U.S. Department of Transportation

Privacy Impact Assessment

Federal Aviation Administration (FAA) 

Office of Aviation Safety (AVS)

Aircraft Registration

Responsible Official

Jana Hammer

Civil Aviation Registry, Program Manager

Office of Aviation Safety (AVS)

Reviewing Official

Claire W. Barrett

Chief Privacy & Information Asset Officer

Office of the Chief Information Officer

privacy@dot.gov
FAA/Office of Aviation Safety Aircraft Registration

-1-

Executive Summary

The Aircraft Registration System, also known as the Aircraft Registry or AVS Registry, was developed to help 

the Federal Aviation Administration (FAA) meet its responsibilities for the certification and registration of 

aircraft under 49 United States Code (U.S.C.) § 44103. The Aircraft Registry serves as the national repository 

for aircraft registration records and provides the central services necessary for control of these records, which 

are used by FAA to analyze safety data and manage time-intensive processes such as examination activities.

The FAA previously published a Privacy Impact Assessment (PIA) in accordance with the E-Government Act 

of 2002, because the Aircraft Registry records contain personally identifiable information on individuals 

registering aircraft – see Airmen/Aircraft Registry Modernization System. This updated PIA for the aircraft

registration portion of the Aircraft Registry is being published because the FAA is adding additional web-based 

capabilities to facilitate the registration of small Unmanned Aircraft Systems (sUAS) under a new part 48 of 

title 14, Code of Federal Regulations; the airmen portion of the AVS Registry will be addressed in a separate 

PIA. 

What is a Privacy Impact Assessment?

The Privacy Act of 1974 articulates concepts for how the federal government should treat individuals and their 

information and imposes duties upon federal agencies regarding the collection, use, dissemination, and maintenance of 

personally identifiable information (PII). The E-Government Act of 2002, Section 208, establishes the requirement for 

agencies to conduct privacy impact assessments (PIAs) for electronic information systems and collections. The 

assessment is a practical method for evaluating privacy in information systems and collections, and documented 

assurance that privacy issues have been identified and adequately addressed. The PIA is an analysis of how information 

is handled to—i) ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; 

ii) determine the risks and effects of collecting, maintaining and disseminating information in identifiable form in an 

electronic information system; and iii) examine and evaluate protections and alternative processes for handling 

information to mitigate potential privacy risks.1

Conducting a PIA ensures compliance with laws and regulations governing privacy and demonstrates the DOT’s 

commitment to protect the privacy of any personal information we collect, store, retrieve, use and share. It is a 

comprehensive analysis of how the DOT’s electronic information systems and collections handle personally identifiable 

information (PII). The goals accomplished in completing a PIA include:

- Making informed policy and system design or procurement decisions. These decisions must be based on 

an understanding of privacy risk, and of options available for mitigating that risk;

- Accountability for privacy issues;

- Analyzing both technical and legal compliance with applicable privacy law and regulations, as well as 

accepted privacy policy; and

- Providing documentation on the flow of personal information and information requirements within DOT 

systems.

Upon reviewing the PIA, you should have a broad understanding of the risks and potential effects associated with the 

Department activities, processes, and systems described and approaches taken to mitigate any potential privacy risks. 

 1

Office of Management and Budget’s (OMB) definition of the PIA taken from guidance on implementing the privacy 

provisions of the E-Government Act of 2002 (see OMB memo of M-03-22 dated September 26, 2003). 
FAA/Office of Aviation Safety Aircraft Registration

-2-

Introduction & System Overview 

The primary mission of the FAA is to provide the safest, most efficient aerospace system in the world. One of 

the ways the FAA supports this mission is through the registration of aircraft, as required under Title 49 of the 

United States Code. The FAA’s rules governing all aviation activities in the United States can be found in 

Title 14 of the Code of Federal Regulations (CFR). A wide variety of aviation-related activities are regulated, 

such as airplane design, typical airline flights, pilot training activities, hot-air ballooning, and even model 

rocket launches. The rules are designed to promote safe aviation while protecting pilots, passengers, and the 

general public from unnecessary risk. Aircraft owners are responsible for compliance and familiarity with the 

applicable 14 CFR part(s) concerning the operation and maintenance of their aircraft. Aircraft owners must 

register aircraft they purchase and intend to operate in the National Air Space (NAS) with the Aircraft 

Registration Branch (AFS-750). 

The Aircraft Registration Branch is responsible for the national programs of aircraft registration including 

small Unmanned Aircraft Systems (sUAS) registration. In addition, the Aircraft Registration Branch is 

responsible for the recording of encumbrances against U.S. civil aircraft, identification of registered aircraft, 

and law enforcement assistance as it involves the aircraft registration program. The Aircraft Registration

Branch is tasked to register aircraft in accordance with 49 U.S.C. §§ 44102 through 44103, and to provide a 

system for recording conveyances that affect an interest in civil aircraft of the United States under 49 U.S.C. §§

44107 and 44108. The FAA also must ensure that registration and recordation systems effectively serve the 

needs of buyers and sellers of aircraft, officials responsible for enforcing laws related to the regulation of 

controlled substances under 21 U.S.C. § 802, and others users of the Aircraft Registry under US.C. § 44111. In 

October 2015, the Department clarified that because unmanned aircraft are aircraft, as defined by statute, they

must be registered with the FAA prior to operation. The FAA, however, recognizes the benefits of this new 

technology and that the existing paper-based system used for manned aircraft would be too onerous to fully 

meet the needs of small unmanned aircraft owners. Therefore, the FAA has developed a stream-lined, webbased alternative that small unmanned aircraft owners may take advantage of to register their aircraft. Small 

unmanned aircraft owners who opt to use this system in lieu of the paper-based system will create an account 

via the online website, submit the required information discussed later in this document, and obtain an FAA 

unique identifier that they will mark on their aircraft. The marking will link the aircraft to the owner. 

Information submitted by aircraft owners under either the legacy, paper-based system or the new, streamlined 

web-based system is used by the FAA to help link the aircraft with its owner, educate owners, and when 

necessary, aid in pursuing enforcement action.

The Aircraft Registry is a central repository of all registered aircraft. The Aircraft Registry satisfies treaty 

obligations under the Convention on International Civil Aviation (ICAO), Annex 7, and is also used to 

determine that aircraft are registered. The central repository provides summary descriptive statistics for the 

development of analytical studies in support of FAA safety programs and agency management; and provides

aircraft owners and operators information about potential mechanical defects or unsafe conditions of their 

aircraft in the form of airworthiness directives. The new, web-based registration process (see 14 CFR part 48)

is designed only for small unmanned aircraft that weigh between .55 pounds and 55 pounds and are intended 

for use solely within the United States, as unmanned aircraft registered under this system will not receive a 

U.S. nationality identifier currently recognized by ICAO.
FAA/Office of Aviation Safety Aircraft Registration

-3-

Aircraft owners, including UAS commercial owners, are required to register aircraft over 55 pounds by 

completing the Aeronautical Center (AC) Form 8050-1, Aircraft Registration Application2. Individuals must 

obtain an original Aircraft Registration Application Form, AC Form 8050-1, from the Aircraft Registration 

Branch AFS-750 or their local Flight Standards District Office (FSDO). The aircraft owner must provide their:

• Full Name;

• Address;

• Phone number (providing a phone number is voluntary);

• Citizenship (Applicants must certify that they are a US citizen or a lawfully admitted resident 

alien);

• Aircraft Registration Number (N Number);

• Aircraft information (manufacturer make and model and serial number); and

• Legal Documents/Records (e.g., evidence of ownership (such as bill of sale), divorce decree, 

court order). 

The Form 8050-1 and evidence of ownership (such as a bill of sale), and payment for the $5 registration fee is 

mailed to the FAA. Upon receipt of these documents by the Aircraft Registration branch, they are time 

stamped to establish order of receipt. Any fees received are posted on the corresponding documents. The 

documents are identified by type (envelope, application, evidence of ownership, correspondence, financial 

claim, etc.), placed in order for review, and scanned to create a work packet containing complete images, front 

and back, of all items received. This work packet is then sent to be reviewed by the aircraft registration 

examination staff in the order of receipt and priority for review. Imported and new aircraft are worked 

first. This is because they are unable to be operated until they are assigned a registration number and 

registered. An undue financial burden could be suffered by their owners if they had to wait several days to be 

registered. Upon review of the items provided in the work packet, the examiner will determine if all 

requirements have been met to assign a U.S. Registration Number, register the aircraft and record the financial 

claim documents. If the items do not meet the requirements for registration of recordation, a letter is sent that 

explains what must be done, supplied or corrected to enable registration or recordation. Unless returned for 

correction, the original paper documents and images are retained until a reply is received. When the 

registration examiner determines that all requirements are met, the images are annotated with a dated 

registration or recordation notation and transferred permanently into the aircraft’s record file. At this point, if 

the aircraft is registered, or the registration is updated or renewed a certificate of aircraft registration is mailed 

to the owner, and if requested a registration letter is sent by facsimile to support operation of the aircraft within 

the NAS until the formal certificate is delivered. The registration number is assigned to the aircraft.

sUAS Registration under 14 CFR part 48

For owners of small unmanned aircraft who opt to register using the web-based application, (sUAS 

Registration System) the information that is required to be submitted depends on the intended use of the 

unmanned aircraft, as discussed below. To begin the registration process under this system, the applicant must 

create an account by providing an email address and password. The system will advise the applicant that in 

order to create an account, the applicant must be at least 13 years old. The applicant is sent a verification email 

to confirm account registration. The applicant confirms the registration by clicking the link provided in the 

 2 Instructions for completing the AC Form 8050-1, Aircraft Registration is available at www.faa.gov or your local FSDO,
FAA/Office of Aviation Safety Aircraft Registration

-4-

email and logs in using the email address and password to activate their account. First time users must create a 

user profile. To create a user profile, the applicant provides a name, physical address, and mailing address (if 

different from physical address). After completing the user profile, all applicants must indicate 

acknowledgement of safety guidelines. All applicants must pay a $5 registration fee using a credit card. For 

individuals registering aircraft intended to be used exclusively as model aircraft, they will pay a $5 fee and 

receive a unique identifier that can be used to mark all of their aircraft. For others registering small unmanned 

aircraft intended for use as other than model aircraft, they will create one account and register each aircraft 

under that account. A $5 fee will be charged and a unique identifier assigned for each aircraft registered under 

the account. The credit card information (name, billing address, credit card number, and security code and 

expiration date) collected is used by the FAA’s payment processor Stripe.com to process the payment 

registration. For more information regarding Stripe.com privacy practices go to https://stripe.com/us/privacy. 

Once the transaction is processed, the applicant will receive a transaction confirmation that will include the 

registration number. The applicant can print their registration certificate through a link that is provided. 

For small unmanned aircraft owners intending to use the aircraft for non-model aircraft operations (such as 

commercial operations), they will be required to include the following information in their online account:

• Applicant name or name of authorized representative;

• Applicant physical address (and mailing address if different than physical address)

• Applicant email address or email address of authorized representative;

• Applicant phone number; and 

• Aircraft manufacturer and model name, as well as serial number, if available.

For small unmanned aircraft owners intending to use the aircraft solely as model aircraft as defined in section 

336 of Public Law 112-95, they will be required to include the following information in their account:

• Applicant name

• Applicant physical address (and mailing address if different than physical address)

• Applicant email address;

• Other information as required by the Administrator.

Applicants will also have the option to include their phone number but this information will not be required for 

these owners. 

While the paper-based system requires applicants to certify their citizenship, the web-based registration 

process only will advise applicants of the citizenship requirements. For those that satisfy the statutory 

requirement for citizenship, the certificate that is issued will constitute a certificate of U.S. registration. NonU.S. citizens seeking permission from the Secretary to operate in the U.S. will be required to complete the 

web-based registration application. For this population, the certificate will constitute recognition of ownership 

and depending on the type of operation to be conducted, additional FAA safety authority and DOT economic 

authorities may be required before operations may commence.

Under both the legacy, paper-based system and the streamlined web-based application for registration of small 

unmanned aircraft, the aircraft owners must renew their registration every three years. To facilitate that 

process under the paper-based system, the FAA sends each aircraft owner a “Notice: Expiration of Aircraft 
FAA/Office of Aviation Safety Aircraft Registration

-5-

Registration” letter six months before the registration expires. Upon receiving the letter, aircraft owners can 

submit their renewals by mailing in the paper Aircraft Registration Renewal Application or via the Aircraft 

Registration Renewal website. To use the website, the aircraft owner enters their aircraft’s N-Number and the 

random, unique security code sent to them in the expiration notice letter. Once logged in, the website will 

display their aircraft owner’s registration information. If no changes are necessary, the aircraft owner affirms 

that the information is accurate. If changes are necessary, the individual must complete paper renewal 

application and mail it to the Aircraft Registration Branch for processing. The $5 registration renewal fee is 

processed by the FAA cashier and accounting offices or, if paid by credit card, pay.gov3. Aircraft Registry 

does not contain any payment information. A transaction identification number will be assigned upon 

confirmation of payment.

For small unmanned aircraft owners registered using the streamlined, web-based application, they will renew 

their registration via an online renewal process and pay the renewal fee. The registration renewal fee is $5. A 

Certificate of Aircraft Registration will be available to print within the registration system or sent to the 

registrant via email following the initial registration and subsequent renewals. The certificate of registration is 

generally valid until the owner’s address changes, the aircraft is sold or destroyed, it has expired under the 

three-year renewal period, the owner’s eligibility status changes, or the owner registers the aircraft in a foreign 

country.

Fair Information Practice Principles (FIPPs) Analysis

The DOT PIA template is based on the fair information practice principles (FIPPs). The FIPPs, rooted in the tenets of 

the Privacy Act, are mirrored in the laws of many U.S. states, as well as many foreign nations and international 

organizations. The FIPPs provide a framework that will support DOT efforts to appropriately identify and mitigate 

privacy risk. The FIPPs-based analysis conducted by DOT is predicated on the privacy control families articulated in the 

Federal Enterprise Architecture Security and Privacy Profile (FEA-SPP) v34

, sponsored by the National Institute of 

Standards and Technology (NIST), the Office of Management and Budget (OMB), and the Federal Chief Information 

Officers Council and the Privacy Controls articulated in Appendix J of the NIST Special Publication 800-53 Security and 

Privacy Controls for Federal Information Systems and Organizations5

.

Transparency

Sections 522a(e)(3) and (e)(4) of the Privacy Act and Section 208 of the E-Government Act require public notice of an 

organization’s information practices and the privacy impact of government programs and activities. Accordingly, DOT is 

open and transparent about policies, procedures, and technologies that directly affect individuals and/or their personally 

identifiable information (PII). Additionally, the Department should not maintain any system of records the existence of 

which is not known to the public. 

The DOT deploys multiple techniques to ensure that individuals are informed of the need to register their 

aircraft and the purposes for which the Department collects and maintains personally identifiable information 

(PII) in support of aircraft registration and certification activities.

The FAA retrieves records in the Aircraft Registry by an individual’s name and other personal identifiers and 

protects Privacy Act records in accordance with the Department’s published system of records notice (SORN) 

 3 Applicable SORN located at https://www.fiscal.treasury.gov/fsservices/gov/rvnColl/otcNet/sorn.pdf 4 http://www.cio.gov/documents/FEA-Security-Privacy-Profile-v3-09-30-2010.pdf 5 http://csrc.nist.gov/publications/drafts/800-53-Appdendix-J/IPDraft_800-53-privacy-appendix-J.pdf
FAA/Office of Aviation Safety Aircraft Registration

-6-

entitled DOT/FAA 801 Aircraft Registration Records. An amended SORN was published in the Federal 

Register (available at www.transportation.gov/privacy) to ensure that the public is made aware that records 

created to comply with the sUAS registration requirements are also covered by this notice. As required, a 

Privacy Act statement discussing the Department’s privacy practices regarding the collection, use, sharing, 

safeguarding, maintenance, and disposal of personally identifiable information is included on all applicable 

forms used to register aircraft with the FAA. 6 A Privacy Act Statement is also available on the sUAS 

Registration Site.

The publication of this PIA demonstrates DOT’s commitment to provide appropriate transparency into the 

Aircraft Registry and the sUAS Registration Site. You may submit comments, identified by docket number 

DOT-OST-2015-0258, by any of the following methods: 

• Federal e-Rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting 

comments. 

• Mail: Docket Management Facility, U.S. Department of Transportation, 1200 New Jersey Ave. SE., 

West Building Ground Floor, Room W12–140, Washington, DC 20590–0001. 

• Hand Delivery or Courier: West Building Ground Floor, Room W12–140, 1200 New Jersey Ave. 

SE., between 9 a.m. and 5 p.m. ET, Monday through Friday, except Federal Holidays.

Individual Participation and Redress

DOT should provide a reasonable opportunity and capability for individuals to make informed decisions about the 

collection, use, and disclosure of their PII. As required by the Privacy Act, individuals should be active participants in 

the decision making process regarding the collection and use of their PII and be provided reasonable access to their PII 

and the opportunity to have their PII corrected, amended, or deleted, as appropriate.

Under the provisions of the Privacy Act, individuals may request searches to determine if any records have 

been added that may pertain to them. Individuals wishing to know if their records appear in this system may 

inquire in person or in writing to:

Federal Aviation Administration

Privacy Office

800 Independence Ave. SW

Washington, DC 20591

Included in the request must be the following:

• Name

• Mailing address

• Phone number and/or email address

• A description of the records sought, and if possible, the location of the records

Contesting record procedures: 

Individuals wanting to contest information about themselves that is contained in this system should make their 

requests in writing, detailing the reasons for why the records should be corrected to the following address: 

 6 The complete listing of aircraft registration forms may be found on the FAA’s public website -

http://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_registry/aircraft_regn_forms/.
FAA/Office of Aviation Safety Aircraft Registration

-7-

Federal Aviation Administration

Privacy Office

800 Independence Ave. SW 

Washington, DC 20591

All aircraft must register with the FAA to operate in the NAS. For aircraft registered under 14 CFR part 47,

information in the Aircraft Registry is collected directly from the aircraft owner through the use of paper-based 

forms and other hard copy supplemental documentation submitted by the aircraft owner. Once received by the 

FAA, these documents are converted into electronic documents and maintained in the Aircraft Registration 

System. Individuals may verify that the FAA has received and uploaded their forms and documentation in the 

Aircraft Registry by conducting a search for their records in the Aircraft Registry using the FAA’s Aircraft 

Inquiry tool.7

 For small unmanned aircraft registered under 14 C.F.R. part 48, information is also collected 

directly from the aircraft owner through a web-based application. Aircraft owners may verify that their 

information is correct by accessing their account via the registration website. Individuals may also confirm 

their name and address information is correct by using the public search function available on the FAA’s 

website, which allows searches by unique identifier only. 

Aircraft owners may update their information during the registration renewal process or at any other time the 

aircraft owner chooses.

Purpose Specification 

DOT should (i) identify the legal bases that authorize a particular PII collection, activity, or technology that impacts 

privacy; and (ii) specify the purpose(s) for which its collects, uses, maintains, or disseminates PII.

Under 49 U.S.C. §§ 44102 and 44103, the FAA is required to register aircraft and maintain an aircraft registry.

The Aircraft Registry is used to:

• Provide a register of United States civil aircraft to aid in the national defense and to support a safe and 

economically strong civil aviation system, and to meet treaty requirements under the Convention on 

International Civil Aviation, Annex;

• Determines that aircraft are registered in accordance with the provisions of 49 U.S.C. 44103;

• Supports FAA safety programs and agency management; 

• Aids law enforcement and aircraft accident investigations; 

• Serves as a repository of legal documents to determine legal ownership of aircraft;

• Provide aircraft owners and operator information about potential mechanical defects or unsafe 

conditions of their aircraft in the form of airworthiness directives;

• Educate owners on safe operating requirements; and

• Receive and record payment of aircraft registration fee.

FAA collects the name of the aircraft owner and address, so that aircraft can be associated with an owner. This 

assists the FAA in its compliance efforts, by allowing the FAA to identify the owner and when there is an 

incident, and educate them on safe operating requirements and, when appropriate, take enforcement action 

against individuals who violate the rules or operate unsafely. Under the legacy, paper-based system in 14 

 7 http://registry.faa.gov/aircraftinquiry/Aircraft_Inquiry.aspx
FAA/Office of Aviation Safety Aircraft Registration

-8-

CFR part 47, the FAA also collects legal documents establishing title and lienholders to establish aircraft 

ownership for registered aircraft.

Data Minimization & Retention

DOT should collect, use, and retain only PII that is relevant and necessary for the specified purpose for which 

it was originally collected. DOT should retain PII for only as long as necessary to fulfill the specified 

purpose(s) and in accordance with a National Archives and Records Administration (NARA)-approved record 

disposition schedule.

Under both the paper-based system in 14 CFR part 47 and the streamlined, web-based system for small 

unmanned aircraft in part 48, the FAA collects the minimum amount of information necessary to establish and 

maintain the record for all United States civil aircraft. The digital images of aircraft registration are the official 

legal record. For the part 47 process, the paper forms are maintained until it has been confirmed that the digital 

image meets quality standards and in accordance with retention policies and are destroy upon completion of 

quality review.

The National Archives and Records Administration (NARA) working in partnership with the FAA has 

designated the Civil Aviation Registry, to include Aviation Registry aircraft registration records and image file 

indexes, as the Permanent Record for United States civil aircraft registration information. These records are 

therefore kept as permanent records in accordance with the NARA approved records disposition schedule N1-

237-04-03. The permanent retention of the records allows for research and a complete history of specific

aircraft and documents the development and progression of registration of the American Aircraft Registration

System.

The FAA is working with NARA to establish an appropriate retention period for records collected under part 

48. Consistent with the Federal Records Act will manage these records as permanent records until NARA has 

determined their historical value and issued an approved records disposition schedule. 

Use Limitation

DOT shall limit the scope of its PII use to ensure that the Department does not use PII in any manner that is not specified 

in notices, incompatible with the specified purposes for which the information was collected, or for any purpose not 

otherwise permitted by law. 

The DOT/FAA 801 Aircraft Registration Records SORN includes one system specific routine use permitting 

the sharing of Privacy Act records:

• To the public (including government entities, title companies, financial institutions, international 

organizations, FAA designee airworthiness inspectors, and others) information through the Aircraft 

Registry, including aircraft owner’s name, address, United States Registration Number, aircraft type, 

and legal documents related to title or financing. Email addresses and credit card information will 

not be disclosed pursuant to this Routine Use. The public may only retrieve the name and address of 

owners of sUAS used for recreational purposes by aircraft registration number

• To law enforcement when necessary and relevant to a FAA enforcement activity.
FAA/Office of Aviation Safety Aircraft Registration

-9-

The Department has also published 14 additional routine uses applicable to all DOT Privacy Act systems of 

records, including this system. These routine uses are published in the Federal Register at 75 FR 82132,

December 29, 2010, and 77 FR 42796, July 20, 2012, under ‘‘Prefatory Statement of General Routine Uses’’ 

(available at http://www.transportation.gov/ privacy/privacyactnotices).

Data Quality and Integrity

In accordance with Section 552a(e)(2) of the Privacy Act of 1974, DOT should ensure that any PII collected and 

maintained by the organization is accurate, relevant, timely, and complete for the purpose for which it is to be used, as 

specified in the Department’s public notice(s).

FAA collects, uses, and retains data that is relevant and necessary for the purpose for which it was collected.

The Aircraft Registry performs extensive edit checks on all data that is entered into the system. It maintains 

images of the documents it receives on aircraft owners as the legal record; database entries are checked against 

these images and the images can be referred to at any time as an authoritative source. The aircraft information 

is inspected by Quality Control and Quality Assurance processes to ensure accuracy. 

Aircraft owners must renew their aircraft registration every three years; at that time, they must certify that the 

information associated with their registration is still accurate. If it is not accurate, they are required to make the 

appropriate updates. For registrations under the paper-based system in 14 CFR part 47, registered owners are 

required to notify the FAA in writing of any change of address within 30 day after any change in owner’s 

mailing address. Registered owner can also send a letter to the FAA for name change. 

Under the paper-based system, in compliance with statutory requirements, documents are processed in datereceived order. Applicants may check to see if their documents have been received by using the FAA website 

“Aircraft Registration” link, and selecting the “Download the Aircraft Registration Database” link to search the 

document index. The FAA updates the “Aircraft Registration Inquiry” site at midnight on each federal 

workday. Applicant can find new information immediately following this update. 

Occasionally, items of sensitive PII (SPII) not necessary to accomplish aircraft registration are submitted for 

inclusion in the aircraft record. Like any information submitted as part of the aviation registration activity, 

SPII is considered to have been knowingly submitted to a public record. Such submission to a known public 

record is considered tantamount to permission to release the data. Any individual whose SPII appears in the 

aircraft record may request the redaction of that information. The FAA will take immediate action to redact 

SPII from publically accessible records that is not necessary to maintain the integrity of the aircraft record.

With respect to those registering small unmanned aircraft under 14 CFR part 48, these owners are responsible 

for the accuracy of their information. They must certify the information is accurate and required to make the 

appropriate updates. sUAS owner can also access their online account and update their information when 

necessary. Lastly, the owner must renew their registration every 3 years.

Security 

DOT shall implement administrative, technical, and physical measures to protect PII collected or maintained by the 

Department against loss, unauthorized access, or disclosure, as required by the Privacy Act, and to ensure that 

organizational planning and responses to privacy incidents comply with OMB policies and guidance. 

FAA protects PII with reasonable security safeguards against loss or unauthorized access, destruction, usage, 

modification, or disclosure. These safeguards incorporate standards and practices required for federal 
FAA/Office of Aviation Safety Aircraft Registration

-10-

information systems under the Federal Information Security Management Act (FISMA) and are detailed in 

Federal Information Processing Standards (FIPS) Publication 200, Minimum Security Requirements for 

Federal Information and Information Systems, dated March 2006, and National Institute of Standards and 

Technology (NIST) Special Publication (SP) 800-53, Revision 4, Security and Privacy Controls for Federal 

Information Systems and Organizations, dated April 2013. 

The Aircraft Registry is considered a high-risk system and was issued a three-year authority to operate (ATO) 

on June 24, 2014. Access to the system is limited to those with appropriate security credentials, an authorized 

purpose, and need-to-know. The FAA deploys role-based access controls in addition to other protection 

measures reviewed and certified by the FAA’s cybersecurity professionals to maintain the confidentiality, 

integrity, and availability requirements of the system.

The sUAS Registration System is a moderate-risk system and will be issued an authority to operate based on 

the outcome of security testing and evaluation no later than December 16, 2015. 

Accountability and Auditing 

DOT shall implement effective governance controls, monitoring controls, risk management, and assessment controls to 

demonstrate that the Department is complying with all applicable privacy protection requirements and minimizing the 

privacy risk to individuals.

FAA’s Office of the Chief Information Officer, Office of information Systems Security, Privacy Division is 

responsible for governance and administration of FAA Order 1280.1B, Protecting Personally Identifiable 

Information (PII). FAA Order 1280.1 implements the various privacy laws based on the Privacy Act of 1974 

(the Privacy Act), the E-Government Act of 2002 (Public Law 107-347, the Federal Information Security 

Management Act (FISMA), Department of Transportation (DOT) privacy regulations, Office of Management 

and Budget (OMB) mandates, and other applicable DOT and FAA information and information technology 

management procedures and guidance.

In addition to these practices, additional policies and procedures will be consistently applied, especially as they 

relate to the access, protection, retention, and destruction of personally identifiable information. Federal and 

contract employees are given clear guidance in their duties as they relate to collecting, using, processing, and 

security privacy data. Guidance was to be provided in the form of mandatory annual security and privacy 

awareness training, as well as FAA Privacy Rules of Behavior. The DOT and FAA Privacy Offices will 

conduct periodic privacy compliance reviews of Aircraft Registry and UAS Registration Site with the 

requirements of OMB Circular A-130.

Responsible Official

Jana Hammer

Civil Aviation Registry, Program Manager

Office of Aviation Safety

Approval 

Claire W. Barrett

Chief Privacy & Information Asset Officer

Office of the Chief Information Officer 
FAA/Office of Aviation Safety Aircraft Registration

-11-