Procedure Act, 5 U.S.C. 551(1). This part uses a simplified version of this definition. It defines ``agency'' as each authority of the Federal Government of the United States, whether or not it is within or subject to review by another agency, but does not include--(A) the Congress; (B) the courts of the United States; (C) the governments of the territories or possessions of the United States; (D) the government of the District of Columbia; or (E) court martial and military commissions. This definition would permit the FAA to give information to the National Transportation Safety Board (NTSB), and to other agencies such as the FBI, in the interest of safety or security. See discussion of Sec. 193.5(d). De-identified: Two comments were received on this definition. The comments are discussed under newSec. 193.9(a)(1) (proposed Sec. 193.7(a)(1)). The definition is adopted as proposed. This rule provides for some limited disclosure of ``de-identified'' information, which is defined to mean that the identity of the source of the information and the names

[[Page 33795]]

of persons are removed from the information. Under Part 1, ``person'' is broadly defined to include not only individuals, but also such entities as companies and firms. Thus, information from an air carrier that is ``de-identified'' will not include the name of the air carrier or the names of any crewmembers, maintenance personnel, repair stations, or other persons that may have been in the original information. It will also not include street addresses, phone numbers, or e-mail addresses. Disclose: No comments were received on this definition and it is adopted as proposed. Section 40123 provides that ``notwithstanding any other provision of law,'' the FAA and other agencies shall not ``disclose'' information under specified circumstances. By referring to ``any other provision of law,'' it appears that ``disclose'' was meant to be read broadly to cover all circumstances under which the FAA and other agencies might otherwise be required or permitted to disclosure information. ``Disclose'' is defined broadly to mean the release of information or a portion of information to other than another agency. Release to another agency, such as the NTSB, would not be considered disclosure under this rule, because section 40123 states that other agencies are under the same requirements as the FAA not to disclose the information. The most common definition of disclosing agency information generally arises in connection with release under the FOIA. ``Disclose'' in this regulation also includes release in rulemaking proceedings, in a press release, or to a party in a legal action. In some legal actions, such as some enforcement actions or criminal prosecutions, the rule permits disclosure of the information. See the discussion of new Sec. 193.9. Information: The definition of ``information'' in the proposed rule included ``data, reports, source, and other information.'' One commenter is concerned about those provisions of the rule that would allow for disclosure of de-identified, summarized information to explain rulemaking or policy (proposed Sec. 193.7(a)(1), new Sec. 193.9(a)(1)). The commenter is concerned that the wording of the rule could be interpreted to mean disclosure of underlying data. The commenter notes that the input element ``data'' transformed into useful ``information'' following appropriate analysis. The commenter states that if this distinction were incorporated within the rule, then disclosure of de-identified summarized ``information'' might be acceptable. It is not the FAA's intent in this rulemaking to require the release of underlying data for the purpose of explaining new rules or policies based on information submitted under part 193. The FAA acknowledges that were it to do so, continued participation in voluntary safety data reporting programs would be unlikely. New Sec. 193.9(a)(1) also includes the terms ``de-identified'' and ``summarized.'' Summarized means that individual incidents are not specifically described, but are presented in statistical or other more general form. De-identified means that the identity of the source of the information, and the names of the persons, are removed from the information. Taken together, the rule does in fact meet the commenter's concerns, in that underlying data will not be disclosed, that disclosed information will be in the form of generalizations or statistical summaries, and that any such disclosures will not reveals the source of the information. We also note that Congress intended ``information,'' as used in section 40123, to be read broadly. The legislative history refers to ``data sharing programs.'' H.R. Rep. No. 104-714, 104th Cong., 2nd Sess., 40-41. A change to the definition of ``information'' to preclude ``data'' might prevent the FAA from developing programs in which raw data were submitted to the FAA for analysis. The FAA wishes to retain the ability to have such programs under part 193. Summarized: No comments were received on this definition and it is adopted as proposed. ``Summarized'' information means that individual incidents are not specifically described, but are presented in statistical or other more general form. Summarized information might be used in rulemaking, for instance, to explain the need for the rule. Voluntary: Several commenters state that ``voluntary provided information'' should be limited to information that cannot otherwise be obtained. However, the limited availability of the information is a factor in section 40123(a)(1) (and appears in new Sec. 193.7(b)(3)). It is unnecessary to add this to the definition of ``voluntary.'' Section 40123 protections apply only to information submitted voluntarily. ``Voluntary'' is defined in this rule to mean that the information was submitted without mandate or compulsion, and not as a condition of doing business with the government. It does not include information submitted as part of a means of complying with statutory, regulatory, or contractual requirements. Under this definition, information that is required to be submitted under a regulation would not be considered voluntarily provided. If a regulation gives several options for compliance, information provided as part of complying with any option chosen is not voluntarily provided. The definition of ``voluntary'' also provides that a program under this part may be published in the Code of Federal Regulation (CFR) and the information submitted under it will be considered ``voluntarily provided.'' The FAA anticipates that some programs adopted under Sec. 193.9 may be published in Title 14 of the Code of Federal Regulations (CFR). Other programs may be adopted as notices that are published in the Federal Register but not incorporated into the CFR. The definition of ``voluntary'' is intended to make clear that a part 193 program can be published in the CFR without destroying its voluntary nature. For example, the CFR may contain a voluntary program under which participants must submit specified information in order to continue participation in the program. This participation, however, is voluntary, and the information is considered voluntarily submitted and protected under part 193. They may stop participating in the program at will. The FAA has various arrangements under which it receives information from foreign authorities, generally under a bilateral agreement. Whether such information would be considered to be ``voluntarily provided'' would depend on all of the circumstances. For instance, in some cases the foreign country inspects an FAA- certificated repair station, production certificate holder, or other FAA-regulated party to determine whether it is in compliance with applicable rules and requirements, and forwards its findings to the FAA. The regulated party is required to submit to such inspections, and thus the information is not voluntarily provided by the regulated party any more than information obtained during an inspection by FAA personnel would be voluntarily provided. In other cases, the information provided by a foreign authority might be considered voluntarily provided.

Section 193.5 How May I Submit Safety or Security Information and Have It Protected From Disclosure? (Not Proposed)

This section was not proposed, but has been added to the final rule to provide an overview of how the process works. Section 193.5(a) explains that a person may submit information under a program under this part. The program

[[Page 33796]]

may be developed based on the person's proposal, a proposal from another person, or a proposal developed by the FAA. Section 193.5(b) makes clear that the person may be an individual, a company, an organization, or any other person. Section 193.5(c) points out that the person may propose to develop a program under this part using either the notice procedure in Sec. 193.11 or the no-notice procedure in Sec. 193.13. Paragraph (d) states that if the FAA decides to protect the information that the person proposes to submit, it issues an order designating the information as protected under this part. Section 193.5(e) states that the FAA only designates information as protected if the FAA makes the findings in Sec. 193.7. Paragraph (f) explains that the designation may be for a program in which all similar persons may participate (referred to as a ``national'' program in the NPRM), or for a program in which only one person submits information. Section 193.5(g) explains that even if the person receives protection from disclosure under this part, this part does not establish the extent to which the FAA may or may not use the information to take enforcement action. Limits on enforcement action, if any, for a given program under this part will be in another policy or rule applicable to that program.

Section 193.7 What Does It Mean for the FAA to Designate Information as Projected? (Proposed Sec. 193.5 Withholding Information From Disclosure)

Proposal: This section proposed the general provisions for withholding information from disclosure. Section 19.35(a) proposed to provide that, except as provided in this part and in individual programs, the FAA does not disclose voluntarily provided safety or security information that has been designated as protected under this part. It set out the findings that must be made under section 40123, and described how the FAA would deal with sharing information with other agencies, disclosing information if the submitter agrees, and responding to subpoenas. Comment: A number of commenters discuss what they believe the appropriate scope of the protected information should be. Several state that the FAA should only protect information that will discourage further reporting if it is released, and that the FAA should limit the information covered by this rule to the extent possible. One states that if a submitter provides additional data and reports, they should be released unless there was a substantial reason to believe that release would lead the submitters to refuse to submit information in the future. The commenter states that withholding information should not be a ``rubber-stamp operation.'' Another commenter believes that the FAA will make findings to protect information post-hoc, after it is submitted. FAA response: The FAA agrees that the protection afforded under this part must be limited, and that the FAA may only protect information that will discourage further reporting if it is released. That is what is called for in section 40123. However, the FAA usually must decide what information to protect at the time the designation is issued, not after the program is underway. The protection is based on the idea that we will not receive the information without this protection, and submitters must have predictability--they must know ahead of time whether their information will be protected. The findings set out in section 40123 and new Sec. 193.7 will be made when the designation is issued. In the normal case, the designation will cover only information that will be submitted after the designation is issued. However, there may be some instances in which industry has begun voluntarily submitting limited information with the understanding that Exemption 4 of the FOIA applies (relating to trade secrets and commercial or financial information obtained from a person and privileged or confidential), and in anticipation that the FAA would consider protecting it under section 40123 (which is an Exemption 3 statute). In such cases, the FAA may use the notice process in Sec. 193.11 to consider whether to apply these protections to information already submitted to the FAA. Comment: Section 40123 provides for protection if ``disclosure of the information would inhibit the voluntary provision of that type of information.'' In the Notice, the FAA interpreted ``inhibit'' to mean to discourage or to repress or to restrain, but not to mean to prevent the submission of information. (64 FR at 40474.) Some commenters object to this interpretation, and one calls for an objective standard. FAA response: The FAA agrees that it must use sound discretion in determining whether this element of section 40123 is met, but it is not possible to have a truly objective standard. The FAA must evaluate the possible action of the persons who hold the information and determine whether they might provide the information without the non-disclosure protection. We note the legislative history that refers to the FAA withholding voluntarily provided information if disclosure would ``discourage'' people from providing it. H.R. Rep. No. 104-714, 104th Cong., 2d Sess. 49. Indeed, the first choice for the FAA would be to receive the information with no strings attached, without going through the process in part 193, because that would be far easier. The FAA will only use part 193 when it is apparent that this is the only way to obtain information that is likely to be of significant benefit in meeting the FAA's safety or security duties. Comment: A commenter requests that we add to the end of proposed Sec. 193.5(b)(5) (new Sec. 193.7(b)(5)) that, in making the determination on whether withholding information from disclosure is consistent with the FAA's safety and security duties, the FAA shall take into account the public interest in disclosure of safety and security information. FAA response: We do not believe it is appropriate to place this factor in Sec. 193.7(b)(5), which is essentially repeating section 40123(a)(2). Section 40123 and part 193 strike a balance between the release of government-held information and the interests of the private sector in preventing full disclosure of its information. Congress has determined that there are limited circumstances under which the safety and security of the public are enhanced by the Federal government committing to withhold information from disclosure. Comment: Some commenters believe there are insufficient controls on when the FAA can release information to other agencies. One suggests that the same process used for subpoenas be used, that is, the FAA should contact the submitter before releasing information to another agency. FAA response: We cannot commit to contacting the submitter before each release to another agency. We cannot predict all circumstances under which information may be released to another agency. However, under new Sec. 193.7(e), the other agency will have to commit in writing to protect the information from disclosure in accordance with section 40123, this part, and the designation. In response to commenters' concerns, the new rule expands the commitments we request from the other agency. Under this process sharing information with other agencies will not be a casual matter. Comment: One commenter states that the FAA should take the position that it will not disclose voluntarily submitted information in response to a subpoena.

[[Page 33797]]

FAA response: The FAA concurs that if information is designated as protected under this part, the FAA should not disclose the information unless both the submitter and the FAA agree to disclosing the information, or the court orders disclosure. The final rule has been changed to reflect this, see the discussion of new Sec. 193.7(g) below. Comment: One commenter, an attorney in private practice, describes difficulties he encountered in discovering information regarding the type certification process for a large transport category aircraft. He expresses concern that the part 193 process would make it harder for litigants in tort cases to obtain information necessary to pursue their cases. FAA response: Part 193 will have no impact on discovery of type certification data. Such information will not be under part 193. First, to the extent such data is submitted to the FAA in connection with an application for a type certificate, it is not ``voluntarily'' submitted, because it is submitted to show compliance with FAA rules. Second, much of the data is never submitted to the FAA, it is only kept by the holder of the type certificate and made available to the FAA for inspection. Parties must seek such information from the type certificate holder, not the FAA. Litigants will continue to use normal discovery rules to seek such data in litigation. New part 193 will not affect how these matters are handled. New Sec. 193.7: This section describes what it means for the FAA to designate information as protected under part 193. The protections of this part apply only to information covered under a designated program, because the Administrator must make findings in accordance with section 40123 before the protections are invoked. Section 193.7(a) provides that, except as provided in this part and in individual programs, the FAA does not disclose voluntarily provided safety or security information that has been designated as protected under this part. Section 193.7(b) states the elements for the FAA's designation of a program under this part. It includes the elements that are in section 40123. Section 193.7(b)(1) requires a finding that the information would be provided voluntarily. Only information that is provided voluntarily may be protected under section 40123. Some information that is provided other than voluntarily may receive protection under other laws, such as exceptions to the FOIA. Section 193.7(b)(2) requires a finding that the information is safety or security related. Section 193.7(b)(3) requires a finding that the disclosure of the information would inhibit the voluntary provision of that type of information. The FAA will consider whether the possibility of disclosing the information would sufficiently inhibit the provision of the information to warrant granting the protections of section 40123. Section 193.7(b)(4) requires a finding that the receipt of that type of information aids in fulfilling the FAA's safety and security responsibilities. This generally will be done by describing how the FAA intends to use the information. Section 193.7(b)(5) requires a finding that withholding such information from disclosure, under the circumstances stated in the program, will be consistent with the FAA's safety and security responsibilities. There are circumstances under which disclosure would be consistent with safety and security. They are set out in new Sec. 193.9, and there may be additional circumstances for specific programs. By including the circumstances in the designation, submitters will know ahead of time when their information may be released. In most cases the designation will apply only to information provided after the designation is made. There may be instances, however, when information of that type already has been submitted to the FAA, but that future submissions may be inhibited without further protection. In such cases the FAA might propose to retroactively designate as protected information that it has received already under an information-sharing program. Section 193.7(c) has been added to clearly state the FAA's stance on disclosing part 193 information in response to a FOIA request. The FAA does not disclose information protected under this part in response to a FOIA request. Section 193.7(d) makes clear that only information submitted under a program designated under this part is protected from disclosure as described in this part. The FAA may receive information on a particular incident both under a part 193 program and from another source. Information received by the FAA through another means is not protected under part 193. For instance, the FAA might receive information about an airspace deviation both from air traffic control (ATC) and from a part 193 designated program. The information received from ATC would not be protected under this part while the information received under part 193 would be protected from disclosure. Section 193.7(e) makes clear that the Administrator may provide to other agencies with safety or security responsibilities information submitted under part 193. Section 40123 specifically makes such agencies subject to its requirements regarding nondisclosure of information, and thus clearly contemplates that the FAA may give information to such agencies. For instance, the FAA might share information with the NTSB, and it may be important for security to share information with the FBI or other agencies with security responsibilities. The FAA may be required to share information with agencies that oversee FAA activities. For example, if the FAA drafts a regulation based on voluntarily submitted information, the FAA may provide that information to the Department of Transportation's Office of the Secretary or the Office of Management and Budget in connection with their review of the draft regulation. The FAA will only give the information to another agency if the other agency provides certain written assurances. The agency must state that it has a safety or security need for the information, including the general nature of the need. This might include, for instance, review of draft FAA safety rulemaking, or a criminal investigation involving possible safety or security related violations. The agency also will provide assurance it will protect the information from disclosure, in accordance with section 40123, this part, and the designation, including marking the information as provided in the designation. Further, the agency will assure the FAA that it will limit access to those with a need to know to carry out safety and security responsibilities. The provisions in new Sec. 193.7(e) are intended to give confidence to submitters that their information will not be released to other agencies in an uncontrolled manner that may lead to unauthorized disclosure of the information. Rather, it will be released only for safety and security purposes, with adequate controls to protect it from release. New Sec. 193.7(f) provides the procedure in the event that the FAA receives a subpoena for protected information. This might happen, for instance, in litigation between an air carrier and an individual who alleges he was harmed by the air carrier's negligence. The rule provides that when the FAA receives a subpoena for information designated as protected under this part, the FAA contacts the person who submitted the information to determine whether the submitter objects to disclosure of the information or wishes to participate in

[[Page 33798]]

responding to the subpoena. If the submitter has no objection the FAA would have the option of disclosing the information. If the submitter wanted the information to continue to be protected, that submitter would have the option of participating in the response to the subpoena such as by filing an appropriate motion with the court. The submitter would not be required to participate, however, and may not wish to if that submitter wishes to remain anonymous. New Sec. 193.7(g) provides that if either the submitter or the FAA wish to resist the subpoena the FAA will not release information designated as protected under this part unless ordered to do so by a court of competent jurisdiction. This includes any appeals to higher courts. The FAA will ask the Department of Justice to file the appropriate motion to resist the subpoena or the FAA will file the motion. The rule provides that both the FAA and the submitter must agree to the release of the voluntarily submitted information. If the submitter did not object to releasing the information we usually would release it. However, there may be instances in which the submitter of particular material does not object to its release but release may comprise other aspects of the program, in which case the FAA may decide to continue to protect it from release. In that case, the FAA would resist the subpoena. Note that under new Sec. 193.15 the FAA's decisions to release the information would be made by a high-level official, the same level that can designate information as protected.

Section 193.9 Will the FAA Ever Disclose Information That Is Designated as Protected Under This Part? (Proposed Sec. 193.7 Disclosure of Information)

Proposal: Section 40123(a)(2) requires that, for information to be protected, the Administrator must find that withholding the information would be consistent with safety and security. Some reasons for disclosing information apply to all FAA programs and activities and were described in proposed Sec. 193.7(a). They involve developing new policies and regulations (Sec. 193.7(a)(1)), evaluating or correcting current deficiencies (Sec. 193.7(a)(2)), conducting criminal investigations or prosecutions (Sec. 193.7(a)(3)), and complying with 49 U.S.C. 44905, regarding information about threats to civil aviation (Sec. 193.7(a)(4)). Proposed Sec. 193.7(b) provided for other disclosures in individual information sharing programs. Comment: One commenter states that there appears to be a presumption of non-disclosure, and that the FAA has a responsibility to provide the public with safety and security information. Another commenter believes that the rule appears to have a bias toward disclosure of information. FAA response: The FAA agrees that the intended bias of part 193 is the same bias as for section 40123, that is, to protect the voluntarily submitted information from disclosure, with limited exceptions to promote safety and security. Section 40123 emphasizes the non- disclosure of information received under the circumstances of that statute. It is, in fact, an exemption from the usual laws and public policy calling for disclosing government-held information. However, that statute also provides for disclosure when safety or security requires, and the FAA must disclose in limited circumstances in order to carry out those duties. Comment: One commenter states that disclosure to correct a condition that may compromise safety or security in proposed Sec. 193.7(a)(2) is vague. FAA response: The FAA agrees that clarification of the rule language is appropriate. The rule language is modified to indicate that the FAA retains the discretion to disclose information submitted under this part that compromises safety or security, if that condition continues uncorrected. In many cases corrective action may be accomplished without the FAA disclosing the information. For instance, if the FAA can work with a certificate holder to bring it into compliance without the need for enforcement action, there may be no need to disclose the part 193 information. Comment: One commenter notes that when explaining the need for changes in policies and regulations the FAA is committing only to releasing summarized information. The commenter states that the public may gain a clearer understanding of the safety problem from anecdotal information than from statistical and general information. FAA response: The FAA agrees that the more information, the better the understanding. However, if the FAA does not commit to protecting the details, the information will not be voluntarily submitted. Our commitment to release of de-identified, summarized information in connection with developing new rules and policies is a compromise between releasing nothing (and getting none of the benefits of informed comment on proposed rules and policies) and releasing so much information as to inhibit voluntary submission of information. Comment: One commenter states that there is no need for the FAA to disclose protected information, even information that is de-identified and summarized, in rulemaking. The commenter states that there is no statutory authority to disclose individual pieces of data to support new policies or rulemaking, that generalized findings and conclusions based on aggregated data, or information summaries, are sufficient. FAA response: The proposed rule and new Sec. 193.9(a)(1) provide that individual pieces of data will not be released for this purpose, only summarized, de-identified information. A specific designation may state with more specificity what the FAA will release if we find a need for a new rule or policy based on the protected information. If an air carrier, for instance, is applying for a designation or is commenting on a proposed designation, it may state what it feels is an appropriate level of summarization for the data involved. The FAA recognizes that if the potential submitters are not comfortable with the FAA's commitments in this regard, we will receive fewer voluntary submissions. We understand the argument that under sec. 40123 the FAA has the authority to adopt a new rule based on protected information without disclosing even summarized, de-identified information. However, we believe there is a safety benefit to providing that summarized, de- identified information to the public. The public, including the aviation industry, will be better informed and therefore better able to provide comments to improve the rulemaking decisions. This will also give the industry a better understanding of the need for the new rule and the safety or security issues it is intended to address, leading to more informed compliance. Comment: Several persons commented on the FAA's release of ``de- identified information,'' stating that we must ensure that the source of the information cannot be traced through such items as letterheads and email addresses. FAA response: The FAA agrees that such things as letterheads, e- mail addresses, and other identifying information must not be released. We consider this to be included in the definition of ``de-identified'' where its states ``the identity of the source of the information, * * * are removed * * *.'' Further, only summarized information is released to explain the need for new rules and policies, so that photocopies of the submitted information will not be released. Only

[[Page 33799]]

summarized de-identified versions prepared by the FAA will be released, such as descriptions, charts, or tables of aggregate information. Finally, we note that the details of how this might be done may be worked out for each information sharing program. Submitters may work with the FAA to ensure they are confident in how the information will be handled. Comment: One commenter requests that we change proposed Sec. 193.7(a)(1) and (2) (new Sec. 193.9(a)(1) and (2)) from referring to what the FAA ``may'' disclose, to referring to what the FAA ``shall'' disclose. FAA response: The FAA disagrees. The word ``may'' has been retained in new Sec. 193.9(a)(1) through (4) to indicate that the FAA retains the discretion to disclose the information, but may not necessarily do so in all cases. The FAA must retain latitude to both carry out its safety and security duties and to encourage the submission of voluntarily submitted information. Comment: A commenter asks that proposed Sec. 193.7(a)(2) (new Sec. 193.9(a)(2)) provide for disclosure of information ``to show corrective action already taken to correct'' a condition that may compromise safety or security. FAA response: We do not agree that disclosure under those conditions would be consistent with the requirements of section 40123. New Sec. 193.9 is intended to show circumstances in which withholding information would be inconsistent with safety or security. However, if the condition already has been corrected, there likely is no safety or security need to release the protected information. Comment: Two persons comment on the possible need for the FAA to reveal some part 193 information under proposed Sec. 193.7(a)(2) to design and production approval holders so they can evaluate airworthiness conditions. See 64 FR at 40476. One commenter states that the information should be released only to those with a need to know. Another commenter states that the person receiving the information should be required to refrain from disclosing it. FAA response: We agree that design and production approval holders must protect the information from disclosure. New Sec. 193.17 contains this provision. See the discussion of this section below. Comment: One commenter recommended that any data submitted under part 193 be submitted to an independent third party who would be responsible for maintaining security, archiving, and summarizing the information for the FAA. FAA response: Third party programs are an option for the FAA to obtain safety or security information. The Aviation Safety Reporting Program (ASRP, Advisory Circular 00-46D) is such a program. In ASRP, pilots and others may submit reports of incidents to the National Aeronautics and Space Administration (NASA). NASA in turn analyzes the data and provides reports to the FAA under its Aviation Safety Reporting System (ASRS). This is a valuable program that the FAA expects to continue. The ASRP, however, does not provide for the FAA to interact with the person providing the information or to address corrective measures with that person. Section 40123 reflects that there is great benefit to the FAA dealing directly with those who submit the information. This relationship allows the FAA to directly interact with industry experts, which allows for a more robust exchange of information and ideas. It also allows for development of corrective action, when needed, that most efficiently addresses the problem. If that corrective action involves changes in the air carrier's operation, this direct relationship allows the FAA to monitor the progress and success of that corrective action. These tasks would not be possible, or would be much less efficient, if the FAA received the information anonymously through a third party. With regard to ASAP and FOQA, the FAA believes that the benefits of voluntary sharing of safety related information with the agency are better served by a direct relationship with the submitter, rather than through an independent third party intermediary. These programs are considered extensions of the direct relationship that already exists between an air carrier and the FAA office responsible for direct oversight of the air carrier. This direct relationship permits the FAA to accomplish timely interpretation of trends within the context of the operations of the specific air carrier, to work cooperatively with the air carrier to develop feasible strategies for corrective action when warranted, and to track the effectiveness of corrective actions on a timely basis. Since both ASAP and FOQA programs are approved on an airline by airline basis, and continued approval is subject to FAA monitoring of corrective actions by particular airlines, the FAA believes that using third party data collectors for these particular programs is not appropriate. Comment: Many comments note that in order for all stakeholders in government and the aviation industry to share lessons from voluntary safety data reporting programs, the government must prescribe a method of protecting individuals and companies from enforcement action for voluntarily provided information. They state that a failure to have such protection from enforcement action would chill participation in the information-sharing program. FAA response: Part 193 does not contain enforcement policy. Part 193 is intended to include only what is necessary to carry out section 40123. There is no need to address enforcement policy to carry out section 40123, except to the extent that enforcement action that the FAA initiates based on information received under part 193 may result in disclosure of that information. Further, to the extent that certain limitations on enforcement may be appropriate, they can only be offered in the context of the specific program to which they are intended to apply. Each program must be examined on an individual basis to determine the appropriateness, if any, of such protection. For example, the ASAP program contains a detailed policy governing when enforcement action may or may not be taken for violations that have been reported through ASAP. See AC-120-66A, paragraph 11. Although part 193 is not intended to address protection fro enforcement action, the FAA understands that this issue is closely linked to the present rulemaking. Individuals and airlines are unlikely to participate in voluntary safety data reporting programs for which no protections from enforcement or other reprisals are provided. In FOQA and ASAP there are in fact limits on possible enforcement action that might be taken based on information obtained under those programs. We understand that appropriate enforcement policies, along with non- disclosure under part 193, may be needed to encourage participated in information-sharing programs. Comment: Several commenters object to proposed Sec. 193.7(a)(3) (new Sec. 193.9(a)(3)) that would allow for disclosure of information for use in criminal investigations or prosecutions. They state that these provisions will discourage voluntary participation. A commenter notes that new section 40123 authorizes the FAA to designate safety and security information as protected ``notwithstanding any other provisions of law,'' and the commenter therefore recommends that the proposed use and disclosure of protected information for criminal investigations or prosecutions be eliminated from the rule. This commenter also recommends using the conditions in Advisory Circular 00- 46D, Aviation Safety

[[Page 33800]]

Reporting Program (ASRP) as grounds for taking action. FAA response: The FAA does not consider it to be in the interest of safety or security to forego reporting of possible criminal violations. Indeed, criminal violations related to aviation may pose extreme danger to the flying public and possible violations must be investigated, and if warranted, prosecuted. The ASRP, cited by the commenter, provides that NASA will refer information concerning criminal offenses to the Department of Justice and the FAA. See AC-00-46D, paragraph 7.a.(1) and 14 CFR 91.25. ASAP, too, provides that reports of possible criminal activity will be referred to a law enforcement agency. See AC 121120- 66A, paragraph 11.c.(2). New Sec. 193.9: New Sec. 193.9 describes when withholding voluntarily submitted information will not be consistent with safety or security, as provided in section 40123(a)(2). The FAA anticipates that if all other requirements in section 40123 are met, it will be infrequent that the FAA will find it necessary to disclose the information. This is partly because the types of information we anticipate collecting the procedures under which it will be collected are unlikely to reveal criminal offenses. This is also true because we anticipate including in the information sharing programs a method to carry out corrective action without the need for enforcement action or other process that would call for disclosing the protected information. Under FOQA, for example, it is highly unlikely that routine flight data will reveal criminal activity or a lack of qualifications of a certificate holder. In ASAP, there is a detailed procedure for initiating corrective action without the need for enforcement action. If this process is carried out there will no need for the FAA to disclose the information. If this process is not carried out the FAA may have to take enforcement action (see AC 120-66A paragraph 10.b.), but we expect this to happen rarely. There are some circumstances under which safety or security will make it necessary for the FAA to disclose at least portions of protected information, which circumstances are stated in this section. Where disclosure will be necessary, attempts will be made to limit the disclosure to the extent practicable, such as releasing only de- identified and summarized information. Any information sharing program may reveal a need for the FAA to change its rules or policies, for instance. These will be handled as provided in new Sec. 193.9(a)(1), discussed below, and will involve release of de-identified, summarized information. New Sec. 193.9(a)(1) provides for the disclosure of limited information to explain the need for changes in policies and regulations. As is explained in the legislative history for section 40123, the information collected in these voluntary programs ``could help to improve air safety by helping safety official identify trends before they cause accidents.'' H.R. Rep. No. 104-714, 104th Cong., 2d Sess. 41. ``The data and information that would be available to the FAA as a result of this provisions * * * should be very useful in the formulation of the FAA's safety policy and regulations.'' Id. at 42. Generally, during rulemaking the agency is required to make data available that it relied on in developing the proposed rule and is required to give the public an opportunity to comment on the proposal. Providing the data gives the public a chance to look at how the agency analyzed and interpreted the data and provides an opportunity to comment on the conclusions reached. See 5 U.S.C. 553. This informed comment assists the agency in developing rules that best promote safety and security. Commenters are able to better understand the reasons for the proposed rule, offer alternate interpretations of the underlying data, and offer solutions that they feel would best address the safety or security problem. Section 40123, however, specifically provides that information voluntarily provided under that section shall not be disclosed ``notwithstanding any other provision of law * * *'' It would not be consistent with the intent of section 40123 for the FAA to make available to the public all of the raw data on which it relied if that data was submitted voluntarily in a program under this part. On the other hand, it would not be consistent with safety and security for the FAA to completely forego the benefits of informed comment that comes with disclosing the data supporting a proposed rule. The FAA has determined that if we enter into rulemaking or policy making based on data submitted under part 193, we will not release all of the data. Rather, we will release only data that is de-identified and that is summarized. In this way, we will not reveal the source of the data, but we will reveal enough information to explain to the public how the FAA made its decisions on the new rule or policy. This approach balances the public's interest in understanding the basis for agency rulemaking and policy making, and the need to encourage the voluntary submission of safety and security information. Data could be summarized in a number of ways, depending on the rulemaking. For instance, charts might show how often a specific maintenance problem was discovered in different air carriers, without revealing the names of the air carriers. This would show how the maintenance problem was distributed across the industry, leading the FAA to propose a general rulemaking instead of a correction for one air carrier. This approach is similar to that currently used with information that is of a very personal or private nature. Rulemaking based on a review of medical records, for instance, may provide summarized findings without revealing individuals' names. New Sec. 193.9(a)(2) provides for disclosure of information received in a program under this part to evaluate or correct a condition that may compromise safety or security. This would only be done if the condition continues uncorrected. We anticipate that in many or most cases the corrective action can be accomplished without the release of protected information. There are a number of instances in which this might occur. Examples include evaluating airworthiness conditions, assuring that the holder of an FAA certificate is qualified for that certificate, and preventing on-going violations of safety or security regulations. The rule language is modified to indicate that the FAA retains the discretion to disclose information submitted under this part to correct a condition that compromises safety or security, if that condition continues uncorrected. In many cases corrective action may be accomplished without the FAA disclosing the information. For instance, if the FAA can work with a certificate holder to bring it into compliance without the need for enforcement action, there may be no need to disclose the part 193 information. Under new Sec. 193.9(a)(2) the FAA may need to make a limited disclosure to evaluate airworthiness conditions. If, for instance, information indicates an unsafe condition in a type of aircraft, engine, or other product, the FAA may consider issuing an Airworthiness Directive (AD, under part 39) to require that the deficiency be corrected. The FAA works with design approval holders and production approval holders to identify the need for action to correct airworthiness problems and to develop what that action should be. Design approval holders hold the rights

[[Page 33801]]

to a design for a product approved by the FAA, such as a type certificate under part 21. Production approval holders hold an approval from the FAA to produce a product, such as a production certificate, parts manufacturer approval, or technical standard order authorization under part 21. The holders of design and production approvals have expertise in their own products that the FAA does not have, and it is important that their expertise be available to help the FAA analyze potential airworthiness problems. Under Sec. 193.9(a)(2), the FAA will disclose voluntarily-provided information to a design or production approval holder to assist the FAA in assessing the need for, and the content of, required corrective action. See, for example, Sec. 21.99, which requires the holder of a type certificate to submit appropriate changes to the FAA for approval when an AD is issued. If an AD is issued, it may include de-identified, summarized information in accordance with Sec. 193.9(a)(1). Under new Sec. 193.17, those design and production approval holders will be required to protect the information from unauthorized disclosure. See the further discussion for new Sec. 193.17. Section 193.9(a)(3) provides for disclosure of information to conduct a criminal investigation or prosecution. While the FAA does not prosecute criminal actions, in those rare circumstances in which it is appropriate the agency refers such matters to the Department of Justice or other appropriate agency. It is not in the interest of safety or security to forego reporting of possible criminal violations. Criminal violations related to aviation may pose extreme danger to the flying public and possible violations must be investigated, and if warranted, prosecuted. Finally, Sec. 193.9(a)(4) provides for disclosure of information to comply with 49 U.S.C. 44905 regarding information about threats to civil aviation. That section requires that public notice be made in specified circumstances about threats to civil aviation, generally involving possible terrorists threats. The legislative history makes clear that such information should be disclosed even if voluntarily provided under sec. 40123. H.R. Rep. No. 104-714, 104th Cong., 2d Sess. 49. Section 193.9(b) provides for other circumstances in which withholding information provided under this part would not be consistent with the Administrator's safety and security responsibilities. These circumstances may be different depending on the program. Those circumstances will be described in the designation for that program, so participants, and the public, will know. The FAA cannot predict how information programs may develop in the future. As new programs under this part are developed, these uses would be proposed in specific programs. This way both the participants in the information sharing programs and the public will know how the information will be disclosed. Possible examples include disclosure to foreign aviation authorities, disclosure after a period of time in which the information would no longer be protected, and disclosure in punitive enforcement actions.

Section 193.11 What Is the Notice Procedure? (Proposed Sec. 193.9 Designating Information as Protected Under This Part: Notice Procedure)

Proposal: This section proposed to describe the procedure normally used to designate information as protected under part 193. This procedure would be for use where there is not an immediate need for the information. It generally would be used for programs in which a specific type of information is to be provided by types of persons on a continuing basis. The process would include the FAA publishing a proposed designation in the Federal Register, considering the comments,and then publishing a final designation. Comment: Several comments were received on the need for the notice and comment procedure proposed in this section. One commenter stresses that the notice procedure is important to protecting the public's interest in safety and security information. One commenter states that the only interested parties left entirely without the ability to know what sorts of information will be kept secret are the press and the public. Another commenter objects that publishing a notice of proposed designation is an unnecessary, arduous, public, and bureaucratic process, which is not required or authorized by section 40123. The commenter is of the opinion that public comment will not aid the Administrator in understanding the agency's goals with respect to designating a particular program as protected from disclosure, or expand her knowledge or qualifications to make such judgements. The commenter also objects to the proposal to publish a notice withdrawing of designation, stating that such withdrawal would be better handled by direct agency correspondence with affected industry persons. FAA response: The FAA firmly believes that, when possible, designating information as protected under part 193 should be done by the notice procedure. The FAA must balance the industry's legitimate concerns about disclosure of sensitive information with the public's interest in safety and security related information. The notice and comment procedure provides the public the opportunity to comment on whether the FAA should issue the designation, including whether the designation of a particular program is consistent with the Administrator's safety and security responsibilities. Further, this process gives public notice as to what sort of information the FAA may be collecting and not making available to the public. The FAA does not believe that providing the aviation industry and the public with the opportunity to comment on such notices imposes an arduous or bureaucratic process. Rather, it will provide all interested parties with an opportunity to express their viewpoints for consideration by the FAA in making its final designation determination. Once a program has been designated as protected from disclosure under part 193, that designation continues indefinitely, unless subsequently withdrawn by the FAA. Although the FAA may withdraw a designation at any time it determines that continuation of the designation does not meet the elements of new Sec. 193.7, the rule requires that a notice of withdrawal be published in the Federal Register. This process is necessary to inform the public (which will have had notice of the creation of the designation), and because a designation is issued for a particular program rather than a particular person or persons. When a designation is withdrawn for a particular program, that withdrawal impacts all program participants, and potential future participants, that the program no longer is effective. Comment: One commenter asks whether the comments on the notice of proposed designation will be published. FAA response: The proposal was silent on this point, but we have decided to add this feature to the rule. New Sec. 193.11(c)(7) provides that the designation includes a summary of the significant comments received and the FAA's responses. This will assist the public in understanding how the FAA made the final decision to designate information as protected. Comment: One commenter states that the FAA should assess whether it would benefit from certain voluntary information sharing programs with designations under this part, and not wait for applications from individuals. FAA response: The FAA agrees, and is considering what programs would be

[[Page 33802]]

of value under this part. As noted, the FAA expects to propose to designate information it will receive under FOQA and under ASAP as protected under this part. Comment: The preamble for the proposal discussed that some information sharing programs would be national programs, in which all persons who are similarly situated could participate. An example is FOQA, in which all air carriers may choose to participate. Two commenters endorse the use of national programs, stating that it reduces the administrative burden for each participant. FAA response: The final rule retains the ability for the FAA to designate a program level such that all similar persons may participate, such as all air carriers, or all producers of engines. These programs will state what is needed for persons to participate in the program. New Sec. 193.11: This section describes the procedure normally used to designate information as protected under part 193. This procedure is for use where there is not an immediate need for the information. It generally is used for programs in which a specific type of information is to be provided by types of person on a continuing basis. For instance, under FOQA, access to aggregate flight recorder data may be made available by air carriers on a regular basis. The scope of Sec. 193.11 programs would vary. The FAA create a program that is available to all individuals or companies that meet the basic requirements of that program. For this type of program, the FAA would designate information received from all participants as protected under section 40123, then different persons would have the option of participating in the program without obtaining a separate designation under part 193. Examples of these programs are FOQA and ASAP. The FAA anticipates that it will propose to designate FOQA and ASAP programs as protected under section 40123. The proposed designations would include all of the items in Sec. 193.7, such a description of the type of information that may be voluntarily provided. The comments we receive will be available to the public on the DMS web site. If, after public comment, the FAA decides to designate these programs as protected under section 40123, then each company that participates would receive the protections of section 40123 without each obtaining a designation under part 193 for their company FOQA or ASAP program. Another way to have an information program designated as protected under section 40123 is for a person to submit an application for a single participant program, in which only that person submits information. Any person may apply to have information designated as protected under this part. The application must include the designation described in paragraph (c) of Sec. 193.11 that the applicant would like the FAA to issue. The FAA will evaluate the application and either publish a proposed designation for public comment or deny the application. The FAA could deny an application if it did not contain the information required. It also could be denied if the FAA determined that the potential benefits of the proposed program did not warrant use of FAA resources at that time, given other priorities. You may apply to have information designated as protected under this part by submitting an application addressed to the Docket Management System (DMS), U.S. Department of Transportation, Room PL 401, 400 Seventh Street, SW., Washington, DC 20590-0001 for paper submissions, and the DMS web page at http://dms.dot.gov/ for electronic submissions. The FAA may decide to issue a proposed designation based either on an application or the FAA's internal decision. In either event, if the FAA determines that the designation may be advisable, the FAA will publish a proposed designation in the Federal Register and request comment. If after review of the comments the FAA finds that the elements in Sec. 193.7 were met and the designation is otherwise advisable, it will publish in the Federal Register an order designating the information received under the program as protected. The order includes a summary of the significant comments received and the FAA's responses, and summaries of why the FAA finds that the elements are met. By publishing the order in the Federal Register, all interested persons will be able to see what information they may provide under the program and receive the protection described in section 40123 and this part. They may also see what information the FAA is collecting but not making available to the public. Five items in the order are the elements of section 40123. Section 193.11(c)(1) provides for a summary of why the FAA finds that the information will be provided voluntarily. Paragraph (c)(2) of that section provides for a description of the type of information that may be voluntarily provided under the program and a summary of why the FAA finds that the information is safety or security related. Paragraph (c)(3) calls for a summary of why the FAA finds that the disclosure of the information would inhibit the voluntary provision of that type of information. Paragraph (c)(4) is for a summary of why the receipt of that type of information aids in fulfilling the FAA's safety and security responsibilities. Paragraph (c)(5) calls for a summary of why withholding such information from disclosure is consistent with the FAA's safety and security responsibilities, including a statement as to the circumstances under which, and a summary of why, withholding such information from disclosure will not be consistent with the FAA's safety and security responsibilities, as described in new Sec. 193.9. New Sec. 193.11(c)(6) provides for a summary of how the FAA will distinguish information protected under this part from other information. This might include such items as the method for persons to become involved in the program, how information is submitted under the program, and how the information is segregated within the FAA to ensure that it is handled properly. It might also include such procedures as marking documents as protected under part 193. New Sec. 193.11(c)(7) provides a summary of the significant comments received and the FAA's responses. The FAA anticipates that the designation published in the Federal Register may not contain all the details, conditions, and procedures that apply to the program. For instance, if the FAA issues a designation for ASAP, it will contain the items listed in Sec. 193.11(c). But the designation likely will not include many of the items in AC 120-66A, such as description of how reports are processed, the enforcement policies that apply, and how corrective action is handled. The approvals for each air carrier would not need to be published in the Federal Register as long as they meet the requirements in the designation that was published. Under Sec. 193.11(d), the FAA may amend a designation using the procedures in paragraphs (a), (b), and (c). The amendment may be based on either an application of one of the submitters, another person, or the FAA's own work. The amendment would be processed using the notice and comment procedure. Section 193.11(e) provides for withdrawal of the designation if the FAA determines that the program no longer meets the elements in Sec. 193.7, or if the requirements of the individual program are not met. The withdrawal

[[Page 33803]]

would be published in the Federal Register and would state the effective date of the withdrawal. Information that was received under the program while the designation was effective would remain protected even after the program was discontinued. No newly receive information would receive the protection of section 40123 and part 193.

Section 193.13 What Is the No-Notice Procedure? (Proposed Sec. 193.11 Designating Information as Protected Under This Part: No Notice Procedure)

Proposal: This section proposed a procedure for situations in which there was an immediate need for the FAA to received safety or security information. This process would be a way for the FAA to assure the submitter of information that the information would be protected under this part, but would not require publication in the Federal Register and a comment period. Comment: One comment felt that this procedure is helpful. FAA response: The procedure is being adopted, with some changes discussed below. New Sec. 193.13: This procedure is for when there is an immediate need for the FAA to receive safety or security information without taking the time for publication in the Federal Register and a comment period. The FAA might need to obtain the information quickly in order to evaluate the need for immediate remedial or corrective action. The FAA anticipates using this procedure in rare circumstances. There may be a serious safety or security issue for which the FAA needs to collect information immediately without first using the procedure in Sec. 193.11. This procedure would allow the FAA to do so. The person can request the protection by stating their name, the general nature of the information, and whether they are willing to provide the information without the protection of this part. If the person is unwilling to provide their name, the information will not be designated as protected under this part. There are other means to submit information anonymously, such as through the FAA Hotline at (202) 267-9532. The FAA will accept the application either verbally or in writing. The FAA protects information under this section only when the Administrator has found that the elements of Sec. 193.7 are met and that there is an immediate need to obtain the information without carrying out the more time-consuming procedures in Sec. 193.11. The designation is in writing. We anticipate that this procedure may often involve an individual who has information regarding a specific condition, where the information can be provided all at once or over a short time. This is different than the notice procedure in Sec. 193.11, which generally will involve long-term information sharing programs. Section 193.13(c) contains limitations on the length of time the procedures in Sec. 193.13 may be used. That paragraph provides that this procedure usually may be used only for 60 days. If an enforcement or criminal investigation is underway, the information could continue to be provided under the protection of part 193. In addition, if there is a critical safety or security need to immediately adopt a program and begin collecting information in a program that normally would be under Sec. 193.11, the FAA could use Sec. 193.13 to begin obtaining the information right away, and initiate the procedure in Sec. 193.11 to adopt a long-term program. This rule does not include the provisions of proposed Sec. 193.11(d), which would have provided that usually the FAA would be able to disclose information from no-notice programs in the conduct of enforcement actions. After further evaluation, we believe that it is not clear that this will be necessary in all cases. Each program will deal with this issue as appropriate. New Sec. 193.13(d) provides for amending the designation using the procedures in paragraphs (a) and (b) of this section. Finally, new Sec. 193.13(e) provides that the designation may be withdrawn by written notice to the person providing the information.

Section 193.15 What FAA Officials Exercise the Authority of the Administrator Under This Part? (Proposed Sec. 193.1(a) Scope and Delegations)

Proposal: The proposal provided for delegation of the authority under this part. It stated that the authority of the Administrator to issue, amend, and withdraw designations under this part may be delegated to specified high-level FAA officials. Because of the strong public policy in favor of disclosure of information held by a Federal agency, authority to grant the final designations, with their extensive non-disclosure protections under this part, should be the decision of senior officials in the agency. Comment: Two commenters note that only high-level FAA officials may designate information as protected. They state that the ability to disclose the protected information also should be delegated to the same high level officials. FAA response: The FAA agrees. New Sec. 193.15: This section provides the same delegation for release of information that applies to designating information as protected. These officials are Associate Administrators and Assistant Administrators and the Chief Counsel, their deputies, and any individual formally designated to act in their capacity. For instance, if an Associate Administrator were on leave, the person designated as Acting Associate Administrator will have the authority under this part. This section further states that the authority of the Administrator to issue proposed designations under this part may be further delegated, which could be below the level of Associate Administrator.

Section 193.17 How Must Design and Production Approval Holders Handle Information They Receive From the FAA Under This Part? (Not Proposed)

As discussed above for new Sec. 193.9(a)(2), the FAA may need to make a limited disclosure of protected information to the holders of design approvals or production approvals to evaluate airworthiness conditions. In the NPRM the FAA asked whether the approval holders should be required to protect the information from further disclosure. Two commenters agreed that the approval holders should be required to protect the information. Under Sec. 193.9(a)(2) the FAA will disclose voluntarily-provided information to a design or production approval holder to assist the FAA in assessing the need for, and the content of, required corrective action. Under new Sec. 193.17, those design and production approval holders will be required to protect the information from unauthorized disclosure. New Sec. 193.17 provides that if the FAA discloses information under Sec. 193.9(a)(2) to an approval holder, the approval holder must disclose that information only to persons who need to know the information to address the safety or security condition. Approval holders may disclose the information to their engineers and other individuals working on the problem. They may also disclose the information to a licensee or supplier if their expertise is needed to address the safety problem. Approval holders should use such practices as marking the materials and storing them in safe places to avoid unauthorized disclosure. We believe that approval holders are well positioned to protect part 193 information. Approval holders are used to handling proprietary information,

[[Page 33804]]

such as trade secrets, which must be protected from unauthorized disclosure. New Sec. 193.17(b) provides that unless an emergency exists, before disclosing information to approval holders the FAA will contact the submitter of the information. The FAA must retain its discretion on whether an AD, and disclosure to an approval holder, is needed, but the submitter will have notice of the disclosure.

Paperwork Reduction Act

As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)), the FAA has submitted a copy of these sections to the Office of Management and Budget for its review. The collection of information was approved and assigned OMB Control Number 2120-0646. Comments on the proposal have been addressed previously. However, no specific comments were received on this information collection submission. This final rule will impose a negligible paperwork burden for persons that choose to participate in a voluntary submission program. The person will submit a letter or other application notifying the FAA that they wish to participate in a current program. The FAA believes that approximately 10 air carriers and other persons will participate and prepare one application each. Assuming that each of the 10 persons file one application, divided by 10 years, equals approximately one (1) hour per application times five (5) programs, equals a total of 5 hours each year. The estimated hour burden is 5 hours (one time application). The FAA anticipates approximately five (5) programs within the next 10 years. Occasionally, a person may want to propose a program to the FAA that will require voluntarily submitted information that will have to be protected. The FAA anticipates that there will only be one (1) such proposal per decade. An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid Office of Management and Budget (OMB) control number.

International Compatibility

In keeping with U.S. obligations under the Convention on International Civil Aviation, it is FAA policy to comply with International Civil Aviation Organization (ICAO) Standards and Recommended Practices to the maximum extent practicable. The FAA has reviewed the corresponding ICAO standards and Recommended Practices and has identified no differences with these regulations.

Regulatory Evaluation Summary

Changes to Federal regulations must undergo several economic analyses. First, Executive Order 12866 directs that each Federal agency shall propose or adopt a regulation only upon a reasoned determination that the benefits of the intended regulation justify its costs. Second, the Regulatory Flexibility Act of 1980 requires agencies to analyze the economic effect of regulatory changes on small entities. Third, the Trade Agreements Act of 1979 (19 U.S.C. 2531-2533) prohibits agencies from settling standards that create unnecessary obstacles to the foreign commerce of the United States. In developing U.S. standards, this Trade Act also requires the consideration of international standards and, where appropriate, that they be the basis of U.S. standards. And fourth, the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) requires federal agencies to assess the impact of any federal mandates on State, local, or tribal governments. The FAA has determined that this regulation is a ``significant regulatory action'' under section 3(f) of Executive Order 12866 and Department of Transportation policies and procedures (44 FR 11034, February 26, 1979) because of significant Congressional and public interest in this rulemaking. This rule will not have a significant impact on a substantial number of small entities, will not constitute a barrier to international trade, and does not impose a federal mandate on state, local, or tribal governments, or the private sector of $100 million per year. The FAA has determined that since the rule will have only a negligible economic impact, positive or negative, on the aviation industry, a full regulatory evaluation is not necessary. The purpose of this rule is to encourage the aviation community to voluntarily share information with the FAA so that the agency may work cooperatively with industry to identify modifications to rules, policies, and procedures needed to improve safety, security, and efficiency of the National Airspace System (NAS). To facilitate this process, the FAA has initiated a number of programs designed to capture safety and security related information normally not available to the public or to governmental agencies. One such program envisioned under this rule is the Flight Operational Quality Assurance Program (FOQA), which entails the routine extraction and analysis of digital flight data from line operations. The program enables collection of objective information that can be used to identify trends relating to the safety and efficiency of the NAS. Voluntary sharing of such information with the FAA could accelerate agency decision making in many areas of mutual interest, for example, published airport area arrival and departure procedures, air traffic control data, updates to certification criteria for aircraft, agency guidance for the use and performance of key aircraft subsystems, i.e., Traffic Alert and Collision Avoidance System (TCAS) and global Positioning System (GPS), or the approval under the Advanced Qualification Program of departures from traditional pilot training methods and media. Another benefit of data sharing programs envisioned through the final rule is that it provides an objective tool by which the FAA could improve its safety surveillance. For example, voluntarily shared data could provide the FAA and industry with an alternative means of monitoring the continued safety of Reduced Vertical Separation Maneuvers (RVSM). Under current FOQA guidelines, an FAA inspector may review data and information while at the operator's facility. The inspector is not authorized to remove either a paper or electronic copy of data provided under the program from an operator's premises. Not having a voluntarily provided copy of the information severely limits the ability of the FAA to use the information in agency decision making. This circumstance is not always in the interest of the FAA, the airline industry, or the public as it can preclude timely realization of a safety problem or potential efficiency benefits that might otherwise be realized from the shared information. Adopting this proposed rule would encourage data sharing by ensuring that the information shared will be protected from public disclosure, even if requested under the Freedom of Information Act (FOIA). The final rule will protect the confidentiality of the individual submitting the information and, therefore, alleviate aviation industry fears that information provided would be used by the public, competitors, or other government agencies for purposes other than those related to safety and security of the aviation system. In order to participate in any FAA sponsored program where voluntarily submitted information is protected, the person will have to submit a letter or an application notifying the FAA that it wishes to participate in the program. The FAA believes that this application

[[Page 33805]]

will cost approximately $100 to generate. The FAA also believes that approximately 10 persons may participate. The FAA anticipates approximately five (5) new programs will be in existence within the next 10 years. The total cost to the industry of notifying the FAA concerning their participation in these programs would be $5,000 over 10 years. Occasionally, a person may want to propose a program to the FAA that would require voluntarily submitted information that would have to be protected. The FAA anticipates that it would cost approximately $1,000 to develop such a proposal, and we anticipate that there would only be one (1) such proposal per decade. The benefits of this proposed rule are unquantifiable, but nevertheless are positive because the protected information can be used proactively to correct safety concerns, thus preventing avoidable accidents and potentially saving many lives and millions of dollars. There are negligible application costs associated with implementing the proposed rule. The proposal, if adopted, imposes no reporting requirements on the aviation community and would assure aviation interests such as air carrier operators, pilot associations, airframe manufacturers, and trade associations that voluntarily submit proprietary information would be protected from public disclosure. The cost to the public of having this data or information protected from public disclosure is considered negligible. On the other hand, the benefit to the FAA of voluntarily submitted sensitive, proprietary, safety, and security information protected from public disclosure will outweigh any potential costs to the public of being denied access to this information.

Regulatory Flexibility Act

The Rgulatory Flexibility Act of 1980 (5 U.S.C. 60-612) directs the FAA to fit regulatory requirements to the scale of the business, organizations, and governmental jurisdictions subject to regulation. We are required to determine whether a proposed or final action will have a ``significant economic impact on a substantial number of small entities'' as defined in the Act. If we find that the action will have a significant impact, we must do a ``regulatory flexibility analysis.'' This final rule will assist the FAA in carrying out its safety and security duties by providing that certain information submitted to the FAA on a voluntary basis will not be disclosed. The economic impact is minimal. Small entities wishing to participate in any program where voluntarily submitted information is protected, must submit a letter or an application to the FAA notifying the agency that the entity wishes to participate. Generating this letter or application will only cost $100. If a small entity wishes to propose a program that would require voluntarily submitted information, preparing the proposal will only cost $1,000. Both of these costs are considered minimal and will be voluntarily incurred. Therefore, we certify that this action will not have a significant economic impact on a substantial number of small entities.

International Trade

The Trade Agreement Act of 1979 (19 U.S.C. 2531-2533) prohibits Federal agencies from engaging in any standards or related activity that create unnecessary obstacles to the foreign commerce of the United States. Legitimate domestic objectives, such as safety, are not considered unnecessary obstacles. The statute also requires consideration of international standards and where appropriate, that they be the basis for U.S. standards. In addition, consistent with the Administration's belief in the general superiority and desirability of free trade, it is the policy of the Administration to remove or diminish, to the extent feasible, barriers to international trade, including both barriers affecting the export of American goods and services to foreign countries and barriers affecting the import of foreign goods and services into the U.S. In accordance with the above statute and policy, the FAA has assessed the potential effect of this final rule and has determined that it will have only a domestic impact and therefore no effect on any trade-sensitive activity.

Unfunded Mandates Reform Act

The Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1532-1538) requires the FAA to assess the effects of Federal regulatory actions on state, local, and tribal governments, and on the private sector of proposed or final rules that contain a Federal intergovernmental or private sector mandate that exceeds $100 million in any one year (adjusted annually for inflation). Such a mandate is deemed to be a ``significant regulatory action.'' This action does not contain such a mandate and, therefore, the requirements of Act do not apply.

Executive Order 13132, Federalism

The FAA has analyzed this final rule under the principles and criteria of Executive Order 13132, Federalism. We determined that this action would not have a substantial direct effect on the States, or the relationship between the national Government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, we determined that this final rule does not have federalism implications.

Plain Language

In response to the June 1, 1998, Presidential Memorandum regarding the use of plain language, the FAA re-examined the writing style currently used in the development of regulations. The memorandum requires federal agencies to communicate clearly with the public. We are interested in your comments on whether the style of this document is clear, and in any other suggestions you might have to improve the clarity of FAA communications that affect you. You can get more information about the Presidential memorandum and the plain language initiative at http://www.plainlanguage.gov.

Environmental Analysis

FAA Order 1050.1D defines FAA actions that may be categorically excluded from preparation of a National Environmental Policy Act (NEPA) environmental impact statement. In accordance with FAA Order 1050.1D, appendix 4, paragraph 4(j), this rulemaking action qualifies for a categorical exclusion.

Energy Impact

The energy impact of the notice has been assessed in accordance with the Energy Policy and Conservation Act (EPCA) Pub. L. 94-163, as amended (42 U.S.C. 6362) and FAA Order 1053.1. It has been determined that the final rule is not a major regulatory action under the provisions of the EPCA.

List of Subjects in 14 CFR Part 193

Air transportation, Aircraft, Aviation safety, Safety, Security.

The Amendment

In consideration of the foregoing, the Federal Aviation Administration adds part 193 to Title 14, Code of Federal Regulations as follows:

PART 193--PROTECTION OF VOLUNTARILY SUBMITTED INFORMATION

Sec. 193.1 What does this part cover? 193.3 Definitions. 193.5 How may I submit safety or security information and have it protected from disclosure?

[[Page 33806]]

193.7 What does it mean for the FAA to designate information as protected? 193.9 Will the FAA ever disclose information that is designated as protected under this part? 193.11 What is the notice procedure? 193.13 What is the no-notice procedure? 193.15 What FAA officials exercise the authority of the Administrator under this part? 193.17 How must design and production approval holders handle information they receive from the FAA under this part?

Authority: 49 U.S.C. 106(g), 40113, 40123.

Sec. 193.1 What does this part cover?

This part describes when and how the FAA protects from disclosure safety and security information that you submit voluntarily to the FAA. This part carries out 49 U.S.C. 40123, protection of voluntarily submitted information.

Sec. 193.3 Definitions.

Agency means each authority of the Government of the United States, whether or not the agency is within or subject to review by another agency, but does not include-- (1) The Congress; (2) The courts of the United States; (3) The governments of the territories or possessions of the United States; (4) The government of the District of Columbia; (5) Court martial and military commissions. De-identified means that the identity of the source of the information, and the names of persons have been removed from the information. Disclose means to release information to a person other than another agency. Examples are disclosures under the Freedom of Information Act (5 U.S.C. 552), in rulemaking proceedings, in a press release, or to a party to a legal action. Information includes data, reports, source, and other information. ``Information'' may be used to describe the whole or a portion of a submission of information. Summarized means that individual incidents are not specifically described, but are presented in statistical or other general form. Voluntary means that the information was not required to be submitted as part of a mandatory program, and was not submitted as a condition of doing business with the government. ``Voluntarily-provided information'' does not include information submitted as part of complying with statutory, regulatory, or contractual requirements, except that information submitted as part of complying with a voluntary program under this part is considered to be voluntarily provided.

Sec. 193.5 How may I submit safety or security information and have it protected from disclosure?

(a) You may do so under a program under this part. The program may be developed based on your proposal, a proposal from another person, or a proposal developed by the FAA. (b) You may be any person, including an individual, a company, or an organization. (c) You may propose to develop a program under this part using either the notice procedure in Sec. 193.11 or the no-notice procedure in Sec. 193.13. (d) If the FAA decides to protect the information that you propose to submit it issues an order designating the information as protected under this part. (e) The FAA only issues an order designating information as protected if the FAA makes the findings in Sec. 193.7. (f) The designation may be for a program in which all similar persons may participate, or for a program in which only you submit information. (g) Even if you receive protection from disclosure under this part, this part does not establish the extent to which the FAA may or may not use the information to take enforcement action. Limits on enforcement action applicable to a program under this part will be in another policy or rule.

Sec. 193.7 What does it mean for the FAA to designate information as protected?

(a) General. When the FAA issues an order designating information as protected under this part, the FAA does not disclose the information except as provided in this part. (b) What findings does the FAA make before designating information as protected? The FAA designates information as protected under this part when the FAA finds that-- (1) The information is provided voluntarily; (2) The information is safety or security related; (3) The disclosure of the information would inhibit the voluntary provision of that type of information; (4) The receipt of that type of information aids in fulfilling the FAA's safety and security responsibilities; and (5) Withholding such information from disclosure, under the circumstances provided in this part, will be consistent with the FAA's safety and security responsibilities. (c) How will the FAA handle requests for information under the Freedom of Information Act (FOIA)? The FAA does not disclose information that is designated as protected under this part in response to a FOIA request. (d) What if the FAA obtains from another source the same information I submit? Only information received under a program under this part is protected from disclosure under this part. Information obtained by the FAA through another means is not protected under this part. (e) Sharing information with other agencies. The FAA may provide information that you have submitted under this part to other agencies with safety or security responsibilities. The agencies are subject to the requirements of 49 U.S.C. 40123 regarding nondisclosure of information. The FAA will give the information to another agency only if, for each such request, the other agency provides the FAA with adequate assurance, in writing, that-- (1) The agency has a safety or security need for the information, including the general nature of the need. (2) The agency will protect the information from disclosure as required in 49 U.S.C. 40123, this part, and the designation. This includes a commitment that the agency will mark the information as provided in the designation. (3) The agency will limit access to those with a need to know to carry out safety or security responsibilities. (f) What if the FAA receives a subpoena for the information I submit? When the FAA receives a subpoena for information you have submitted under this part, the FAA contacts you to determine whether you object to disclosure of the information or you wish to participate in responding to the subpoena. If both you and the FAA determine that release of the information is appropriate, the information is released. Otherwise, the FAA will not release information designated as protected under this part unless ordered to do so by a court of competent jurisdiction.

Sec. 193.9 Will the FAA ever disclose information that is designated as protected under this part?

The FAA discloses information that is designated as protected under this part when withholding it would not be consistent with the FAA's safety and security responsibilities, as follows: (a) Disclosure in all programs. (1) The FAA may disclose de- identified, summarized information submitted under this part to explain the need for changes in policies and regulations. An example is the FAA publishing a notice of proposed rulemaking based on your information, and including a de-identified, summarized version of your information (and the information from other persons, if applicable) to explain the need for the notice of proposed rulemaking.

[[Page 33807]]

(2) The FAA may disclose information provided under this part to correct a condition that compromises safety or security, if that condition continues uncorrected. (3) The FAA may disclose information provided under this part to carry out a criminal investigation or prosecution. (4) The FAA may disclose information provided under this part to comply with 49 U.S.C. 44905, regarding information about threats to civil aviation. (b) Additional disclosures. For each program, the FAA may find that there are additional circumstances under which withholding information provided under this part would not be consistent with the FAA's safety and security responsibilities. Those circumstances are described in the designation for that program.

Sec. 193.11 What is the notice procedure?

This section states the notice procedure for the FAA to designate information as protected under this part. This procedure is used when there is not an immediate safety or security need for the information. This procedure generally is used to specify a type of information that you and others like you will provide on an on-going basis. (a) Application. You may apply to have information designated as protected under this part by submitting an application addressed to the Docket Management System (DMS), U.S. Department of Transportation, Room PL 401, 400 Seventh Street, SW., Washington, DC 20590-0001 for paper submissions, and the DMS web page at http://dms.dot.gov/ for electronic submissions. Your application must include the designation described in paragraph (c) of this section that you want the FAA to issue. You should not include in your application any information that you do not want available to the public. The FAA may issue a proposed designation based on the application or may deny your application. (b) Proposed designation. Before issuing a designation under this section, based either on your application or the FAA's own initiative, the FAA publishes a proposed designation in the Federal Register and requests comment. (c) Designation. The FAA designates information as protected under this part if, after review of the comments, the FAA makes the findings in Sec. 193.7. The FAA publishes in the Federal Register an order designating the information provided under the program as protected under this part. The designation includes the following: (1) A summary of why the FAA finds that you and others, if applicable, will provide the information voluntarily. (2) A description of the type of information that you and others, if applicable, may voluntarily provide under the program and a summary of why the FAA finds that the information is safety or security related. (3) A summary of why the FAA finds that the disclosure of the information would inhibit you and others, if applicable, from voluntarily providing of that type of information. (4) A summary of why the receipt of that type of information aids in fulfilling the FAA's safety and security responsibilities. (5) A summary of why withholding such information from disclosure would be consistent with the FAA's safety and security responsibilities, including a statement as to the circumstances under which, and a summary of why, withholding such information from disclosure would not be consistent with the FAA's safety and security responsibilities, as described in Sec. 193.9. (6) A summary of how the FAA will distinguish information protected under this part from information the FAA receives from other sources. (7) A summary of the significant comments received and the FAA's responses. (d) Amendment of designation. The FAA may amend a designation using the procedures in paragraphs (a), (b), and (c) of this section. (e) Withdrawal of designation. The FAA may withdraw a designation under this section at any time the FAA finds that continuation of the designation does not meet the elements of Sec. 193.7, or if the requirements of the designation are not met. The FAA withdraws the designation by publishing a notice in the Federal Register. The withdrawal is effective on the date of publication or such later date as the notice may state. Information provided during the time the program was designated remains protected under this part and the program. Information provided after the withdrawal of the designation is effective is not protected under this part or the program.

Sec. 193.13 What is the no-notice procedure?

This section states the no-notice procedure for the FAA to designate information as protected under this part. This procedure is used when there is an immediate safety or security need for the information. This procedure generally is used for specific information that you will provide on a short-term basis. (a) Application. You may request that the FAA designate information you are offering as protected under this part. You must state your name, at least the general nature of information, and whether you will provide the information without the protection of this part. Your request may be verbal or writing. (b) Designation. The FAA issues a written order designating information provided under this section as protected under this part. The FAA designates the information as protected under this part if the FAA-- (1) Makes the findings as Sec. 193.7; and (2) Finds that there is an immediate safety or security need to obtain the information without carrying out the procedures in Sec. 193.11 of this part. (c) Time limit. Except as provided in paragraphs (c)(1) and (c)(2) of this section, no designation under this section continues in effect for more than 60 days after the date of designation. Information provided during the time the designation was in effect remains protected under this part. Information provided that the designation ceases to be in effect is not protected under this part. The designation remains in effect for more than 60 days if-- (1) The procedures to designate such information under Sec. 193.11(a) have been initiated, or (2) There is an ongoing enforcement or criminal investigation, in which case the designation may continue until the investigation is completed. (d) Amendment of designation. The FAA may amend a designation under this section using the procedures in paragraphs (a) and (b) of this section. (e) Withdrawal of designation. The FAA may withdraw a designation under this section at any time the FAA finds that continuation does not meet the elements of Sec. 193.7, or if the requirements of the designation are not met. The FAA withdraws the designation by notifying the person in writing that the designation is withdrawn. The withdrawal is effective on the date of receipt of the notice or such later date as the notice may state. Information provided during the time the designation was in effect remains protected under this part. Information provided after the withdrawal is effective is not protected under this part.

Sec. 193.15 What FAA officials exercise the authority of the Administrator under this part?

(a) The authority to issue proposed and final designations, to issue proposed and final amendments of designations, and to withdraw

[[Page 33808]]

designations under this part, and to disclose information that has been designated as protected under this part, is delegated by the Administrator to Associate Administrators and Assistant Administrators and to the Chief Counsel, their Deputies, and any individual formally designated as Acting Associate or Assistant Administrator, Acting Chief Counsel, or Acting Deputy of such offices. (b) The officials identified in paragraph (a) of this section may further delegate the authority to issue proposed designations and proposed amendments to designations.

Sec. 193.17 How must design and production approval holders handle information they receive from the FAA under this part?

(a) If the FAA discloses information under Sec. 193.9(a)(2) to the holders of design approvals of production approvals issued by the FAA, the approval holder must disclose that information only to persons who need to know the information to address the safety or security condition. (b) Unless an emergency exists, before disclosing information to approval holders the FAA will contact the submitter of the information.

Issued in Washington, DC, on June 19, 2001. Jane F. Garvey, Administrator. [FR Doc. 01-15853 Filed 6-22-01; 8:45 am] BILLING CODE 4910-13-M