Her Excellency the Governor General in Council, on the recommendation of the Minister of Transport, pursuant to section 17.95 a, subsection 37(1) b and section 40.1 c of the Railway Safety Act d, makes the annexed Locomotive Voice and Video Recorder Regulations.
General Provisions
The following definitions apply in these Regulations.
Act means the Railway Safety Act. (Loi)
conductor means an employee who is in charge of the operation of a movement of railway equipment. (chef de train)
controlling locomotive means the railway equipment from which an operating employee controls the movement of the locomotive and any other railway equipment connected to the locomotive. (locomotive de commande)
locomotive engineer means an employee who is in control of the locomotive. (mécanicien de locomotive)
LVVR system means a locomotive voice and video recorder system. (système d’EAVL)
operating employee means an employee who performs the duties of a conductor or locomotive engineer. (membre du personnel de l’exploitation)
TSB means the Canadian Transportation Accident Investigation and Safety Board. (BST)
These Regulations apply to a company that meets at least one of the following criteria:
the company realized gross revenues of at least $250 million for the provision of rail services in Canada in each of the two preceding calendar years and operates controlling locomotives on five miles or more of track in Canada;
the company operates a passenger train service within a municipality or between adjacent municipalities;
the company has 15 or more operating employees, operates controlling locomotives on 20 miles or more of track in Canada, operates at least one controlling locomotive at a speed of more than 25 miles per hour, and, if the company transports freight, generates more than 10% of its gross ton miles on track in Canada.
A company must ensure that an LVVR system is installed in every controlling locomotive that it operates.
However, a company is not required to ensure that an LVVR system is installed in a controlling locomotive that is a
steam locomotive;
heritage locomotive that is used exclusively for tourist railway services that travels no further than a round trip of 150 miles at a speed of no more than 25 miles per hour;
locomotive in yard service that is used exclusively in switching, marshalling, humping, trimming and industrial switching;
locomotive that is being used for testing and evaluation purposes; or
locomotive that the company intends to decommission within 18 months after the day on which these Regulations come into force.
A company must ensure that the interior of every controlling locomotive fitted with an LVVR system has signage, written in both official languages of Canada and in a font that is clear and readable from the furthest point from the signage in the controlling locomotive, that
notifies persons in the controlling locomotive that they are subject to audio and video recording; and
includes the following statements: “It is prohibited by law for any person to do anything, including altering the locomotive voice and video recorder system, with the intent to prevent information from being recorded, collected or preserved.” and “Il est interdit par la loi à quiconque de prendre une quelconque mesure, notamment d’altérer le système d’enregistrement audio et vidéo de locomotive, dans l’intention d’empêcher l’enregistrement, la collecte ou la conservation de renseignements.”
Technical Requirements
A company must ensure that an LVVR system
is equipped with at least one crash-protected memory module;
continuously records voice and video data from the time the controlling locomotive engine is turned on until it is turned off;
does not record data when the controlling locomotive engine is turned off;
stores 48 hours of data on at least one crash-protected memory module;
automatically and permanently erases from any crash-protected memory module any data other than the most recent 48 hours of data that was stored by the LVVR system on the module;
is equipped with an alternate power supply or with a controlled shutdown feature that allows for a complete shutdown of the LVVR system in the event of a power interruption; and
restarts automatically when power is restored to the controlling locomotive engine.
A company must ensure that, on installation, an LVVR system meets the environmental criteria respecting vibration, shock, bump and temperature testing set out in standard EN 50155:2017, Railway applications — Rolling stock — Electronic equipment, published by BSI Standards Limited, on October 31, 2017, as amended from time to time.
A company must ensure that a crash-protected memory module
is installed in a controlling locomotive in the location that offers the most protection; and
meets, on installation or replacement, the crashworthiness requirements set out in standard 1482.1-2013, IEEE Standard for Rail Transit Vehicle Event Recorders, published by the Institute of Electrical and Electronic Engineers on March 6, 2014, as amended from time to time.
A company must ensure that an LVVR system is equipped with one or more microphones that, collectively, are capable of clearly recording
the voices of the operating employees and their communications; and
aural warnings in the controlling locomotive, including alarms.
The company must ensure that every microphone
has its own recording channel;
if it is used to record the voices of operating employees, records frequencies from 150 Hz to 3.5 kHz; and
if it is used to record aural warnings in the controlling locomotive, records frequencies from 150 Hz to 6 kHz.
The company must ensure that the microphones are positioned in the controlling locomotive in a manner that allows the recording of
the voice of the locomotive engineer, clearly and distinctly from the voice of the conductor;
the voice of the conductor, clearly and distinctly from the voice of the locomotive engineer; and
safety-related sounds and aural warnings in the controlling locomotive, including alarms.
A company must ensure that an LVVR system is equipped with one or more cameras that record at a minimum frame rate of 15 frames per second
clear video in all lighting conditions;
video with a resolution sufficient to determine the status of instrument displays in the controlling locomotive; and
video with a resolution sufficient to determine the reactions of the operating employees, including their facial features and expressions.
The company must ensure that the cameras are positioned in the controlling locomotive in a manner that allows the recording of
the portion of the interior of the controlling locomotive where the operating employees carry out their work;
an unobstructed view of the instruments and controls required to operate the controlling locomotive; and
an unobstructed view of the faces and upper bodies of operating employees at a distance close enough to discern their facial features and expressions.
A company must ensure that the voice and video data recorded by an LVVR system has accurate date and time stamps that are expressed in Coordinated Universal Time (UTC).
The company must ensure that
the date and time stamps of the voice data that is recorded by each microphone of an LVVR system are synchronized, to the second, with the date and time stamps of the video data that is recorded by each camera of that system;
the date and time stamps of the voice and video data recorded by an LVVR system are synchronized, to the second, with the date and time stamps of
locomotive event recorder data,
global positioning system (GPS) data, if applicable, and
the video data recorded by any outward-facing camera.
The company must ensure that the voice and video data recorded by an LVVR system is capable of being automatically synchronized on a playback system.
The company must carry out a test of each LVVR system at least once every 12 months to verify compliance with the synchronization requirements set out in subsection (2).
The company must keep a record of each test carried out under subsection (4) for a period of six years after the day of the test and provide a copy to the Minister on request.
The test recordings must be carried out in respect of an LVVR system once per year and at each of the following times:
on installation of the system in the controlling locomotive, if the company itself installs the system;
prior to the company’s initial operation of the controlling locomotive, if the company itself did not install the system; and
each time a component of the system is repaired, replaced or updated.
The company must keep the test recordings required under subsection (1) for a period of six years after the day on which they are carried out and provide a copy to the Minister on request.
Data Management Requirements
A company must develop, implement and make available to all employees a written policy that includes
a description of the purposes under section 17.91 of the Act for which the company intends to record, collect or preserve voice and video data;
procedures for collecting, communicating, accessing and using voice and video data; and
procedures for record keeping.
The company must keep the policy while it is in effect and for a period of six years after the day on which it is replaced and provide a copy to the Minister on request.
A company must designate a member of senior management who is responsible for the operations of the company as the accountable executive to be accountable for meeting the requirements of these Regulations, including implementing the policy referred to in section 12.
The company must submit to the Minister, within 30 days after the designation, the name and title of the accountable executive and a statement signed by that person confirming that they accept the responsibilities of the position.
A company must designate the persons it authorizes to take one or more of the following actions and make a record of their names and positions:
collecting voice and video data from a crash-protected memory module or from any other storage location where such data is automatically stored;
communicating voice and video data; and
accessing and using voice and video data for the purposes of paragraph 17.91(1)(a) or (b) or subsection 17.91(3) of the Act, as applicable.
For the purposes of paragraph (1)(c), the company must not designate any person who directly manages operating employees to access or use voice and video data under paragraph 17.91(1)(a) of the Act.
A company must ensure that only a person authorized to take the action referred to in paragraph (1)(a), (b) or (c) takes that action.
The company must keep any record required under subsection (1) while it is current and for a period of six years after the day on which it is revised and provide a copy to the Minister on request.
If the company makes any changes to the policy, the company must provide training on the changes to each person designated under subsection 14(1).
A company must ensure that an LVVR system is equipped with physical safeguards that are designed to prevent tampering, including reducing the field of view of the cameras.
A company must ensure that crash-protected memory modules and any other storage locations containing voice or video data that was recorded in a controlling locomotive operated by the company are subject to safeguards that are designed to prevent unauthorized access to the data, including physical safeguards such as locked filing cabinets and restricted access to offices, organizational safeguards such as requiring a continuous chain of custody and technological safeguards such as the use of passwords and encryption.
For greater certainty, even if a company uses a storage provider operated by a third party to back up or store voice or video data that was recorded in a controlling locomotive operated by the company, the company is responsible for complying with the provisions of the Act and these Regulations in respect of that data.
If a company uses a virtual storage provider, including a cloud storage provider, to back up or store voice or video data that was recorded in a controlling locomotive operated by the company, the company must ensure that the provider is accredited under a current internationally recognized standard respecting information security management systems.
A company must ensure that any technological means it uses to access or download voice or video data from a crash-protected memory module, or any other storage location where such data is automatically stored, automatically generates an unalterable record each time such data is accessed or downloaded.
The record must include the following information:
an electronic signature that uniquely identifies the person who accessed or downloaded the voice or video data;
the date and time the data was accessed or downloaded;
the date and time stamps of the data; and
the number or other identifier that uniquely identifies the controlling locomotive in which the data was recorded.
The company must, on a monthly basis, make available to all operating employees a report that includes the information referred to in subsection (2) that was generated during the preceding month.
Communication Requirements
On receipt of a request to obtain, for use by the Minister under paragraph 17.92(1)(b) or (c) of the Act or for use by a railway safety inspector under subsection 17.93(1) of the Act, voice or video data that was recorded in a controlling locomotive operated by the company, the company must communicate the data to the Minister or the railway safety inspector, as the case may be.
If a company communicates voice or video data that was recorded in a controlling locomotive operated by the company, it must communicate the data in a format that prevents unauthorized access.
If a company communicates to the TSB voice or video data that was recorded in a controlling locomotive operated by the company, it must provide the software and equipment required to use the data, either in advance of or at the time that it communicates the data.
If a company is required to communicate voice or video data that was recorded in a controlling locomotive operated by the company to the Minister, the company must transfer the data to the Minister and, on request, provide the software and equipment required to use the data.
If a company is required to communicate voice or video data that was recorded in a controlling locomotive operated by the company to a railway safety inspector, the company must make the data available to the inspector.
A company must ensure that voice and video data is capable of being played back in such a way that
the communications of the operating employees are understandable; and
the voice of each operating employee is identifiable and clearly distinguishable.
A company must ensure that any playback system used to review voice or video data allows for an uninterrupted review of the data and includes play, pause, rewind and fast-forward functions.
Accident and Incident Investigations
A company must not access or use, for the purpose of paragraph 17.91(1)(b) of the Act, voice or video data that was recorded in a controlling locomotive operated by the company unless it
has identified that the controlling locomotive was involved in the accident or incident; and
has reason to believe that activities in the controlling locomotive caused or contributed to the accident or incident.
For the purpose of paragraph 17.91(1)(b) of the Act, the voice and video data that a company may access and use is the data from the controlling locomotive involved in the accident or incident that was recorded
during the shift of any operating employee who was present when the accident or incident occurred; and
during a shift immediately preceding a shift referred to in paragraph (a) if, prior to accessing or using the data, the company has notified all operating employees who are present on the recording, and any bargaining agents representing those employees, that it intends to use the data.
For greater certainty, if, at the time of an accident or incident, a company cannot identify which controlling locomotive was involved, the company must not use voice or video data for the purpose of making that determination.
On receipt of a request for voice or video data related to an accident or incident for use by the Minister under subsection 17.92(1) of the Act or for use by a railway safety inspector under subsection 17.93(1) of the Act, a company must ensure that, before the data is permanently erased, it is collected from the crash-protected memory module or any other storage location where the data is automatically stored, and preserved in another storage location.
Random Selection
To randomly select voice and video data as required by subsection 17.91(2) of the Act, a company must use a random number generator to select, in the following order,
the day of the month from which the data will be selected;
the controlling locomotives from which the data will be selected; and
a maximum of three start times, to the minute, for each of the controlling locomotives.
The company must ensure that, when making the selections set out in subsection (1), no day, controlling locomotive or start time has a greater likelihood of being selected than another.
For the purpose of paragraph (1)(a), the company must use the random number generator during the week preceding the beginning of the month.
For the purpose of paragraph (1)(b), the company must select at least two controlling locomotives from among all of the controlling locomotives that the company is scheduled to operate in Canada on the day selected under paragraph 1(a). The number of controlling locomotives selected must not exceed 10% of the controlling locomotives that the company is scheduled to operate in Canada on that day.
For the purpose of paragraph (1)(c), the company may include parameters to ensure that the selected start times are chosen from among the times that the controlling locomotives are scheduled to operate.
A company must download 30 minutes of voice and video data beginning from each selected start time before the data is permanently erased from the crash-protected memory module or any other storage location where such data is automatically stored.
A company must not download more than 30 minutes of voice and video data beginning from each selected start time.
A company must not perform the selections set out in paragraph (1)(a) to (c) more than once in respect of a given month.
A company must develop and implement a written random selection policy that
identifies the persons in the company who are authorized to perform the selections set out in subsection (1);
ensures that no person who schedules or manages employees performs the selections set out in subsection (1) or influences any person who does; and
identifies and describes the random number generator that the company uses to perform the selections set out in subsection (1).
For the purpose of paragraph 17.91(1)(a) of the Act, a company must use all voice and video data selected in accordance with section 26 within 30 days after downloading the data.
A company must submit a copy of the random selection policy required under subsection 26(9) to the Minister before selecting any voice and video data for the purpose of paragraph 17.91(1)(a) of the Act.
If a company changes its random selection policy after submitting it to the Minister, the company must submit a copy of the updated policy to the Minister before selecting any voice and video data for the purpose of paragraph 17.91(1)(a) of the Act.
On receipt of a request to obtain, for use by the Minister under paragraph 17.92(1)(a) of the Act, voice or video data that was recorded in a controlling locomotive operated by the company, the company must communicate to the Minister data that
the company has randomly selected in accordance with any methodology provided by the Minister;
the Minister has randomly selected; or
the company has randomly selected for the purpose of paragraph 17.91(1)(a) of the Act.
For the purpose of paragraph (1)(b), a company must provide to the Minister, on request, a list of its controlling locomotives that are scheduled to be in operation in Canada on any day or in any location selected by the Minister.
A company must download all voice and video data requested under subsection (1) before it is permanently erased from the crash-protected memory module or any other storage location where such data is automatically stored.
Threats to Safety of Railway Operations
For the purpose of subsection 17.91(3) of the Act, a company may use voice and video data to address the following threats to the safety of railway operations:
an operating employee who uses a cellular telephone while on duty when normal railway radio communication systems are available, except as provided for in company policies;
an operating employee who assumes a sleeping position while on duty, except as provided for in company policies;
an operating employee who uses a personal entertainment device while on duty, except as provided for in company policies;
the presence of an unauthorized person in the controlling locomotive;
an operating employee who is consuming or using intoxicants or impairing drugs;
an operating employee who reads materials not required in the performance of their duties while on duty, except as provided for in company policies; and
If a company identifies a threat set out in section 30 when it is using voice or video data for the purposes of subsection 17.91(1) of the Act, the company must
as soon as possible, notify all identifiable persons present on the recording of the data that the company has identified a threat on that recording;
within 30 days after the notice is provided under paragraph (a), advise any employee the company has deemed responsible for the threat as to whether the data will be used to address the threat;
make the data available to any employee whom the company has deemed responsible for the threat, on request of the employee; and
Preservation and Erasure of Voice and Video Data
A company must ensure that voice and video data is permanently erased from any storage location where such data is automatically stored, other than a crash-protected memory module, before or at the same time as the corresponding data is permanently erased from a crash-protected memory module in accordance with paragraph 5(e).
If a company preserves voice or video data for any purpose set out in sections 17.91 to 17.93 of the Act, the company must permanently erase the data from all storage locations as soon as the data is no longer required for that purpose.
Despite subsection (1), if a company uses voice or video data for the purpose of paragraph 17.91(1)(a) of the Act, the company must permanently erase the data from all storage locations within 30 days after downloading the data.
Despite subsections (1) and (2), if a company preserves voice and video data for any purpose set out in subsection 17.91(1) of the Act and uses the data to address a threat to the safety of railway operations set out in section 30, the company must preserve the data for at least two years after the day on which the decision to address the threat was made and permanently erase the data from all storage locations as soon as the following conditions have been met:
two years have passed since the decision to address the threat was made; and
the data is no longer required for the purpose for which it was preserved.
Record Keeping
Each time a company accesses or uses voice or video data, the company must make a record that sets out
the name of the person who accessed or used the data;
the date and time the data was accessed or used;
the date and time stamps of the data;
the number or other identifier that uniquely identifies the controlling locomotive on which the data was recorded; and
the purpose for which the data was accessed or used.
Each time a company communicates voice or video data to the TSB, the Minister or a railway safety inspector, the company must make a record that sets out
the purpose for which the data was communicated;
the date and time the data was communicated;
the name of the person who communicated the data; and
the name of any individual who received or, as applicable, viewed the data and the organization they represent.
Each time a company randomly selects voice and video data for the purposes of paragraph 17.91(1)(a) or 17.92(1)(a) of the Act, the company must make a record that sets out
the name and position of the person who performed each selection; and
the voice and video data that was downloaded.
The company must keep the records referred to in subsection (1) for a period of six years after the day on which they are created and provide a copy of any record to the Minister on request.
Each time a company uses voice or video data to address a threat to the safety of railway operations set out in section 30, the company must make a record that sets out
the purpose for which the data was used under subsection 17.91(1) of the Act;
the threat to the safety of railway operations that was addressed; and
the day on which the decision to address the threat was made.
The company must keep the record referred to in subsection (1) for a period of six years after the day on which it is created and provide a copy of any record to the Minister on request.
Each time a company permanently erases voice or video data in accordance with section 33, the company must make a record that sets out
the method used to erase the data;
the date and time the data was erased;
all storage locations from which the data was erased; and
the name and position of the person who erased the data.
The company must keep the record referred to in subsection (1) for a period of six years after the day on which it is created and provide a copy of any record to the Minister on request.
The company must keep at its principal place of business in Canada a copy of any record, test recording, policy and report that it is required to keep under these Regulations.
Consequential Amendments to the Railway Safety Administrative Monetary Penalties Regulations
[Amendments]
[Amendments]
Coming into Force
These Regulations come into force on the second anniversary of the day on which they are published in the Canada Gazette, Part II.[Note: Regulations in force September 2, 2022.]