Locomotive Voice and Video Recorder Regulations

Locomotive Voice and Video Recorder Regulations Her Excellency the Governor General in Council, on the recommendation of the Minister of Transport, pursuant to section 17.95a, subsection 37(1)b and section 40.1c of the Railway Safety Actd, makes the annexed Locomotive Voice and Video Recorder Regulations. S.C. 2018, c. 10, s. 62 S.C. 2015, c. 31, s. 31 S.C. 2012, c. 7, s. 31 R.S., c. 32 (4th Supp.) Definitions The following definitions apply in these Regulations. Act means the Railway Safety Act. (Loi) conductor means an employee who is in charge of the operation of a movement of railway equipment. (chef de train) controlling locomotive means the railway equipment from which an operating employee controls the movement of the locomotive and any other railway equipment connected to the locomotive. (locomotive de commande) locomotive engineer means an employee who is in control of the locomotive. (mécanicien de locomotive) LVVR system means a locomotive voice and video recorder system. (système d’EAVL) operating employee means an employee who performs the duties of a conductor or locomotive engineer. (membre du personnel de l’exploitation) TSB means the Canadian Transportation Accident Investigation and Safety Board. (BST) Application These Regulations apply to a company that meets at least one of the following criteria: the company realized gross revenues of at least $250 million for the provision of rail services in Canada in each of the two preceding calendar years and operates controlling locomotives on five miles or more of track in Canada; the company operates a passenger train service within a municipality or between adjacent municipalities; the company has 15 or more operating employees, operates controlling locomotives on 20 miles or more of track in Canada, operates at least one controlling locomotive at a speed of more than 25 miles per hour, and, if the company transports freight, generates more than 10% of its gross ton miles on track in Canada. Installation of LVVR system A company must ensure that an LVVR system is installed in every controlling locomotive that it operates. Exceptions However, a company is not required to ensure that an LVVR system is installed in a controlling locomotive that is a steam locomotive; heritage locomotive that is used exclusively for tourist railway services that travels no further than a round trip of 150 miles at a speed of no more than 25 miles per hour; locomotive in yard service that is used exclusively in switching, marshalling, humping, trimming and industrial switching; locomotive that is being used for testing and evaluation purposes; or locomotive that the company intends to decommission within 18 months after the day on which these Regulations come into force. Signage requirement A company must ensure that the interior of every controlling locomotive fitted with an LVVR system has signage, written in both official languages of Canada and in a font that is clear and readable from the furthest point from the signage in the controlling locomotive, that notifies persons in the controlling locomotive that they are subject to audio and video recording; and includes the following statements: “It is prohibited by law for any person to do anything, including altering the locomotive voice and video recorder system, with the intent to prevent information from being recorded, collected or preserved.” and “Il est interdit par la loi à quiconque de prendre une quelconque mesure, notamment d’altérer le système d’enregistrement audio et vidéo de locomotive, dans l’intention d’empêcher l’enregistrement, la collecte ou la conservation de renseignements.” LVVR system A company must ensure that an LVVR system is equipped with at least one crash-protected memory module; continuously records voice and video data from the time the controlling locomotive engine is turned on until it is turned off; does not record data when the controlling locomotive engine is turned off; stores 48 hours of data on at least one crash-protected memory module; automatically and permanently erases from any crash-protected memory module any data other than the most recent 48 hours of data that was stored by the LVVR system on the module; is equipped with an alternate power supply or with a controlled shutdown feature that allows for a complete shutdown of the LVVR system in the event of a power interruption; and restarts automatically when power is restored to the controlling locomotive engine. Environmental standards A company must ensure that, on installation, an LVVR system meets the environmental criteria respecting vibration, shock, bump and temperature testing set out in standard EN 50155:2017, Railway applications — Rolling stock — Electronic equipment, published by BSI Standards Limited, on October 31, 2017, as amended from time to time. Crashworthiness A company must ensure that a crash-protected memory module is installed in a controlling locomotive in the location that offers the most protection; and meets, on installation or replacement, the crashworthiness requirements set out in standard 1482.1-2013, IEEE Standard for Rail Transit Vehicle Event Recorders, published by the Institute of Electrical and Electronic Engineers on March 6, 2014, as amended from time to time. Microphones — voice quality A company must ensure that an LVVR system is equipped with one or more microphones that, collectively, are capable of clearly recording the voices of the operating employees and their communications; and aural warnings in the controlling locomotive, including alarms. Technical requirements The company must ensure that every microphone has its own recording channel; if it is used to record the voices of operating employees, records frequencies from 150 Hz to 3.5 kHz; and if it is used to record aural warnings in the controlling locomotive, records frequencies from 150 Hz to 6 kHz. Placement of microphones The company must ensure that the microphones are positioned in the controlling locomotive in a manner that allows the recording of the voice of the locomotive engineer, clearly and distinctly from the voice of the conductor; the voice of the conductor, clearly and distinctly from the voice of the locomotive engineer; and safety-related sounds and aural warnings in the controlling locomotive, including alarms. Cameras — video quality A company must ensure that an LVVR system is equipped with one or more cameras that record at a minimum frame rate of 15 frames per second clear video in all lighting conditions; video with a resolution sufficient to determine the status of instrument displays in the controlling locomotive; and video with a resolution sufficient to determine the reactions of the operating employees, including their facial features and expressions. Placement of cameras The company must ensure that the cameras are positioned in the controlling locomotive in a manner that allows the recording of the portion of the interior of the controlling locomotive where the operating employees carry out their work; an unobstructed view of the instruments and controls required to operate the controlling locomotive; and an unobstructed view of the faces and upper bodies of operating employees at a distance close enough to discern their facial features and expressions. Additional cameras For greater certainty, a company that has satisfied the requirements set out in subsections (1) and (2) may equip an LVVR system with additional cameras that do not meet those requirements. Coordinated Universal Time A company must ensure that the voice and video data recorded by an LVVR system has accurate date and time stamps that are expressed in Coordinated Universal Time (UTC). Synchronization requirements The company must ensure that the date and time stamps of the voice data that is recorded by each microphone of an LVVR system are synchronized, to the second, with the date and time stamps of the video data that is recorded by each camera of that system; the date and time stamps of the voice and video data recorded by an LVVR system are synchronized, to the second, with the date and time stamps of locomotive event recorder data, global positioning system (GPS) data, if applicable, and the video data recorded by any outward-facing camera. Playback synchronization The company must ensure that the voice and video data recorded by an LVVR system is capable of being automatically synchronized on a playback system. Synchronization testing The company must carry out a test of each LVVR system at least once every 12 months to verify compliance with the synchronization requirements set out in subsection (2). Record keeping The company must keep a record of each test carried out under subsection (4) for a period of six years after the day of the test and provide a copy to the Minister on request. Test recordings A company must ensure that test recordings are carried out for each LVVR system installed in a controlling locomotive operated by the company to demonstrate that the system meets the requirements set out in section 8, paragraphs 9(1)(b) and (c) and subsections 9(2), 10(3) and 23(1). Frequency The test recordings must be carried out in respect of an LVVR system once per year and at each of the following times: on installation of the system in the controlling locomotive, if the company itself installs the system; prior to the company’s initial operation of the controlling locomotive, if the company itself did not install the system; and each time a component of the system is repaired, replaced or updated. Retention of test recordings The company must keep the test recordings required under subsection (1) for a period of six years after the day on which they are carried out and provide a copy to the Minister on request. Policy and procedures A company must develop, implement and make available to all employees a written policy that includes a description of the purposes under section 17.91 of the Act for which the company intends to record, collect or preserve voice and video data; procedures for collecting, communicating, accessing and using voice and video data; and procedures for record keeping. Retention of policy The company must keep the policy while it is in effect and for a period of six years after the day on which it is replaced and provide a copy to the Minister on request. Accountable executive A company must designate a member of senior management who is responsible for the operations of the company as the accountable executive to be accountable for meeting the requirements of these Regulations, including implementing the policy referred to in section 12. Notice to Minister The company must submit to the Minister, within 30 days after the designation, the name and title of the accountable executive and a statement signed by that person confirming that they accept the responsibilities of the position. Authorized persons — voice and video data A company must designate the persons it authorizes to take one or more of the following actions and make a record of their names and positions: collecting voice and video data from a crash-protected memory module or from any other storage location where such data is automatically stored; communicating voice and video data; and accessing and using voice and video data for the purposes of paragraph 17.91(1)(a) or (b) or subsection 17.91(3) of the Act, as applicable. Prohibition For the purposes of paragraph (1)(c), the company must not designate any person who directly manages operating employees to access or use voice and video data under paragraph 17.91(1)(a) of the Act. Requirement A company must ensure that only a person authorized to take the action referred to in paragraph (1)(a), (b) or (c) takes that action. The company must keep any record required under subsection (1) while it is current and for a period of six years after the day on which it is revised and provide a copy to the Minister on request. Authorized persons — training A company must provide training on the policy required under section 12 to each person designated under subsection 14(1) before the person takes any actions referred to in paragraphs 14(1)(a) to (c). Additional training If the company makes any changes to the policy, the company must provide training on the changes to each person designated under subsection 14(1). Safeguards — LVVR system A company must ensure that an LVVR system is equipped with physical safeguards that are designed to prevent tampering, including reducing the field of view of the cameras. Safeguards — voice and video data A company must ensure that crash-protected memory modules and any other storage locations containing voice or video data that was recorded in a controlling locomotive operated by the company are subject to safeguards that are designed to prevent unauthorized access to the data, including physical safeguards such as locked filing cabinets and restricted access to offices, organizational safeguards such as requiring a continuous chain of custody and technological safeguards such as the use of passwords and encryption. Clarification For greater certainty, even if a company uses a storage provider operated by a third party to back up or store voice or video data that was recorded in a controlling locomotive operated by the company, the company is responsible for complying with the provisions of the Act and these Regulations in respect of that data. Virtual storage provider If a company uses a virtual storage provider, including a cloud storage provider, to back up or store voice or video data that was recorded in a controlling locomotive operated by the company, the company must ensure that the provider is accredited under a current internationally recognized standard respecting information security management systems. Record of data access or download A company must ensure that any technological means it uses to access or download voice or video data from a crash-protected memory module, or any other storage location where such data is automatically stored, automatically generates an unalterable record each time such data is accessed or downloaded. Contents of record The record must include the following information: an electronic signature that uniquely identifies the person who accessed or downloaded the voice or video data; the date and time the data was accessed or downloaded; the date and time stamps of the data; and the number or other identifier that uniquely identifies the controlling locomotive in which the data was recorded. Monthly report The company must, on a monthly basis, make available to all operating employees a report that includes the information referred to in subsection (2) that was generated during the preceding month. Retention of documents The company must keep the records and reports described in subsections (1) and (3) for a period of six years after the day on which they are created and provide a copy to the Minister on request. Request from Minister or inspector On receipt of a request to obtain, for use by the Minister under paragraph 17.92(1)(b) or (c) of the Act or for use by a railway safety inspector under subsection 17.93(1) of the Act, voice or video data that was recorded in a controlling locomotive operated by the company, the company must communicate the data to the Minister or the railway safety inspector, as the case may be. Secure communications If a company communicates voice or video data that was recorded in a controlling locomotive operated by the company, it must communicate the data in a format that prevents unauthorized access. Communications with TSB If a company communicates to the TSB voice or video data that was recorded in a controlling locomotive operated by the company, it must provide the software and equipment required to use the data, either in advance of or at the time that it communicates the data. Communications with Minister If a company is required to communicate voice or video data that was recorded in a controlling locomotive operated by the company to the Minister, the company must transfer the data to the Minister and, on request, provide the software and equipment required to use the data. Communications with railway safety inspector If a company is required to communicate voice or video data that was recorded in a controlling locomotive operated by the company to a railway safety inspector, the company must make the data available to the inspector. Playback of data A company must ensure that voice and video data is capable of being played back in such a way that the communications of the operating employees are understandable; and the voice of each operating employee is identifiable and clearly distinguishable. Playback system A company must ensure that any playback system used to review voice or video data allows for an uninterrupted review of the data and includes play, pause, rewind and fast-forward functions. Accessing and using data — conditions A company must not access or use, for the purpose of paragraph 17.91(1)(b) of the Act, voice or video data that was recorded in a controlling locomotive operated by the company unless it has identified that the controlling locomotive was involved in the accident or incident; and has reason to believe that activities in the controlling locomotive caused or contributed to the accident or incident. Accessing and using data — types For the purpose of paragraph 17.91(1)(b) of the Act, the voice and video data that a company may access and use is the data from the controlling locomotive involved in the accident or incident that was recorded during the shift of any operating employee who was present when the accident or incident occurred; and during a shift immediately preceding a shift referred to in paragraph (a) if, prior to accessing or using the data, the company has notified all operating employees who are present on the recording, and any bargaining agents representing those employees, that it intends to use the data. For greater certainty, if, at the time of an accident or incident, a company cannot identify which controlling locomotive was involved, the company must not use voice or video data for the purpose of making that determination. Data collection On receipt of a request for voice or video data related to an accident or incident for use by the Minister under subsection 17.92(1) of the Act or for use by a railway safety inspector under subsection 17.93(1) of the Act, a company must ensure that, before the data is permanently erased, it is collected from the crash-protected memory module or any other storage location where the data is automatically stored, and preserved in another storage location. Process To randomly select voice and video data as required by subsection 17.91(2) of the Act, a company must use a random number generator to select, in the following order, the day of the month from which the data will be selected; the controlling locomotives from which the data will be selected; and a maximum of three start times, to the minute, for each of the controlling locomotives. Random selection The company must ensure that, when making the selections set out in subsection (1), no day, controlling locomotive or start time has a greater likelihood of being selected than another. Selecting the day of the month For the purpose of paragraph (1)(a), the company must use the random number generator during the week preceding the beginning of the month. Selecting controlling locomotives For the purpose of paragraph (1)(b), the company must select at least two controlling locomotives from among all of the controlling locomotives that the company is scheduled to operate in Canada on the day selected under paragraph 1(a). The number of controlling locomotives selected must not exceed 10% of the controlling locomotives that the company is scheduled to operate in Canada on that day. Selecting start times For the purpose of paragraph (1)(c), the company may include parameters to ensure that the selected start times are chosen from among the times that the controlling locomotives are scheduled to operate. Obligation to download A company must download 30 minutes of voice and video data beginning from each selected start time before the data is permanently erased from the crash-protected memory module or any other storage location where such data is automatically stored. Prohibition — maximum of 30 minutes A company must not download more than 30 minutes of voice and video data beginning from each selected start time. Prohibition — repeated selection process A company must not perform the selections set out in paragraph (1)(a) to (c) more than once in respect of a given month. Random selection policy A company must develop and implement a written random selection policy that identifies the persons in the company who are authorized to perform the selections set out in subsection (1); ensures that no person who schedules or manages employees performs the selections set out in subsection (1) or influences any person who does; and identifies and describes the random number generator that the company uses to perform the selections set out in subsection (1). Use of voice and video data For the purpose of paragraph 17.91(1)(a) of the Act, a company must use all voice and video data selected in accordance with section 26 within 30 days after downloading the data. Submission of random selection policy to Minister A company must submit a copy of the random selection policy required under subsection 26(9) to the Minister before selecting any voice and video data for the purpose of paragraph 17.91(1)(a) of the Act. Changes to policy If a company changes its random selection policy after submitting it to the Minister, the company must submit a copy of the updated policy to the Minister before selecting any voice and video data for the purpose of paragraph 17.91(1)(a) of the Act. Request by Minister On receipt of a request to obtain, for use by the Minister under paragraph 17.92(1)(a) of the Act, voice or video data that was recorded in a controlling locomotive operated by the company, the company must communicate to the Minister data that the company has randomly selected in accordance with any methodology provided by the Minister; the Minister has randomly selected; or the company has randomly selected for the purpose of paragraph 17.91(1)(a) of the Act. List of controlling locomotives For the purpose of paragraph (1)(b), a company must provide to the Minister, on request, a list of its controlling locomotives that are scheduled to be in operation in Canada on any day or in any location selected by the Minister. Downloading data A company must download all voice and video data requested under subsection (1) before it is permanently erased from the crash-protected memory module or any other storage location where such data is automatically stored. Prescribed threats For the purpose of subsection 17.91(3) of the Act, a company may use voice and video data to address the following threats to the safety of railway operations: an operating employee who uses a cellular telephone while on duty when normal railway radio communication systems are available, except as provided for in company policies; an operating employee who assumes a sleeping position while on duty, except as provided for in company policies; an operating employee who uses a personal entertainment device while on duty, except as provided for in company policies; the presence of an unauthorized person in the controlling locomotive; an operating employee who is consuming or using intoxicants or impairing drugs; an operating employee who reads materials not required in the performance of their duties while on duty, except as provided for in company policies; and operating employees who are within hearing range of each other but who are not verbally communicating, in a clear and audible manner, information they are required to verbally communicate in accordance with rules approved or established by the Minister under sections 19 and 20 of the Act. Employee access to data If a company identifies a threat set out in section 30 when it is using voice or video data for the purposes of subsection 17.91(1) of the Act, the company must as soon as possible, notify all identifiable persons present on the recording of the data that the company has identified a threat on that recording; within 30 days after the notice is provided under paragraph (a), advise any employee the company has deemed responsible for the threat as to whether the data will be used to address the threat; make the data available to any employee whom the company has deemed responsible for the threat, on request of the employee; and before the data is made available under paragraph (c), notify any other person referred to in paragraph (a) that the data will be made available to the employee deemed responsible for the threat. Erasure of data — storage locations A company must ensure that voice and video data is permanently erased from any storage location where such data is automatically stored, other than a crash-protected memory module, before or at the same time as the corresponding data is permanently erased from a crash-protected memory module in accordance with paragraph 5(e). Erasure of data — when purpose achieved If a company preserves voice or video data for any purpose set out in sections 17.91 to 17.93 of the Act, the company must permanently erase the data from all storage locations as soon as the data is no longer required for that purpose. Exception — paragraph 17.91(1)(a) of the Act Despite subsection (1), if a company uses voice or video data for the purpose of paragraph 17.91(1)(a) of the Act, the company must permanently erase the data from all storage locations within 30 days after downloading the data. Exception — threat to safety of railway operations Despite subsections (1) and (2), if a company preserves voice and video data for any purpose set out in subsection 17.91(1) of the Act and uses the data to address a threat to the safety of railway operations set out in section 30, the company must preserve the data for at least two years after the day on which the decision to address the threat was made and permanently erase the data from all storage locations as soon as the following conditions have been met: two years have passed since the decision to address the threat was made; and the data is no longer required for the purpose for which it was preserved. Accessing or using voice or video data Each time a company accesses or uses voice or video data, the company must make a record that sets out the name of the person who accessed or used the data; the date and time the data was accessed or used; the date and time stamps of the data; the number or other identifier that uniquely identifies the controlling locomotive on which the data was recorded; and the purpose for which the data was accessed or used. Communication of voice or video data Each time a company communicates voice or video data to the TSB, the Minister or a railway safety inspector, the company must make a record that sets out the purpose for which the data was communicated; the date and time the data was communicated; the name of the person who communicated the data; and the name of any individual who received or, as applicable, viewed the data and the organization they represent. The company must keep the records referred to in subsections (1) and (2) for a period of six years after the day on which they are created and provide a copy of any record to the Minister on request. Record of random selection Each time a company randomly selects voice and video data for the purposes of paragraph 17.91(1)(a) or 17.92(1)(a) of the Act, the company must make a record that sets out each selection made in accordance with subsection 26(1) or any methodology provided by the Minister under paragraph 29(1)(a), including the full data set from which each selection was made; the name and position of the person who performed each selection; and the voice and video data that was downloaded. The company must keep the records referred to in subsection (1) for a period of six years after the day on which they are created and provide a copy of any record to the Minister on request. Data use — threats to safety of railway operations Each time a company uses voice or video data to address a threat to the safety of railway operations set out in section 30, the company must make a record that sets out the purpose for which the data was used under subsection 17.91(1) of the Act; the threat to the safety of railway operations that was addressed; and the day on which the decision to address the threat was made. The company must keep the record referred to in subsection (1) for a period of six years after the day on which it is created and provide a copy of any record to the Minister on request. Erasure of voice or video data Each time a company permanently erases voice or video data in accordance with section 33, the company must make a record that sets out the method used to erase the data; the date and time the data was erased; all storage locations from which the data was erased; and the name and position of the person who erased the data. Copies kept in Canada The company must keep at its principal place of business in Canada a copy of any record, test recording, policy and report that it is required to keep under these Regulations. [Amendments] Second anniversary These Regulations come into force on the second anniversary of the day on which they are published in the Canada Gazette, Part II. [Note: Regulations in force September 2, 2022.]