There are two recorders that are mandatory on board commercial aircraft: CVR for voice, and FDR for data. They are designed to survive an accident and include an ultrasonic beacon to facilitate locating them underwater.
(Source)
It's worth mentioning that CVR and FDR are not connected to any external data port for data export/copy/extraction, and extraction of the recorders after an accident is done exclusively by the investigating agency.
(As everybody knows for years, these recorders are orange, so there is no need for journalists to continue to call them 'black boxes' as if we were not in the secret too and may not get what they are talking about...)
Cockpit voice recorder (CVR)
The CVR is a sensitive question. Crews have accepted the recording of cockpit conversations to help understand accidents. One condition is the conversations remain private in other circumstances. So there is definitely no other allowed use of the CVR.
Flight data recorder (FDR)
Certain technical parameters, like inputs on the flight controls, must be recorded, also to help determine the cause of an accident. Most FDRs record many more parameters than mandatory. Still the FDR cannot be used in other circumstances than an investigation (see section about data privacy further down).
Using in-flight data for improvement
FDR data causes less privacy concerns than CVR conversations. Safety agencies over the world have encouraged airlines and manufacturers to set up improvement programs (quality improvement) taking into account in-flight technical parameters.
(Source)
Quality improvement initiatives include:
FDM allows companies to:
Compare their flight standards (SOPs) and the crews' actual actions. This is a way to enforce SOPs, and detect deviations from SOPs, hence crews may be reluctant to see this becoming mandatory.
Detect excessive forces applied to the aircraft, that require maintenance checks and/or repairs.
Set fuel consumption improvement actions.
As the FDR data cannot be exported, new recorders used for data monitoring and analysis are now seen on aircraft.
Quick access recorders (QAR)
Quick access recorders (QAR) are used in place of FDR, they allow much freedom, they don't have the same use and disclosure restrictions, don't have to resist a crash and can be included in wireless networks. For example this is Wifi/Ethernet QAR:
(Source)
QAR use the same data acquisition unit (DFDAU) as the FDR, using ARINC 573/717 links. They are essentially duplicating and extending the mandatory FDR, but data can be read at any time using data links. This access is not limited to investigation purposes.
Optical quick access recorders (OQAR) are QARs storing data on optical disks (e.g. Curtis-Wright), and they can record up to weeks or months of flight data. On the other hand, very small "micro" QARs exist too. This well known one uses a CompactFlash card:
(Source)
Countries like India have mandated flight data monitoring and analysis using such devices, but most regulation bodies have taken into account the reluctance of crews regarding the spreading of sensitive data, and the programs remain subject to airline decision.
Privacy aspects of CVR and FDR data
This section is likely very incomplete as the topic is complex.
ICAO:
Investigation-related recommendations are described in Annex 13 to the Chicago Convention on International Civil Aviation: Aircraft Accident and Incident Investigation.
Non-disclosure of records. 5.12 The State conducting the investigation [...] shall not make the following records available for purposes other than accident or incident investigation, unless the appropriate authority for the administration of justice in that State [...]: [...] b) all communications between persons having been involved in the operation of the aircraft; [...] d) cockpit voice recordings and transcripts from such recordings; 5.12.1 These records shall be included in the final report [...] only when pertinent to the analysis of the accident or incident. Parts of the records not relevant to the analysis shall not be disclosed.
Flight recorder cover both voice and data:
Flight recorder. Any type of recorder installed in the aircraft for the purpose of complementing accident/incident investigation.
However only CVR is mentioned in the article above, so there is some ambiguity about using FDR data.
The point about privacy is that if the information is disclosed, then the safety agencies may not be trusted in the future, information may not be provided, and security may suffer from this lack of information.
CVR in the US:
Recordings in EU:
Article 14, Protection of sensitive safety information in 996/2010:
the following records shall not be made available or used for purposes other than safety investigation, or other purposes aiming at the improvement of aviation safety: (a) all communications between persons having been involved in the operation of the aircraft; [...]. Flight data recorder recordings shall not be made available or used for purposes other than those of the safety investigation, airworthiness or maintenance purposes, except when such records are de-identified or disclosed under secure procedures.
- The article above covers both CVR and FDR, but seems less restrictive than the ICAO.
Article 34 in 76/2014:
In order to ensure the confidence of employees or contracted personnel in the occurrence reporting system of the organisation, the information contained in occurrence reports should be protected appropriately and should not be used for purposes other than maintaining or improving aviation safety.
Reading the many CVR transcripts available online, it's obvious that this rule has sometimes been transgressed. Authorities have now difficulties when making the proposition to increase the legal duration of the recordings from 2 to 24 hours.