1

2

3

4

5

6

7 U.S. Department of Transportation

8

9 Privacy Impact Assessment

10 Federal Aviation Administration

11 Small Unmanned Aircraft Systems Notice of Proposed Rulemaking (NPRM)

12

13

14 Responsible Official

15 Lance Nuckolls

16 Aviation Safety Inspector

17 202-267-8447

18 UAS-rule@faa.gov

19 Reviewing Official

20 Claire W. Barrett

21 Chief Privacy & Information Asset Officer

22 Office of the Chief Information Officer

23 privacy@dot.gov

24

X

Claire W. Barrett

DOT Chief Privacy & Information Asset Officer

25

26

27

28

29
FAA Small Unmanned Aircraft Systems NPRM

-1-

Executive Summary

In the Federal Aviation Administration (FAA) Modernization and Reform Act of 2012 (Public Law 112-95), 

Congress mandated that the Department of Transportation conduct a rulemaking to continue integrating small 

unmanned aircraft systems (small UAS) into the National Airspace System (NAS). In response to this 

statutory mandate, the FAA1 is publishing a notice of proposed rulemaking (NPRM) to allow certain small 

UAS to operate commercially in the NAS. The proposed rule would address the operation of small UAS, 

certification of their operators, registration of the small unmanned aircraft, and display of registration 

markings.

The proposed rule would create a new airman certificate for small UAS operators, which would be called an 

unmanned aircraft operator certificate with a small UAS rating. The process for granting this newly-created 

certificate would be in line with the process for granting traditional airman certificates. Thus, the privacy 

implications of this rule to the privacy of the information that would be collected, maintained, stored, and 

disseminated by the FAA in accordance with this rule are the same as the privacy implications of the FAA’s 

current airman certification processes. These privacy impacts have been analyzed and documented by the FAA 

in the Privacy Impact Assessments (PIAs) for the following systems which support the collection, processing, 

and management of personally identifiable information (PII) necessary to support the granting of airmen 

certificates, and will be updated to be consistent with, and prior to, the implementation date of the Final Rule 

for this rulemaking: Civil Aviation Registry Applications (AVS Registry); the Integrated Airman Certification 

and Ratings Application (IACRA); and the Accident Investigation Database (AIDs). The PIAs for these 

systems, as well as this PIA, may be found on the DOT Privacy Program website www.dot.gov/privacy.

The FAA also acknowledges that privacy concerns that have been raised about unmanned aircraft operations. 

Although these issues are beyond the scope of this rulemaking, recognizing the potential implications for 

privacy and civil rights and civil liberties from the use of this technology, and consistent with the direction set 

forth in the Presidential Memorandum, Promoting Economic Competitiveness While Safeguarding Privacy, 

Civil Rights, and Civil Liberties in Domestic Use of Unmanned Aircraft Systems (February 15, 2015), the 

FAA will participate in the multi-stakeholder engagement process led by the National Telecommunications and 

Information Administration (NTIA) to assist in fostering the discussion regarding privacy, accountability, and 

transparency issues regarding commercial and private UAS use in the NAS. We also note that there exist state, 

and other legal protections that protect individual privacy, and that those laws may provide recourse for a 

person whose privacy may be affected through another person’s use of a UAS.

What is a Privacy Impact Assessment?

The Privacy Act of 1974 articulates concepts for how the federal government should treat individuals and their 

information and imposes duties upon federal agencies regarding the collection, use, dissemination, and 

maintenance of personally identifiable information (PII). The E-Government Act of 2002, Section 208, 

 1 The primary authority for this rulemaking is based on section 333 of Public Law 112-95 (Feb. 14, 2012). In addition, this 

rulemaking also relies on FAA statutory authorities. Thus, for the purposes of this rulemaking, the terms “FAA,” “the 

agency,” “DOT,” “Department of Transportation,” and “the Secretary,” are used synonymously throughout this document.
FAA Small Unmanned Aircraft Systems NPRM

-2-

establishes the requirement for agencies to conduct privacy impact assessments (PIAs) for electronic 

information systems and collections. The assessment is a practical method for evaluating privacy in 

information systems and collections, and documented assurance that privacy issues have been identified and 

adequately addressed. The PIA is an analysis of how information is handled to— i) ensure handling conforms 

to applicable legal, regulatory, and policy requirements regarding privacy; ii) determine the risks and effects 

of collecting, maintaining and disseminating information in identifiable form in an electronic information 

system; and iii) examine and evaluate protections and alternative processes for handling information to 

mitigate potential privacy risks.2

Conducting a PIA ensures compliance with laws and regulations governing privacy and demonstrates the 

DOT’s commitment to protect the privacy of any personal information we collect, store, retrieve, use and 

share. It is a comprehensive analysis of how the DOT’s electronic information systems and collections handle 

personally identifiable information (PII). The goals accomplished in completing a PIA include:

- Making informed policy and system design or procurement decisions. These decisions must be 

based on an understanding of privacy risk, and of options available for mitigating that risk;

- Accountability for privacy issues;

- Analyzing both technical and legal compliance with applicable privacy law and regulations, as 

well as accepted privacy policy; and

- Providing documentation on the flow of personal information and information requirements 

within DOT systems.

Upon reviewing the PIA, you should have a broad understanding of the risks and potential effects associated 

with the Department activities, processes, and systems described and approaches taken to mitigate any 

potential privacy risks. 

Introduction & NPRM Overview 

The FAA has accommodated non-recreational small UAS use through various mechanisms, such as special 

airworthiness certificates, exemptions, and certificates of authorization or waiver (COA). This proposed rule 

would be the next phase of integrating small UAS into the National Airspace System (NAS). Just a few 

examples of possible small UAS operations that could be conducted under this proposed framework are:

• Crop monitoring/inspection;

• Research and development;

• Educational/academic uses;

• Power-line/pipeline inspection in hilly or mountainous terrain;

• Antenna inspections;

• Aiding rescue operations;

• Bridge inspections; and

 2

Office of Management and Budget’s (OMB) definition of the PIA taken from guidance on implementing the privacy 

provisions of the E-Government Act of 2002 (see OMB memo of M-03-22 dated September 26, 2003). 
FAA Small Unmanned Aircraft Systems NPRM

-3-

• Wildlife nesting area evaluations.

Because of the potential societally-beneficial applications of small UAS, the FAA has been seeking to 

incorporate these systems into the NAS since 2008. 

On February 1, 2012, Congress passed the FAA Modernization and Reform Act of 2012, Public Law 112-95. 

Section 333 directed the Secretary of Transportation to determine whether UAS operations posing the least 

amount of public risk could safely be operated in the NAS and, if so, to establish requirements for the safe 

operation of these systems in the NAS. As part of its ongoing efforts to integrate UAS operations in the NAS, 

and in accordance with Public Law 112-95, § 333, the Department of Transportation is proposing to adopt 

specific rules for the commercial operation of small UAS posing the least amount of public risk in the NAS, 

including the four components of the proposed rulemaking that trigger this PIA.

Broadly speaking, the FAA proposes to add a new part 107 to Title 14 Code of Federal Regulations (14 CFR) 

to allow for civil commercial operation of small UAS in the NAS within an acceptable set of safety parameters. 

The proposed rulemaking would define small UAS as weighing less than 55 pounds, and it would limit such 

UAS to operate only during daylight, within a confined area, and within visual-line-of-sight. The confined 

area would prohibit small UAS from flying higher than 500 feet above ground level and from entering 

controlled airspace without permission from the local Air Traffic Control. The proposed rule would also 

impose other operational limits, including speed limitations and weather minimums that are necessary to 

maintain the safety of the NAS.

In addition, this proposed rule would require the person manipulating the controls of a small UAS to obtain a 

small unmanned aircraft operator certificate with a small UAS rating. This would be a new type of airman 

certificate created for small UAS operations. The small UAS rating would bestow on the certificate holder the 

privilege or limitations associated with operating a small UAS. To obtain this certificate and rating, an 

applicant would have to pass an aeronautical knowledge test administered in a similar manner as knowledge 

tests for other FAA-issued airman certificates, and undergo security vetting by the Transportation Security 

Administration (TSA). After obtaining the unmanned aircraft operator certificate, the certificate holder would 

then have to pass a recurrent knowledge test every 24 months to remain current on the certificate.

Finally, this proposed rule would require that all unmanned aircraft be registered to operate in the NAS. The 

registration process for small unmanned aircraft would be the existing process codified in 14 CFR part 47. The 

proposed rule would also require small unmanned aircraft to visibly display their registration markings in 

accordance with 14 CFR part 45. We expect that this rulemaking, once final, would increase the number of 

commercial small UAS operating in the NAS to approximately 7,500 within five years. 

This PIA focuses on the four components of the FAA’s proposed rulemaking that would result in the 

government collection of PII: (1) operator certification applications; (2) aircraft registration applications; (3)

administration of a knowledge test; and (4) accident reporting. Due to the substantial overlap between the 

privacy issues arising out of the operator certification component and aircraft registration component, the 

analyses of these two areas are frequently collapsed into a single section within this PIA. 

Application for an Operator Certificate and Aircraft Registration

The primary mission of the FAA is to provide the safest, most efficient aerospace system in the world. One of 

the ways the FAA supports this mission is through the certification of airmen and registration of aircraft, as 
FAA Small Unmanned Aircraft Systems NPRM

-4-

required under 49 United States Code (U.S.C.) §§ 44703 and 44103, respectively.3 Several of the privacy 

impacts analyzed here would be the result of the FAA’s proposal to extend these existing FAA safety data 

systems to accommodate the incorporation of small UAS into the NAS. 

The proposed rule would define a small UAS “operator” as any person who manipulates the flight controls of a 

small UAS. Under the FAA’s statute, an operator is considered to be an airman, and therefore, a UAS operator 

would be statutorily prohibited from operating a small UAS in air commerce without an airman certificate.4 As 

such, the proposed rule would, in several ways, treat the PII of small UAS operators similarly to the PII of 

airmen that are currently certificated by the FAA. Specifically, any individual seeking to serve as an operator 

on a commercial small UAS operation would be required to submit an application, including certain necessary 

PII, for FAA review and issuance of an operator certificate. 

Another similarity between the proposed small UAS rule and the FAA’s existing regulatory scheme is the

requirement to register aircraft.5 The FAA’s statute prohibits a person from operating a civil aircraft that is not 

registered,6 and this proposed rule would codify this statutory requirement for small UAS. 

In light of these similarities, the FAA’s NPRM would leverage existing aircraft and airmen certification 

processes and systems to address requirements in the NPRM for small UAS operators- and vehicles-related. 

PII collected by the FAA for these purposes will be managed in accordance with the Department’s existing

systems of records. Specifically, this information would be maintained within the Civil Aviation Registry 

Applications (AVS Registry, also known as the Registry Modernization System (RMS)), which was developed 

to help the FAA meet its responsibilities under 49 U.S.C. §§ 44703 and 44103. The AVS Registry is used by 

the Airmen Certification Branch, AFS-760 and the Aircraft Registry Branch, AFS-750, which are responsible 

for the legally-mandated certification and registration of airmen and aircraft, respectively, and in accordance 

with DOT/FAA 847, Aviation Records on Individuals7 and DOT/FAA 801, Aircraft Registration System8. 

The FAA's Office of Aviation Safety (AVS) is responsible for managing the FAA airman certification process. 

Airmen or applicants may submit paper applications or submit an electronic application using the Integrated 

Airman Certification and Rating Application (IACRA) system. IACRA is a web-based application that guides 

the user through the FAA’s airman application process and serves as a temporary repository until applications 

are accepted into the official airman record in the AVS Registry. Privacy mitigations strategies for the IACRA 

application may be found in the IACRA PIA (see www.dot.gov/privacy).

The AVS Registry serves as the national repository for airmen certification and aircraft registration records and 

provides the central services necessary for control of these records, which are used by FAA, the National 

Transportation Safety Board (NTSB), Department of Homeland Security (DHS), State and Federal law 

enforcement and may also be used in court litigation, employment, and insurance verification by the aviation 

industry and for other appropriate public needs. AVS Registry collects PII about airmen and aircraft owners, 

 3 Under the pertinent statutes, a person may not: (1) operate an aircraft that is not registered; and (2) serve as an airman with 

respect to a civil aircraft used in air commerce without an airman certificate. See 49 U.S.C. §§ 44101, 44711(a)(2)(A). 4 See 49 U.S.C. § 40102(a)(8)(A) (defining an airman to include an individual who is “in command, or as pilot, mechanic, or 

member of the crew, who navigates aircraft when under way”); 49 U.S.C. § 44711(a)(2)(A) (prohibiting a person from 

serving as an airman with regard to a civil aircraft being used in air commerce without an airman certificate). 5 See 14 CFR part 47. 6 49 U.S.C. § 44101(a).

7 DOT/FAA 847, Aviation Records on Individuals – 75 FR 68849 - November 9, 2010 8 DOT/FAA 801 Aircraft Registration System - 65 FR 19518 - April 11, 2000
FAA Small Unmanned Aircraft Systems NPRM

-5-

including name, Social Security number (SSN), address, and date of birth. For more information about the data 

collection activities in the AVS Registry please see the AVS Registry PIA. 

The FAA expects that applicants to the AVS Registry seeking an unmanned aircraft operator certificate with a 

small UAS rating would use an application form similar to those forms currently used by other applicants and 

would require individuals to provide the following information:

• Full name

• SSN (voluntary) 

• Date of Birth

• Place of Birth

• Citizenship

• Vital Description (hair and eye color, height, weight, gender)

• Home Address

• Home Phone Number

• E-mail address (for IACRA registration only)

• Security questions and answers (for IACRA registration only)

• Passwords (for IACRA registration only)

• Military Competence (Rank or grade and service number)

• Applicant ID

• Name and certificate number of either: Designated Examiner; Flight Instructor; or Airman Certification 

Representative, Inspector Name, certificate number and Code

• Drug Convictions (Y/N, Date of Convictions)

• Electronic Signature

• Airman Certificate Date of Issuance

• English Proficiency (Y/N)

• Medical limitations preventing English Proficiency

We note that the scope of information that is collected as part of the unmanned aircraft operator application 

may be changed in the final small UAS rule in response to comments received on the NPRM. 

The Aircraft Registration (AR) system is used by the Aircraft Registry Branch, AFS-750, which is responsible 

for the national programs of aircraft registration, recording of encumbrances against U.S. civil aircraft, 

identification of registered aircraft, and law enforcement assistance as it involves the aircraft registration 

program. FAA collects the information necessary to establish and maintain the national repository of all 

United States civil aircraft records. To register an aircraft, the aircraft owner(s) must file an application 

supported by evidence of ownership, together with the registration fee. Registering an aircraft results in the 

issuance of a certificate and the assignment of U.S. registration markings (N Numbers or tail numbers). AR 

has many uses and most information is publically available and may be used by individuals seeking 

information about an aircraft they are considering purchasing, banks that finance such purchases, aviation 

historians, and other interested individuals.

The information collected as part of the aircraft registration process and entered into the AR includes:
FAA Small Unmanned Aircraft Systems NPRM

-6-

• The aircraft registration number assigned to or reserved for this aircraft’s registration

• Name of the aircraft manufacturer

• Aircraft model designation

• Aircraft serial number

• Full legal name of applicant(s)

• Type of Applicant (individual, partnership, corporation, co-ownership, Government, Non-citizen 

corporation)

• Permanent mailing address for first applicant listed, (If PO Box is given, then street address or location 

is also required.)

• Data collected from the aircraft registration process includes; 

• Date of Registration

• Date Registration will expire

• Whether applicant is an aircraft dealer

• Whether a Registration Number change has been authorized

• The aircraft’s registration status

• Whether ownership appears to be part of a Fractional Ownership Management Arrangement

There is no required form for the recording of interests in aircraft (liens, mortgages, leases, etc.). However, 

sample or example forms have been published by the Aircraft Registration Branch for bills of sale, Security 

Agreements, conditional sales contracts, and repossession. The paperwork requirements for these transactions 

are governed by local laws, so the FAA examples provide only a basic format and terminology that would be 

acceptable in most jurisdictions across the U.S. The information collected from these forms is limited to the 

names and addresses of the parties, the registration number of the affected aircraft, a description of the affected 

aircraft, engine(s) and propellers by manufacturer’s name, model designation and serial numbers, and the 

location of affected aircraft parts by city and state. Furthermore, the Aircraft Registration Branch calls attention 

to the fact that the recording of an interest (e.g., lien) in an aircraft is done voluntarily and becomes part of 

records available for public review, and that FAA policy is that any sensitive information included on the forms 

was provided with this knowledge. Nevertheless, if personal information such as social security numbers is

found during the examination process, that information is redacted. In addition, if other sensitive information is 

discovered after a document has been recorded, the affected party may request in writing for the sensitive 

information to be redacted from a particular document by contacting the Aircraft Registration Branch (AFS750) or by submitting an electronic request through the following website:

http://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_registry/contact_aircraft_certification/

The images of these documents affecting an interest in an aircraft are filed in the aircraft’s record kept in the 

EDRS; no data is captured from these documents for entry into the AR. During document receipt and 

preprocessing, a computerized index of documents filed is created that captures data from recordable 

documents. The data collected for this index can be accessed by either the names of the parties shown on the 

documents and the registration number of the aircraft, or the description of engines, propellers and spare parts 

locations. The data collected consists of:
FAA Small Unmanned Aircraft Systems NPRM

-7-

• The names of the parties

• The date the document was received

• An abbreviation for the type of document (BOS, REL, S/A, DIS)

• The registration number for aircraft 

• The manufacturer name, model, and serial number of engines and propellers 

Typical outputs of routine aircraft registration and aircraft-interest recordation would be the issuance of a

Certificate of Aircraft Registration, AC Form 8050-3, and/or Conveyance Recordation Notice, AC Form 8050-

419. All accessible forms can be found at https://employees.faa.gov/tools_resources/forms/

Administration of an Aeronautical Knowledge Test

The FAA also proposes to require applicants for an operator certificate to demonstrate sufficient aeronautical 

knowledge to safely operate a small UAS. As discussed above, part of the FAA’s safety mission, as required 

by statute, is to certificate qualified persons as airmen capable of operating aircraft in the NAS. Under the 

current proposal, an applicant for an unmanned aircraft operator certificate with a small UAS rating would be 

required to pass an FAA aeronautical knowledge written test, focusing on knowledge areas specified in the 

proposed part 107. 

The aeronautical knowledge test would be administered by the FAA’s Airman Knowledge Testing 

Organization Designation Authorization (commonly referred to as a Knowledge Testing Center or KTC).10 An 

FAA KTC is currently authorized to give aeronautical knowledge tests for existing airman certificate 

applicants such as pilots (14 CFR part 61), flight engineers (part 63), and mechanics (part 65). As part of the 

existing requirements for taking the knowledge test, an applicant must provide the KTC facility with his or her 

name, mailing address, and date of birth and provide valid photo ID for the purposes of identity verification. 

As with the airman application, an applicant may provide his or her social security number, but is not required 

to do so. The proposed rule would apply these requirements to applicants for an unmanned aircraft operator 

certificate. As stated in FAA Order 8080.6G11, the FAA has established strict protocols regarding how a KTC 

accepts PII and photo ID verification information, how that information is transmitted to the FAA, how it must 

be safeguarded, and how long it must be kept by the KTC. These protocols would also apply to applicants for 

an unmanned aircraft operator certificate.

Accident Reporting

As part of its safety mission, the FAA collects and reviews aircraft accident data and uses that data to 

promulgate rules, develop aviation safety outreach programs that improve aviation safety, and investigate 

potential violations of FAA regulations. UAS is a relatively new industry and operators of small UAS may not 

have prior experience with aviation regulations or FAA oversight. Furthermore, because of the newness of the 

small UAS industry, the FAA currently does not have the oversight experience with small UAS that it has with 

 9 http://www.faa.gov/forms/index.cfm/go/document.information/documentID/184100

10 See 14 CFR part 183 Subpart D. 11 http://www.faa.gov/documentLibrary/media/Order/FAA_Order_8080_6G.pdf
FAA Small Unmanned Aircraft Systems NPRM

-8-

manned-aircraft operations. Accordingly, the NPRM would require any FAA-certificated small UAS operator 

to report certain types of accidents involving UAS to the nearest FAA Flight Standards District Office (FSDO)

within 10 days of the accident. This proposed rule would require a small UAS operator to report to any small 

UAS operation that results in (1) any injury to a person, or (2) damage to property other than the small 

unmanned aircraft, to the FAA FSDO closest to the accident site. 

After receiving this report, the FAA may conduct further investigation to determine whether any FAA 

regulations were violated. Under this proposal, the only PII that an operator would need to provide to the FAA 

when reporting an accident would be his or her name and operator certificate number.12 Upon receiving an 

accident report, the FAA would use the small UAS operator’s and small UAS registered owner’s PII collected 

during the airman certification and aircraft registration process to supplement the report, as necessary. The 

small UAS accident report would become part of the existing FAA aircraft accident database for the purpose of 

an FAA-internal safety risk analysis, and would be shared with the NTSB. If the small UAS accident involved 

serious injury or death, the NTSB may investigate the cause of the accident (49 CFR 830.2). Though the FAA 

aircraft accident database may be accessed by the public, no sensitive PII is made publicly available. However, 

on a case-by-case basis and depending on the circumstances, certain small UAS operator and/or small UAS 

owner PII information as it pertains to a small UAS accident might be made available through a Freedom of 

Information Act (FOIA) request. For example, in certain circumstances, the FAA may, in response to a FOIA 

request, release the name of the individual who was involved in the accident, and, if a business is involved, the 

FAA may release the name and contact information for that business. However, the FAA would not release the 

address or contact information of an individual who is involved in an accident. For more information about the 

data collection activities about accidents and incidents please see the AIDS PIA.

Fair Information Practice Principles (FIPPs) Analysis

The DOT PIA template is based on the fair information practice principles (FIPPs). The FIPPs, rooted in the 

tenets of the Privacy Act, are mirrored in the laws of many U.S. states, as well as many foreign nations and 

international organizations. The FIPPs provide a framework that will support DOT efforts to appropriately 

identify and mitigate privacy risk. The FIPPs-based analysis conducted by DOT is predicated on the privacy 

control families articulated in the Federal Enterprise Architecture Security and Privacy Profile (FEA-SPP) 

v313, sponsored by the National Institute of Standards and Technology (NIST), the Office of Management and 

Budget (OMB), and the Federal Chief Information Officers Council and the Privacy Controls articulated in 

Appendix J of the NIST Special Publication 800-53 Security and Privacy Controls for Federal Information 

Systems and Organizations14.

Transparency

Sections 522a(e)(3) and (e)(4) of the Privacy Act and Section 208 of the E-Government Act require public 

notice of an organization’s information practices and the privacy impact of government programs and 

activities. Accordingly, DOT is open and transparent about policies, procedures, and technologies that directly 

 12 An operator may choose to provide PII information concerning persons injured or property damage that occurred as a 

result of the accident. If an operator provides this information, it would be protected in the same manner as the operator’s

PII.

13 http://www.cio.gov/documents/FEA-Security-Privacy-Profile-v3-09-30-2010.pdf 14 http://csrc.nist.gov/publications/drafts/800-53-Appdendix-J/IPDraft_800-53-privacy-appendix-J.pdf
FAA Small Unmanned Aircraft Systems NPRM

-9-

affect individuals and/or their personally identifiable information (PII). Additionally, the Department should 

not maintain any system of records the existence of which is not known to the public. 

Application for an Operator Certificate and Aircraft Registration

DOT has published the following Privacy Act System of Records Notices (SORNs), DOT/FAA 847, Aviation 

Records on Individuals – 75 FR 68849 - November 9, 2010, and DOT/FAA 801 Aircraft Registration System -

65 FR 19518 - April 11, 2000 that provide notice to the public of its privacy practices regarding the collection, 

use, sharing, safeguarding, maintenance and disposal of information that affects individuals and/or their 

Personally Identifiable Information (PII) which may be collected as part of the small UAS airmen certification 

processes. Notice to individuals concerning the collection of their PII is provided at the time of collection and 

is provided as a statement in accordance with the Privacy Act, 5 U.S.C. § 552a(e)(3), and included in the 

application process. Individuals provide consent for the collection of their information by participating in the 

application process. The SORNs can be found at www.dot.gov/privacy.

The publication of this PIA demonstrates DOT’s commitment to providing appropriate transparency into the 

privacy risks and mitigation strategies associated with the collection of PII by the FAA in support of 

integrating small UAS into the NAS consistent with the NPRM. 

Administration of an Aeronautical Knowledge Test

The public would be notified about the collection of PII necessary for administering a knowledge test through 

the provisions of the NPRM and a final rule codifying this process. These documents go through the noticeand-comment process applicable to a rulemaking, and the public will have an opportunity to weigh in on these 

provisions as part of the notice and comment process.

We also note that, as part of its day-to-day function, a Knowledge Testing Center may need to provide its data 

to the FAA. Inquiries made under the Freedom of Information Act (FOIA) may require the FAA to disclose 

certain PII and other test-related information that is provided to the FAA by a Knowledge Testing Center. 

However, aside from providing information necessary to comply with FOIA, no sensitive PII information 

collected by the FAA from a Knowledge Testing Center would be made public.

Accident Reporting

The public would be notified about the accident-reporting component of the NPRM through the provisions of 

the NPRM and a final rule codifying these provisions. These documents will go through the notice-andcomment process applicable to a rulemaking, and the public will have an opportunity to weigh in on these 

provisions as part of the notice and comment process.

Except to the extent required by law, no sensitive PII data would be made public under the proposed accidentreporting provision of the NPRM. However, the PII for the small UAS operator and small UAS owner, as well 

as the information contained in the small UAS accident report, may be used by the FAA to determine the 

following: 1) the performance of FAA facilities or functions; 2) the performance of non-FAA-owned and 

operated air traffic control (ATC) facilities or Navigational Aids (NAVAID); 3) the airworthiness of small 

unmanned aircraft; 4) the competency of FAA-certificated airman; 5) the adequacy of the applicable FAA 

regulations; 6) whether airport certification safety standards or operations were involved; 7) whether airport 

security standards or operations were involved; 8) whether a medical event occurred that resulted in an 

accident; and 9) whether there was a violation of the applicable FAA regulations.
FAA Small Unmanned Aircraft Systems NPRM

-10-

Individual Participation and Redress

DOT should provide a reasonable opportunity and capability for individuals to make informed decisions about 

the collection, use, and disclosure of their PII. As required by the Privacy Act, individuals should be active 

participants in the decision making process regarding the collection and use of their PII and be provided 

reasonable access to their PII and the opportunity to have their PII corrected, amended, or deleted, as 

appropriate.

Application for an Operator Certificate and Aircraft Registration

Under the provisions of the Privacy Act, individuals may request searches of IACRA and AR to determine if 

any records have been added that may pertain to them. 

Individuals wishing to know if their records appear in this system may inquire in person or in writing to: 

Federal Aviation Administration

Privacy Office

800 Independence Ave. SW 

Washington DC, 20591

Included in the request must be the following:

• Name,

• Mailing address,

• Phone number or email address,

• A description of the records sought, and if possible, the location of the records and system(s) 

acronym(s).

Contesting records procedure: Individuals wanting to contest information about them that is contained in this 

system should make their requests in writing, detailing the reasons for why the records should be corrected to 

the following address:

Federal Aviation Administration

Privacy Office

800 Independence Ave. SW 

Washington DC, 20591

For questions relating to privacy, visit the DOT Privacy Program website at www.dot.gov.privacy.

Administration of an Aeronautical Knowledge Test

Under the proposed rule, the PII collected by the 14 CFR part 183 designated Knowledge Testing Center 

would be the same as that being currently collected for other FAA aeronautical knowledge tests required for an 

airman certificate. Due to the nature of the application process, if PII is incorrect it would surface during the 

process when the FAA processes the operator certificate application. The FAA would contact the applicant if 

problems with the PII surface during this process and it would annotate and correct any information that an 

individual points out is incorrect. The PII and photo ID verification data collected by a FAA Knowledge Test 

Center and the FAA to take the small UAS aeronautical knowledge test would also not be made publically 

available.
FAA Small Unmanned Aircraft Systems NPRM

-11-

Accident Reporting

The information collected in the small UAS accident would be the same as information that the FAA currently 

processes for manned aircraft accidents. When a manned aircraft accident is investigated, the results of that 

investigation are entered into Air Traffic Quality Assurance secured system, which places that information into 

the AIDs secured database. 

We also note that the FAA would make aircraft accident data publically available on its Accidents/Incidents 

Data Systems database, which can be accessed through the FAA’s Aviation Safety Information Analysis and 

Sharing (ASIAS) website (http://www.asias.faa.gov/). Though the FAA would collect certain PII for accident 

reporting purposes, that PII would not be published on ASIAS.

 

Purpose Specification 

DOT should (i) identify the legal bases that authorize a particular PII collection, activity, or technology that 

impacts privacy; and (ii) specify the purpose(s) for which its collects, uses, maintains, or disseminates PII.

Application for an Operator Certificate 

The FAA would collect PII during the certification application process for the purpose of identifying the 

airman and to determine applicant eligibility for a certificate and/or rating. Data elements and airman 

information collected would be used to identify, verify, and determine eligibility and to contact identified 

individuals. Below, we provide a list of authorities based on which the FAA would collect and maintain PII 

under the NPRM. 

The Registry currently collects and maintains PII based on the following authorities:

• Proposed 14 Code of Federal Regulations (CFR) Part 107, Subpart C – Operator Certification (proposed 

in the NPRM). An applicant for an unmanned aircraft operator certificate with a small UAS rating

would be required to make an application to the FAA in a form and manner acceptable to the 

Administrator.

• 49 United States Code (U.S.C.) § 40113, Administrative – prescribing regulations, standards and 

procedures with respect to aviation safety.

• 49 U.S.C. § 44701 – promote safe flight of civil aircraft in air commerce by prescribing minimum 

standards required in the interest of safety for appliances.

• 49 U.S.C. § 44702 – used to provide guidance on issuing certificates (airman certificates, type 

certificates, production certificates, airworthiness certificates, air carrier operating certificates, airport 

operating certificates, air agency certificates, and air navigation facility certificates).

• 49 U.S.C. § 44703 – used to issue an airman certificate to an individual when the Administrator finds, 

after investigation, that the individual is qualified for, and physically able to perform the duties related 

to, the position to be authorized.

• 49 U.S.C. § 44709 – used by the Administrator of the Federal Aviation Administration when issues arise 

regarding the examination of an airman. This allows the administrator to reinspect at any time or 

reexamine an airman holding a certificate issued under section 44703 of this title.
FAA Small Unmanned Aircraft Systems NPRM

-12-

• 49 U.S.C. § 45103 – provides the information regarding alcohol usage; prohibited services and 

rehabilitation that an individual must do in order to resume or regain their certification.

Aircraft Registration

The FAA would collect PII during the aircraft registration process for the purpose of identifying the aircraft 

owner(s) and to determine eligibility to register an aircraft. Data elements and information collected would be

used to identify both the aircraft and its owner and for the FAA to contact identified aircraft owners in the 

course of managing the NAS and advancing aviation safety, 

Under the proposed rule, the same PII would be collected and maintained for small unmanned aircraft as is 

currently collected and maintained for manned aircraft. These collections are based on the following 

authorities:

• 14 CFR part 47 – Aircraft Registration; Certificates of Aircraft Registration: No person may operate an 

aircraft that is eligible for registration under 49 U.S.C. 44101-44104, unless the aircraft has been 

registered by its owner. An aircraft may be registered under 49 U.S.C. 44103 only when the aircraft is 

not registered under the laws of a foreign country, and is owned by a citizen, a permanent resident, a 

non-citizen corporation (with restrictions) when formed under U.S. or State law, an aircraft of the United

States Government; or a State, District of Columbia, a U.S. territory or possession, or political 

subdivision of these.

• 14 CFR part 49 – Recording of Aircraft Titles and Security Documents: A document affecting title to or 

an interest in an aircraft, engine, propeller, or spare parts location is eligible for recording when the 

conveyance has been mailed to the FAA Aircraft Registry; it is signed in ink by the aircraft owner; it is 

in a form acceptable to the FAA; it describes the aircraft by its registration number; the aircraft, engine 

and propeller by manufacturer name, model, and serial number; and air carrier maintained spare parts by 

specific locations.

• 49 U.S.C. § 40113, -- Administrative – prescribing regulations, standards and procedures with respect to 

aviation safety.

• 49 U.S.C. §§ 44101 through 44103 -- Registration Requirement, a person may operate an aircraft only 

when the aircraft is registered under 44103. An aircraft may be registered under 44103 only when the 

aircraft is not registered under the laws of a foreign country and is owned by a citizen of the U.S., a 

permanent resident, a non-citizen corporation formed under U.S. or State law (with limitations), or an 

aircraft of the U.S. Government, State, District of Columbia, territory, possession; or political 

subdivision of these. On application of the owner of an aircraft that meets the requirements of 44102, the 

FAA shall register the aircraft; and issue a certificate of registration to its owner.

• 49 U.S.C. § 40107 – Recordation of conveyances, leases, and security instruments. The FAA shall 

establish a system for recording conveyances that affect an interest in civil aircraft of the U.S., and 

certain specifically described aircraft engines, aircraft propellers, and spare parts locations maintained 

by air carriers, such as leases and instruments submitted for security purposes, assignments, 

amendments, releases, cancellations, discharges, and satisfactions. 

• 49 U.S.C. § 44111 – Modifications in registration and recordation system, The FAA shall make 

modifications to the aircraft registration and recording system necessary to make the system more 
FAA Small Unmanned Aircraft Systems NPRM

-13-

effective in serving the needs of; buyers and sellers of aircraft, officials responsible for enforcing laws 

related to the regulation of controlled substances, and other users of the system such as: eliminating the 

use of P.O. Boxes and/or mail drops for registration to evade identifying a person’s address; and the 

submission of names of individuals on applications for registration that are not identifiable.

Administration of an Aeronautical Knowledge Test 

Pursuant to its authority to certificate airmen, codified in 49 U.S.C. §§ 44701 and 44703, the FAA would use 

the PII data to assure that the person taking the aeronautical knowledge test is the same person that is applying 

for an airman certificate. The FAA would not disseminate PII collected for an aeronautical knowledge test to 

the public.

Accident Reporting

Pursuant to the FAA’s oversight authority, the proposed rule would use the small UAS operator and small 

UAS registered owner PII data and information from the accident report to determine compliance with the 

applicable FAA regulations. The FAA’s oversight statutes, codified at 49 U.S.C. §§ 44709 and 46104, provide 

the agency with broad investigatory and inspection authority for matters within the FAA’s jurisdiction. Under 

§ 46104, the FAA may subpoena witnesses and records, administer oaths, examine witnesses, and receive 

evidence at a place in the United States that the FAA designates. Under § 44709, the FAA may “reinspect at 

any time a civil aircraft, aircraft engine, propeller, appliance, design organization, production certificate holder, 

air navigation facility, or agency, or reexamine an airman holding a certificate issued [by the FAA].”

In addition to determining compliance with FAA regulations, the FAA would also incorporate the accident 

report into its aircraft accident database for the purpose of aviation safety analyses. The FAA would not 

disseminate PII contained in the accident report to the public.

Data Minimization & Retention

DOT should collect, use, and retain only PII that is relevant and necessary for the specified purpose for which 

it was originally collected. DOT should retain PII for only as long as necessary to fulfill the specified 

purpose(s) and in accordance with a National Archives and Records Administration (NARA)-approved record 

disposition schedule.

Application for an Operator Certificate

In accordance with the NARA-approved records schedule N1-237-06-1, airman certification files in the 

Registry are cut off annually and destroyed 60 years after the cutoff or when no longer needed to conduct 

agency business, whichever is later. Records are retained indefinitely. The FAA maintains these records in 

accordance with 36 CFR 1234.30 and 1234.32. IACRA collects and temporarily15 retains the PII of airmen 

 15 Since IACRA is not the authoritative source (only a means of an online application), if the applicant chooses to use 

IACRA, the images are retained for only 1 year when in a completed status, incomplete status, starts, and ones that have been

abandoned or not completed and 2 years with an incomplete status if CFI recommendation is present. So the status of the 

IACRA application determines how long the image is retained in the IACRA system. After 1 or 2 years depending on the 

status, the image is deleted from IACRA system regardless of the submission to the Registry. Once the certificate is issued by 

AFS-760 (Airmen Certification) whether it be by the “paper” method or “IACRA” it becomes a part of the authoritative 

record and falls under the NARA records schedule N1-237-06-1.
FAA Small Unmanned Aircraft Systems NPRM

-14-

who are applying for airman certificates and/or ratings. The Registry picks up IACRA images of the 

applications submitted via IACRA on a daily basis. PII information is collected in accordance with 49 U.S.C.

§ 44703 in order to print a permanent airman certificate from the authoritative record, which is the 

Comprehensive Airmen Information system (CAIS). Information is collected as part of the certification or 

additional ratings process for the authoritative record in accordance with the System of Records Notice,

DOT/FAA 847, Aviation Records on Individuals – 75 FR 68849 - November 9, 2010. IACRA maintains its

records in accordance with NARA Schedule N1-237-09-014 Approved March 10, 2009; “Disposition: 

Temporary, Delete/Destroy when form or related applications are superseded or obsolete.” This authority does 

not supersede any records of the Registry Modernization System: Airman Certification Records scheduled 

under N1-237-06-001. The business rules for IACRA retention of data and TIFF images of applications are as 

follows and are in accordance with N1-237-09-014:

• Retain images for 1 year from the date of “completed status”.

• Retain images with “incomplete status” for 1 year for “Starts” and “Abandoned” or not 

completed by applicant.

• Retain images with “incomplete status” for 2 years if a CFI recommendation is e-signed.

Application for Aircraft Registration

For the Aircraft Registration Branch, the basic tasks are to maintain a register of U.S. civil aircraft and to 

record documents that convey an interest in these aircraft. Neither of these requires the collection of much 

personal information. The aircraft registration statute only requires the legal name of the aircraft owner, the 

owner’s permanent address, and his or her affirmed status as a U.S. citizen or permanent resident. This allows 

the FAA to determine that the aircraft are registered in accordance with 49 U.S.C. § 44103; enables the FAA to 

contact the party responsible for the aircraft to provide safety-related information, to summon aircraft able to 

aid in the national defense, to serve as a data source to management for production of summary descriptive 

statistics and analytical studies in support of agency functions for which these records are maintained; and by 

law enforcement when an issue in their purview arises. Since U.S. aircraft and those of other nationalities are 

located and operate around the world, the U.S., like all signatory countries, is required by International Civil 

Aviation Organization (ICAO) Conventions (treaties) to maintain a register of U.S. Civil Aircraft. This register 

is required to contain the name and address of the owners or responsible parties for all registered aircraft, with 

a copy of the register to be provided to ICAO. 

The recording of documents that transfer or grant a claim or other interest in an aircraft are typically executed 

by the aircraft owner or persons to whom the owner gives power of attorney. These documents are required to 

be the complete and original agreement between the parties to the agreement. Required information includes 

the names and addresses of these parties. Although an aircraft owner may use his or her social security or 

account numbers, these are not requested, and are redacted when noticed and are not captured in the AR or 

other database. Proprietary information, such as, loan amounts or interest rates are not required to be shown on 

the document copy filed with the Aircraft Registration Branch. The registration and recording documents kept 

in an aircraft’s record in the EDRS system: support investigative efforts of investigation and law enforcement 

agencies of Federal, State, and foreign governments; serve as a repository of legal documents used by 

individuals and title search firms to determine legal ownership of aircraft in support the buying, selling, leasing, 

and financing of aircraft transactions; and provide supporting information in court cases concerning liability of 

parties in lawsuits.

The information as collected is disclosed in System of Records Notice (SORN), DOT/FAA 801 Aircraft 

Registration System - 65 FR 19518 - April 11, 2000 and the purpose of the disclosure is to determine that 

aircraft are registered in accordance with the provisions of 49 U.S.C. § 44103, to maintain the register of U.S. 
FAA Small Unmanned Aircraft Systems NPRM

-15-

Civil Aircraft to aid in the national defense; and support a safe and economically strong civil aviation system. 

The register supports agency functions like distributing safety information and conducting the annual survey of 

general aviation aircraft in support of the aircraft registration statistical system. 

The minimum PII is collected. The impact on individuals is further moderated when one notes that at any 

given time, a substantial number of aircraft are actually owned and registered to Corporations, Limited 

Liability Companies, Partnerships, Government offices, and entities such as trustees and colleges. Operators of 

small UAS could choose to register their aircraft in a similar manner, so that the contact information in the 

system is that of the business entity rather than the operator’s personal contact information.

Aircraft Registration Records are maintained in accordance with the NARA Records Disposition Authority 

N1.237.04.3, issued on June 9, 2005. The registration and recordation document images maintained in 

individual aircraft case files in the EDRS and its electronic indexes, the AR database and certain historic 

listings of the AR database (the register sorted by State and county, manufacturer and model, registration 

number and alphabetically by owner name) are permanent records of the United States. While used and 

maintained by the FAA, they belong to NARA. The FAA maintains them in accordance with 36 CFR 1234.30, 

and 36 CFR 1234.32. 

Administration of an Aeronautical Knowledge Test 

The PII provided by a person during the airman certificate application process, which includes aeronautical 

knowledge testing, would be limited to that information necessary to confirm the identity of the applicant. 

The SORN for this system can be found at DOT/FAA 847, Aviation Records on Individuals – 75 FR 68849 -

November 9, 2010. In accordance with FAA Order 8080.6G, an individual 14 CFR part 183 designated 

Knowledge Testing Center must keep the test applicant’s identification media (i.e. photo ID copy) in a secured, 

lockable cabinet. In addition, in the event of the closure of a KTC location, test applicant records, including 

copies of identification and authorization information and daily logs, both paper and electronic, must be 

maintained at the KTC’s home office for at least 5 years from the date of closure of the location. Pursuant to 

the NARA Records Disposition Authority N1.237.06.1 approved December 12, 2005, information that is 

transmitted to the FAA is destroyed after 60 years.

Accident Reporting

The accident-reporting provision of the NPRM would collect the minimum amount of PII necessary for the 

FAA to be able to: (1) determine what happened; and (2) know who to contact with follow-up questions or as 

part of a follow-up investigation. The PII collected as part of the accident reporting requirements would be 

retained for not more than 5 years though not publically available. However, pursuant to the NARA Records 

Disposition Authority N1.237.05.2 approved August 18, 2005, the pertinent accident data excluding PII would 

be publically available on the FAA’s Accident/Incident Database system in perpetuity. The specific forms 

providing inputs into the system would be converted into an image file and destroyed after conversion. The 

image file would be deleted after three years. 

Use Limitation

DOT shall limit the scope of its PII use to ensure that the Department does not use PII in any manner that is 

not specified in notices, incompatible with the specified purposes for which the information was collected, or 

for any purpose not otherwise permitted by law. 
FAA Small Unmanned Aircraft Systems NPRM

-16-

Application for an Operator Certificate

The PII in AVS Registry is used for many different purposes, to include:

• The type of airman certificates and ratings held;

• Airman’s certificate number; 

• The status of the airman’s certificate (i.e., whether it is current or has been amended, modified, 

expired, suspended or revoked for any reason);

• The airman’s home address, unless requested by the airman to be withheld from public disclosure 

per 49 U.S.C.§ 44703(c);

The FAA is required by law to make certain information about certificated airmen available to certain entities. 

AVS Registry provides the following: 

• Contact information is used to inform airmen of meetings and seminars conducted by the FAA 

regarding aviation safety.

• Information can be disclosed to the National Transportation Safety Board (NTSB) in connection with 

its investigation responsibilities.

• Information about airmen provided to Federal, State, local and Tribal law enforcement agencies when 

engaged in an official investigation in which an airman is involved.

• Records of delinquent civil penalties owed to the FAA provided to the U.S. Department of the Treasury 

(Treasury) and the U.S. Department of Justice (DOJ) for collection pursuant to 31 U.S.C. § 3711(g).

• Airmen records available to users of FAA’s Safety Performance Analysis System (SPAS).

• Information about airmen provided to the Department of Health and Human Services, Office of Child 

Support Enforcement, and the Federal Parent Locator Service that locates noncustodial parents who 

owe child support. Records in this system are used to identify airmen to the child support agencies 

nationwide in enforcing child support obligations, establishing paternities, establishing and modifying 

support orders and locating obligors.

• Make airman, aircraft and operator record elements provided to users of the FAA Skywatch system, 

including the Department of Defense (DOD), the Department of Homeland Security (DHS), the 

Department of Justice (DOJ) and other authorized government users, for their use in managing, tracking 

and reporting aviation-related security events.

• Information about airmen provided to Federal, State, local, and Tribal law enforcement, national 

security or homeland security agencies whenever such agencies are engaged in the performance of 

threat assessments affecting the safety of transportation or national security. 

IACRA limits its use of PII according to the purpose and routine uses specified in the System of Records 

Notice, DOT/FAA 847, Aviation Records on Individuals – 75 FR 68849 - November 9, 2010 . All data 

elements are collected via the IACRA website (http://iacra.faa.gov/iacra) or by a paper FAA Forms. FAA uses 

contact information to follow up with authorized users. The airmen certification information is used to 

uniquely identify airmen and to determine the applicant eligibility for airman certificates and/or ratings and to 

ensure regulatory compliance.
FAA Small Unmanned Aircraft Systems NPRM

-17-

Aircraft Registration

The aircraft registration and recording systems have been established by the statutes and regulations referenced 

above with appropriate notice given to the public by SORN DOT/FAA 801 Aircraft Registration System - 65 

FR 19518 - April 11, 2000, and by Privacy Act notices that are a part of aircraft registration forms. These 

systems are established to enable the FAA to manage today’s safe operation and appropriately plan for the 

future needs and growth in U.S. Civil Aviation; financial institutions and aircraft buyers and sellers to 

confidently enter and support aviation transactions; and to support law enforcement activities for the general 

welfare. There is no doubt that the aircraft registration and recording systems are Public Records meant to be 

accessed and used by the FAA, other Federal and State agencies, law enforcement, the courts, and the general 

aviation community that buy, sell, maintain, and in some fashion support U.S. aviation. 

The Aircraft Registration Database (AR) is available for download from the FAA website. The majority of AR 

data consists of aircraft related descriptive and administrative information like the aircraft’s manufacturer, 

model designation, serial number, registration date, and assigned registration number (N-number). Personally 

identifiable information in the form of the aircraft owner’s name and address is shown when the registered 

aircraft owner happens to be an individual.

The information contained on bills of sale, security agreements or other claim of interest documents is less 

available than data captured for the AR database. Aircraft registration bills of sale, security agreements, and 

claims of interest that are recorded and imaged to be stored as part of an aircraft record in the Electronic 

Document Retrieval System (EDRS) are entered only into a tracking index of recordable documents. This file 

captures only an abbreviation for the type of document, the names of the parties to the document, the date the 

document was filed, and a short description of the aircraft, engine, propeller, or air carrier spare parts location 

affected by the document. This is used by the Aircraft Registration Branch to manage workflow and by title 

research firms and similar individuals to verify the correct filing of submitted documents. The document 

images retained in aircraft records by EDRS are available to the public when they request copy of a record of a 

particular aircraft record at a cost of $10.00. These records are typically reviewed by title firms or interested 

parties in preparation for an aircraft’s sale, its lease to another party, or the preparation and recording of a 

financing agreement. Because minimal data is captured from these documents, and their availability limited to 

specific requests for a particular aircraft record and subject to a copy fee, access to the information on these 

documents is limited by the barriers of process, cost, time, time and effort.

Note Regarding Accessibility of Aircraft Registration

As mentioned previously, the Aircraft Registration Database (AR) is available for download from the FAA 

website. This website is searchable by using the FAA-issued registration number that is unique to each aircraft 

which must visibly be displayed on the aircraft. Personally identifiable information in the form of the aircraft 

owner’s name and address is shown on the website when the registered aircraft owner happens to be an 
FAA Small Unmanned Aircraft Systems NPRM

-18-

individual. Thus, the owner of a small unmanned aircraft can be easily located through identification of a 

small unmanned aircraft’s registration number.16

Administration of an Aeronautical Knowledge Test

The PII would be collected for the sole purpose of taking the small UAS aeronautical knowledge test and 

assuring that it matches with the PII subsequently provided by the same person applying for the UAS operator 

airman certificate. All small UAS operator airman certificate application PII is used in accordance with current 

FAA Orders and statutory requirements discussed previously. 

Accident Reporting

The accident-reporting provision of the NPRM would collect the minimum amount of PII necessary for the 

FAA to be able to: (1) determine what happened; and (2) follow up with the parties involved. These would be 

the two purposes for which PII collected in an accident report would be used.

Data Quality and Integrity

In accordance with Section 552a(e)(2) of the Privacy Act of 1974, DOT should ensure that any PII collected 

and maintained by the organization is accurate, relevant, timely, and complete for the purpose for which it is to 

be used, as specified in the Department’s public notice(s).

Application for an Operator Certificate

The AVS Registry performs extensive edit checks on all data that is entered into the system.

Information is obtained from the airman, Designated Examiner or FAA Inspector that is captured on the 

Airmen Certificate or Rating Application, or by correspondence with the Airmen Certification Branch. 

Applicants who submit an electronic application enter their information directly into the IACRA web based 

application during the registration and certification process. Users with qualified roles review applicant 

certification information for accuracy. Data related to existing airmen certificates entered into IACRA by the 

applicant is compared or validated via the Registry databases. Legal Instruments Examiners and 

clerical/technical staff employed by the branch enter information into CAIS. The information is inspected by 

Quality Control and Quality Assurance processes to ensure accuracy.

Under the provisions of the Privacy Act, individuals may request searches of AVS Registry to determine if any 

records have been added that may pertain to them. This is accomplished by the airman requesting a copy of 

his/her complete airman certification records. An airman can mail: A Request for Copies of My Complete 

Airman File form or a signed, written request stating his/her name, date of birth, social security number or 

certificate number. Requests can be mailed to:

Federal Aviation Administration

Airmen Certification Branch, AFS-760

P.O. Box 25082

Oklahoma City, OK 73125-0082

 16 The AR database is also searchable through a number of other ways. For example, the database can also be searched 

using the name of the registered owner or the make/model of the aircraft.
FAA Small Unmanned Aircraft Systems NPRM

-19-

Aircraft Registration

Data collected for aircraft registration is provided by the aircraft owner or other party to a document. Aircraft 

descriptive information is verified against official descriptions contained in the aircraft registration database. 

Data entry of new or corrective data is performed by trained staff that can rely on other FAA reference records 

and experienced supervisors. Addresses are electronically compared to a U.S. Postal Service listing of 

established addresses. When there is an inconsistency or a question regarding information provided to the 

Aircraft Registration Branch, the aircraft owner is contacted for clarification. Data fields auto fill certain fields 

like the dates of registration or expiration. Other fields are restricted by expected content, for example; 

allowing only numbers in a zip code field. A quality control process is included to check actions taken to 

receive and prepare all documents filed for registration and recordation. Verification practices to ensure a 

document is associated with the correct aircraft record, the correct action is taken with each document, and 

each data entry was what was intended is built into the registration and recordation processes during training. 

This is reinforced with verification steps being written into employee references for performing examination 

and recordation tasks. A sample of all registration and recordings is then reviewed to verify that necessary 

tasks were performed correctly and to monitor any issues that need to clarified, reinforced, or otherwise 

improved.

Aircraft owners are always welcome to review their information in the AR database or to order a copy of the 

aircraft record images in EDRS. Requests for records can be accomplished on-line at http://www.faa.gov or by 

writing to: 

Federal Aviation Administration

Aircraft Registration Branch, AFS-750

P.O. Box 25504

Oklahoma City, OK 72125

Administration of an Aeronautical Knowledge Test

As with its handling of PII collected for existing aeronautical knowledge tests, the FAA would use the same 

methodology to assure the quality and integrity of the PII collected for the small UAS aeronautical knowledge 

test. The PII collected, transmitted and retained by the FAA Knowledge Testing Center would be done in 

accordance with FAA Order 8080.6G. The FAA would retain the aeronautical knowledge test PII as part of its 

airman certification authority and that PII is treated in the same manner as the PII provided by the same person 

subsequently applying for an airman certificate.

Accident Reporting

The FAA would use the same methodology to assure the quality and integrity of the PII collected that it uses 

with manned-aircraft accidents. The PII collected by the local FAA office as part of an accident report would 

be done in accordance with FAA Order 8900.1. That accident report data would then be submitted to the FAA 

Office of Accident Investigation and Prevention, which would automatically strip PII as part of the process of 

entering the pertinent accident data into the FAA Accident/Incident Data system.
FAA Small Unmanned Aircraft Systems NPRM

-20-

Security 

DOT shall implement administrative, technical, and physical measures to protect PII collected or maintained 

by the Department against loss, unauthorized access, or disclosure, as required by the Privacy Act, and to 

ensure that organizational planning and responses to privacy incidents comply with OMB policies and 

guidance. 

Safeguards Applied to All UAS-Related PII Systems

Several of the FAA’s PII-protective security safeguards apply equally to all of the systems examined in this 

analysis. Most notable among these are the safeguards incorporating standards and practices required for 

federal information systems under the Federal Information Security Management Act (FISMA) and are 

detailed in Federal Information Processing Standards (FIOS) Publication 200, Minimum Security 

Requirements for Federal Information and Information Systems, dated March 2006, and National Institute of 

Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4, Security and Privacy Controls 

for Federal Information Systems and Organizations, dated April 2013. 

Application for an Operator Certificate and Aircraft Registration

AVS Registry protects PII with numerous reasonable security safeguards against loss, unauthorized access, 

destruction, usage, modification, or disclosure. One element of the FAA’s registry-specific safeguards includes

controlled access by Resource Access Control Facility (RACF), Complete Security, and Natural Security. 

Role-based security is defined within the AVS Registry applications. Roles are assigned based on job title and 

need. Users receive the least privileges possible to perform their job duties.

Another registry-specific security element is that IACRA protects PII with reasonable security safeguards 

against loss or unauthorized access, destruction, usage, modification, or disclosure. These safeguards 

incorporate standards and practices required for federal information systems under the Federal Information 

Security Management Act (FISMA) and are detailed in Federal Information Processing Standards (FIPS) 

Publication 200, Minimum Security Requirements for Federal Information and Information Systems, dated 

March 2006, and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 

Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, dated April 

2013. The IACRA is approved through the Security Authorization Process under NIST. As of the date of 

publication of this PIA, the IACRA was last authorized on May 21, 2013. 

Strict controls have been imposed to minimize the risk of compromising the information that is being stored. 

Access to the computer system containing the records in IACRA is limited to those individuals who have a 

need to know the information for the performance of their official duties and who have appropriate clearances 

and permissions. All records in IACRA are protected from unauthorized access through appropriate 

administrative, physical, and technical safeguards. 

IACRA is categorized as a high risk system in accordance with NIST Federal Information Processing 

Standards (FIPS) 199. Accordingly, access to the PII within IACRA is restricted to users based on their role 

and only after consent by the airman applicant. All IACRA users are required to have assigned user names and 

passwords. Usernames are associated with specific IACRA functions so only those functions that are 

authorized to a specific user are available. Annual security and privacy training is conducted and required of all 

employees.
FAA Small Unmanned Aircraft Systems NPRM

-21-

Knowledge Test Administration

The FAA would secure small UAS aeronautical knowledge test PII collected in the same manner that it 

protects PII collected as part of existing aeronautical knowledge tests. The PII is kept secure at the FAA 

Knowledge Testing Center in accordance with FAA Order 8080.6G. The PII would also be kept secure within 

a secure FAA facility and within a secure FAA server, all which are only accessible by FAA personnel with 

the required access clearance.

Accident Reporting

The FAA would secure all PII collected as part of small UAS accident reporting in the same manner that it 

protects PII collected as part of manned aircraft accident reporting. The accident report PII is kept secure at 

the local FAA office to which the report was given and within a secure FAA server, all of which are only 

accessible by FAA personnel with the required access clearance.

Accountability and Auditing 

DOT shall implement effective governance controls, monitoring controls, risk management, and assessment 

controls to demonstrate that the Department is complying with all applicable privacy protection requirements 

and minimizing the privacy risk to individuals.

FAA Order 1280.1, Protecting Personally Identifiable Information (PII), implements the various privacy laws 

based on the Privacy Act of 1974 (the Privacy Act), the E-Government Act of 2002 (Public Law 107-347), the 

Federal Information Security Management Act (FISMA), Department of Transportation (DOT) privacy 

regulations, Office of Management and Budget (OMB) mandates, and other applicable DOT and FAA Records 

Management procedures and guidance. 

In addition to these practices, additional policies and procedures would be consistently applied, especially as 

they relate to protection, retention, and destruction of records. Federal and contract employees would be given 

clear guidance regarding their duties as they relate to collecting, using, processing, and securing privacy data. 

Guidance would be provided in the form of mandatory annual security and privacy awareness training as well 

as FAA Privacy Rules of Behavior. 

Application for an Operator Certificate and Aircraft Registration

The FAA would conduct periodic privacy compliance reviews of the Integrated Airmen Certification and 

Ratings Application (IACRA) with the requirements of the Office of Management and Budget (OMB) Circular 

A-130. Access to data submitted via IACRA is through authenticated accounts. Users must register through 

IACRA to receive a login name and password and an assigned FAA Tracking Number (FTN). The FTN is a 

permanent and unique number. The system also limits access to PII according to job function. IACRA 

captures date, time, client IP and user name in the audit logs. During the security assessment, independent 

assessors evaluated the security controls to ensure their compliance. Input validation is used to ensure

accuracy and completeness of user entries into the system. IACRA utilizes a Secure Socket Layer (SSL) 

protocol to protect the integrity of transmitted information.

Knowledge Test Administration

Only those persons with the required job function and data access would have access to the aeronautical 

knowledge test PII. In addition, the integrity of the PII received by the FAA would be protected in the same 

manner at that PII provided when applying for an airman certificate. 
FAA Small Unmanned Aircraft Systems NPRM

-22-

Accident Reporting

Small UAS operator and owner PII would be treated the same way as that for manned aircraft pilots and 

owners. Only those persons with the required job function and data access would have access to the collected 

small UAS accident reporting PII. In addition, the integrity of the small UAS accident reporting PII given to 

the FAA using an online reporting system would be protected using FAA website and internal server security 

protocols. 

Responsible Official

Lance Nuckolls

Aviation Safety Inspector

202-267-8447

UAS-rule@faa.gov

Approval and Signature 

Original signed and on file with the DOT Privacy Office

Claire W. Barrett

Chief Privacy & Information Asset Officer

Office of the Chief Information Officer