Privacy

General points

This statement explains the policy of the Rail Accident and Incident Investigation Unit (hereinafter referred to as “IU”) on the processing of personal data and implements the transparency obligations contained in the General Data Protection Regulation (also known as the GDPR and hereinafter referred to as “GDPR”).
This statement is a brief summary. However, the IU provides more detailed information on separated pages.

This statement is subject to change as a result of changes to IU processing procedures, new regulations and developments in terms of the supervisory authorities. The IU always endeavours to take these developments into account in an appropriate and timely manner within the framework of this statement and, if necessary, to provide you with additional information.
You can find more information on the regulations applicable to the processing of personal data in Belgium on the Data Protection Authority’s website, https://www.dataprotectionauthority.be/citizen

Data Controller

The data controller, on its own or with others, determines the purpose and means of the processing of such personal data.
The data controller is the IU, represented by the Chief Investigator.
Contact:
FPS Mobility and Transport
Rail Accident and Incident Investigation Unit
City Atrium, Rue du Progrès 56 (5^th floor), 1210, Brussels;
telephone: +32 (0)2 277 31 11
e-mail: raui@mobilit.fgov.be
company number: BE 0308.357.852.

Data Protection Officer

The Data Protection Officer (DPO) of the Federal Public Service Mobility and Transport acts as DPO for the IU:
Mr Michel LOCCUFIER
contact:
• by post: FPS Mobility and Transport, for the attention of the DPO (9A64), City Atrium – Rue du Progrès 56, 1210 Brussels ;
• by e-mail : dpo@mobilit.fgov.be

The DPO ensures compliance with the regulatory framework for data protection and is the contact person for all matters relating to personal data processing and exercising your rights under the GDPR.

Processing of personal data: what data, for what purpose and on what basis

The IU processes different categories of personal data for a wide variety of purposes which, along with the reasons for each processing case, are explained in more detail here.
Personal data will never be processed by the IU for advertising purposes or transmitted to third parties who would use personal data for such purposes.

Retention period

The IU only stores personal data for the time required for its intended processing. Retention periods are always determined according to the purpose of the processing and are described in more detail on the specific page on this subject.
In this respect, account is taken of the periods set out in the regulations and the legislation governing the relevant processing, the principles set out in Article 5 of the GDPR and the obligations imposed on the IU by the regulations on archives (principally the Law on archives of 24 June 1955).

Transfer of personal data

Personal data is shared with third parties when the IU is required to do so based on its legal obligations, as part of the execution of a public interest mission or the exercise of official authority, because of a legitimate interest or after having obtained your consent.
In compliance with Belgium’s international obligations and in accordance with the regulations in force, the IU may be required to send personal data to a European organisation (e.g. a counterpart investigation unit, external experts).
This (European) transfer of personal data is explained in more detail here.

Your rights

Depending on the processing of personal data, the data subject has a number of rights in relation to their data. These rights are as follows :

• the right of access and to obtain a copy;
• the right of rectification;
• the right to object;
• the right to restriction of processing
• the right to erasure;
• the right to data portability;
• the right to withdraw consent.

However, you may not always be able to enforce these rights. The Rail Accident and Incident Investigation Unit and the FPS Mobility and Transport will always inform you of this, stating the reasons.

• Right of access and to obtain a copy: you have the right to view the personal data relating to you that is processed by the Rail Accident and Incident Investigation Unit and to obtain a free copy.
• Right of rectification: you have the right to have incorrect personal data relating you corrected as quickly as possible. Given the purposes of processing, you have the right to have any incomplete personal data completed.
• Right to object: in a number of cases, you may object to the processing of your personal data at any time for reasons related to your specific situation.
• Right to restriction of processing: in some cases, you have the right to obtain a restriction on the processing of your personal data.
• Right to erasure: in a number of cases, you have the right to have your personal data erased without unreasonable delay.
• Right to data portability: in a number of cases, you have the right to receive your personal data, which you have provided to the Rail Accident and Incident Investigation Unit, in a structured, commonly used and machine-readable format, and the right to transfer this data to another data controller, without the Rail Accident and Incident Investigation unit obstructing this.
• Right to withdraw consent: for personal data processing carried out on the basis of your consent, you may withdraw your consent.

Exercising your rights

To exercise your rights, you can contact the Data Protection Officer using our standard form.

We ask you to formulate your request clearly so that we can deal with it in the best possible way. You can send the completed form by e-mail to dpo@mobilit.fgov.be.
If you do not have a computer, you can also send your request by post for the attention of our Data Protection Officer to the following address:

FPS Mobility and Transport
For the attention of the DPO (9A64)
City Atrium
Rue du Progrès 56
1210 Brussels

We remind you that your identity must be reasonably verifiable so that we can be sure that no one else is trying to exercise your rights.
In principle, your request will be processed within one month. If your application is complex or if the Rail Accident and Incident Investigation Unit has to handle a large number of requests, this time limit may be extended by two months.

Data processing

1. Rail Accident and Incident Investigations

1.1. Description of processing

Investigation reports and any subsequent findings and recommendations provide crucial information for the future improvement of rail safety in the single European railway area.

Information is collected (files, minutes of meetings, interview minutes) within the framework of safety investigations and relates to companies (railway undertakings, infrastructure managers, safety authorities, manufacturers, entities in charge of maintenance, etc.) and their staff (in accordance with Implementing Regulation 2020/572).

Based on the investigative work, exchanges of views and experiences are also organised between counterpart European investigation units, with a view to developing common investigative methods and common principles for following-up on safety recommendations and adaptations to scientific and technical progress (in accordance with Article 114. of the Law of 30/08/2013 on the Railway Code).

1.2. Actors with access to this data

• Staff of the Belgian Investigation Unit
• Staff of the Investigation Unit and counterparts from another EU Member State (only in the framework of investigations as defined in Article 115 of the Law of 30/08/2013 on the Railway Code)
• Experts (pursuant to Art. 117 of the Law of 30/08/2013 on the Railway Code)

1.3. Purposes

Investigation reports and any subsequent findings and recommendations provide information for the future improvement of rail safety. Investigation reports will be drawn up as closely as possible in accordance with the structure set out in Annex I of the Implementing Regulation (EU) 2020/572. The Investigation Unit’s investigation reports are anonymised.

1.4. Legitimacy

Mission of the Investigation Unit (Law of 30/08/2013 on the Railway Code – Royal Decree of 16/01/2007 setting out certain rules relating to the investigation of rail accidents and incidents – Commission Implementing Regulation (EU) 2020/572 of 24 April 2020 on the reporting structure to be followed for railway accident and incident investigation reports).

1.5. Personal data

The content of verbal message recorders, the results of the examination of victims’ bodies, the results of the examination of the train crew and other railway staff involved, interviews with the railway staff involved and other witnesses, copies of statements made by these persons to other bodies, any relevant information or document held by SNCB-Holding, the manager of the railway infrastructure, the railway undertakings involved and the safety authority, the human and individual characteristics of the railway staff involved (training and development, skills and experience, medical and personal circumstances having an influence on the occurrence, including the existence of physical or psychological stress, fatigue, motivation and attitude).

1.6. Data retention

Data is kept for a period of 50 years.

1.7. Data sharing

Data is not shared with third parties (except for the actors defined in point 1.2).

2. Contact management

2.1. Description of processing

Management of the address book (professional contacts) accessible to the service.

2.2. Actors with access to this data

Staff of the Investigation Unit

2.3. Purposes

Contact the actors in the sector

2.4. Legitimacy

Legitimate interest

2.5. Personal data

Identification and contact details, title

2.6. Data retention

Data is kept until the data subject withdraws their consent.

2.7. Data sharing

Data is not shared with third parties.