# U.S. Department of Transportation

**Privacy Impact Assessment**

**Federal Aviation Administration (FAA )**  **Office of Aviation Safety (AVS)**
**A ircraft Registr**  **ation**

**Responsible Official**

Jana Hammer Civil Aviation Registry, Program Manager Office of Aviation Safety (AVS)



### Reviewing Official
Claire W. Barrett Chief Privacy & Information Asset Officer

Office of the Chief Information Officer privacy@dot.govFAA/Office of Aviation Safety Aircraft Registration

- 1

- 

### Executive Summary

The A ircraft Registration System , also known as the Aircraft Registry or AVS Registry

, was developed to help
the Federal Aviation Administration (FAA) meet its responsibilities for the certification and registration of
aircraft under 49 United States Code (U.S.C.) § 44103. The Aircraft Registry serves as the national repository
for aircraft registration records and provides the central services necessary for control of these re cords, which are used by FAA to analyze safety data and manage time

- intensive processes such as examination activities. The FAA previously published a Privacy Impact Assessment (PIA) in accordance with the E

- Government Act of 2002, because the A ircraft Registry records contain personally identifiable information o n individuals registering aircraft

– see Airmen/Aircraft Registry Mode rnization System . This updated PIA for the aircraft registration portion of the A ircraft Registry is being published because the FAA is adding additional web

- based capabilities to facilitate the registration of small Unmanned Aircraft Systems ( s UAS) under a new part 48 of title 14, Code of Federal Regulations ; the airmen portion of the AVS Registry will be addressed in a separate
PIA

. 

### What is a Privacy Impact Assessment?

The Privacy Act of 1974 articulates concepts for how the federal government sh ould treat individuals and their information and imposes duties upon federal agencies regarding the collection, use, dissemination, and maintenance of personally identifiable information (PII). The E

- Government Act of 2002, Section 208, establishes the req uirement for agencies to conduct privacy impact assessments (PIAs) for electronic information systems and collections. The assessment is a practical method for evaluating privacy in information systems and collections, and documented assurance that privacy issues have been identified and adequately addressed. The PIA is an analysis of how information
is handled to

— i) ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; ii) determine the risks and effects of co llecting, maintaining and disseminating information in identifiable form in an electronic information system; and iii) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. 1

Conducting a PIA ensures compliance with laws and regulations governing privacy and demonstrates the DOT’s commitment to protect the privacy of any personal information we collect, store, retrieve, use and share. It is a comprehensive analysis of how the D OT’s electronic information systems and collections handle personally identifiable information (PII). The goals accomplished in completing a PIA include:

- Making informed policy and system design or procurement decisions. These decisions must be based on

a n understanding of privacy risk, and of options available for mitigating that risk;

- Accountability for privacy issues;

- Analyzing both technical and legal compliance with applicable privacy law and regulations, as well as accepted privacy policy; and

- Provid ing documentation on the flow of personal information and information requirements within DOT systems.

Upon reviewing the PIA, you should have a broad understanding of the risks and potential effects associated with the Department activities, processes, an d systems described and approaches taken to mitigate any potential privacy risks.

1 Office of Management and Budget’s (OMB) definition of the PIA taken from guidance on implementing the privacy provisions of the E

- Government Act of 2002 (see OMB memo of M

- 03

- 22 dated September 26, 2003).FAA/Office of Aviation Safety Aircraft Registration

- 2

- 

### Introduction & System Overview

The primary mission of the FAA is to provide the safest, most efficient aerospace system in the world. One of the ways the FAA supports thi s mission is through the registration of aircraft, as required under Title 49 of the
United States Code

. The FAA’s rules governing all aviation activities in the United States can be found in
Title 14 of the Code of Federal Regulations ( CFR )

. A wide variety of aviation

- related activities are regulated, such as airplane design, typical airline flights, pilot training activities, hot

- air ballooning, and even model
rocket launches. The rules are designed to promote safe aviation while protecting pilots, passengers, and the general public from unnecessary risk. Aircraft owners are responsible for compliance and familiarity with the applicable 14 CFR part(s) concerning the operation and maintenance of their aircraft. Aircraft owners must register aircraft they purchase and intend to operate in the National Air Space (NAS) with the Aircraft Registration Branch (AFS

- 750).

T he Aircraft Registr ation Branch is responsible for the national programs of aircraft registration including
small Unmanned Aircr aft Systems ( s UAS ) registration. In addition, the Aircraft Registration Branch is responsible for the recording of encumbrances against U.S. civil aircraft, identification of registered aircraft, and law enforcement assistance as it involves the aircraft registration program. T he Aircraft Registr ation
Branch is tasked to r egister aircraft in accord ance with 49 U

. S

. C . §§ 4410 2 through 44103, and to provide a system for recording conveyances that affect an interest in civil aircraft of the United States under 49 U.S.C. §§
44107 and 44108. The FAA also must ensure th at registration and recordation systems effectively serv e the needs of buyers and sellers of aircraft, officials responsible for enforcing laws related to the regulation of
controlled substances under 21 U

. S

. C

. § 802, and other s users of the Aircraft Registry under US.C. § 44111. In
October 201 5, the Department clarified th at b ecause unmanned aircraft are aircraft

, as defined by statute , they

must be registered with the FAA prior to operation. The FAA, however, recognizes the benefits of this new technology and that the existing paper

- based sys tem used for manned aircraft would be too onerous to fully

meet the needs of small unmanned aircraft owners . Therefore, the FAA has developed a stream

- lined, web

based alternative that small unmanned aircraft owners may take advantage of to register their aircraft. Small
unmanned aircraft owners who opt to use this system in lieu of the paper

- based system will create an account via the online website, submit the required information discussed later in this document, and obtain an FAA unique identifier that they will mark on the ir aircraft . The marking will link the aircraft to the owner. Information submitted by aircraft owners under either the legacy, paper

- based system or the new, streamlined
web

- based system is used by the FAA to help link the ai rcraft with its owner, educate owners, and when necessary, aid in pursuing enforcement action.

T he A ircraft Registry is a central repository of all registered aircraft. The Aircraft Registry satisfies treaty obligations under the Convention on Internationa l Civil Aviation (ICAO) , Annex 7 , and is also used to determine that aircraft are registered

. The central repository provide s summary descriptive statistics for the development of analytical studies in support of FAA safety programs and agency management; and provide s aircraft owners and operators information about potential mechanical defects or unsafe conditions of their aircraft in the form of airworthiness directives. The new , web

- based registration process (see 14 CFR part 48 ) is designed only for small unmanned aircraft that weigh between .55 pounds and 55 pounds and are intended for use solely within the United States, as unmanned aircraft registered under this system will not receive a U.S. nationality identif ier currently recognized by ICAO.FAA/Office of Aviation Safety Aircraft Registration

- 3

- Aircraft owners

, including UAS commercial owners , are required to register aircraft over 55 pounds by completing the Aeronautical Center (AC) Form 8050

- 1, Aircraft Registration Application 2

. Individuals must obtain an original Aircraft Registration Application Form, AC Form 8050

- 1, from the Aircraft Registration
Branch AFS

- 750 or their local Flight Standards District Office (FSDO) . The aircraft owner must provide their:

• Full Name;

• Address ;

• Pho ne number ( p roviding a phone number is voluntary) ;

• Citizenship (Applicants must certify that they are a US citizen or a lawfully admitted resident alien) ;

• Aircraft Registration Number (N Number) ;

• Aircraft information (manufacturer make and model and serial number) ; and

• Legal Documents/Records (e.g., evidence of ownership (such as bill of sale), divorce decree, court order)

. The Form 8050

- 1 and evidence of ownership (such as a bill of sale), and payment for the $5 registration fee is
mailed to the FAA

. Upo n receipt of these documents by the Aircraft Registration branch, they are time stamped to establish order of receipt. Any fees received are posted on the corresponding documents. The documents are identified by type (envelope, application, evidence of ownership, correspondence, financial claim, etc.), placed in order for revie w, and scanned to create a work packet containing complete images, front and back, of all items received. This work packet is then sent to be reviewed by the aircraft registration
examination staff in the order of re ceipt and priority for review. Imported and new aircraft are worked
first. This is because they are unable to be operated until they are assigned a registration number and registered. An undue financial burden could be suffered by their owners if they had to wait several days to be registered

. Upon review of the items provided in the work packet, the examiner will determine if all requirements have been met to assign a U.S. Registration Number, register the aircraft and record the financial
claim documents. If the items do not meet the requ irements for registration of recordation, a letter is sent that explains what must be done, supplied or corrected to enable registration or recordation. Unless returned for correction, the original paper documents and images are retained until a reply is r eceived. When the registration examiner determines that all requirements are met, the images are annotated with a dated registration or recordation notation and transferred permanently into the aircraft’s record file. At this point, if
the aircraft is re gistered, or the registration is updated or renewed a certificate of aircraft registration is mailed to the owner, and if requested a registration letter is sent by facsimile to support operation of the aircraft within
the NAS until the formal certificate is delivered. The registration number is assigned to the aircraft.
sUAS Registration under 14 CFR part 48
For owners of small unmanned aircraft who opt to register u sing the web

- based application, (sUAS Registration System) the information that is required to be submitted depends on the intend ed use of the unmanned aircraft, as discussed be low. To begin the registration process under this system, t he applicant must create an account by provid ing an email address and password. The system will advise the applicant that in
order to create an account, the applicant must be at least 13 years old. The applicant is sent a verification email to confirm account registration. The applicant confirms the registration by clicking the link provided in the

2 Instructions for completing the AC Form 8050

- 1, Aircraft Registration is available at www.faa.gov or your local FSDO,FAA/Office of Aviation Safety Aircraft Registration

- 4

- email and logs in using the email address and password to activate their account. First time users must create a user profile . To create a user profile, the applicant provides a name, physical address, and mailing address (if different from physical address). Aft er completing th e user profile, all applicants must indicate acknowledgement of safety guide lines. All a pplicants must pay a $5 registration fee using a credit card. For individuals registering aircraft intended to be used exclusively as model aircraft, they will pay a $ 5 fee and receive a unique identifier that can be used to mark all of their aircraft. For others registering small unmanned aircraft intended for use as other than model aircraft, they will create one account and register each aircraft

un der that account. A $5 fee will be charged and a unique identifier assigned for each aircraft registered under
the account. The credit card information (name, billing address, credit card number, and security code and expiration date) collected is used b y the FAA’s payment processor Stripe.com to process the payment registration. For more information regarding Stripe.com privacy practices go to https://stripe.com/us/privacy

. Once the transaction is processed , the applicant will receive a transaction confirmation that will include the registration number. The applicant can print their registration certificate through a link that is provided.
For small unmanned aircraft owners intending to use the aircraft for non

- model aircraft operations (such as
commercial operations), they will be required to include the following information in their online account:

• Applicant name or name of authorized rep resentative;

• A pplicant physical address (and mailing address if different than physical address )

• Applicant email address or email address of authorized representative;

• Applicant p hone number; and

• Aircraft manufacture r and model name, as well as serial num ber, if available.
For small unmanned aircraft owners intending to use the aircraft sole ly as model aircraft as defined in section
336 of Public Law 112

- 95, they will be required to include the followi ng information in their account:

• Applicant name

• Applica nt physical address (and mailing address if different than physical address)

• Applicant email address ;

• Other information as required by the Administrator.
Applicants will also have the option to include their phone number but this information will not be required for
these owners.
While the paper

- based system requires applicants to certify their citizensh ip, the web

- based registration

process only will adv ise applicants of the citizenship requirements

. F or those that satisfy the statutory requirement for citizenship, the certificate that is issued will constitute a certificate of U.S. registration. Non

U.S. citizens seeking permission from the Secretary to operate in the U.S. will be required to complete the
web

- based registration application. For this population, the certificate will constitute recognition of ownership and depending on the type of operation to be conducted, additional FAA safety authority and DOT economic authorities may be required before operations may commence.

Under both the legacy, paper

- based system and the streamlined web

- based application for registration of small
unmanned aircraft, the aircraft owners must renew their registration every three years. To facilitate that

process under the paper

- based system , the FAA sends each aircraft owner a “Notice: Expiration of AircraftFAA/Office of Aviation Safety Aircraft Registration

- 5

- Registration” letter six months before the registra tion expires. Upon receiving the letter, aircraft owners can submit their renewals by mailing in the paper Aircraft Registration Renewal Application or via the Aircraft Registration Renewal website . To use the website, the aircraft owner enters their aircraft’s N

- Number and the random, unique security code sent to them in the expir ation notice letter. Once logged in, the website will display their aircraft owner’s registration information. If no changes are necessary, the aircraft owner affirms that the information is accurate. If changes are necessary, the individual must comple te paper renewal application and mail it to the Aircraft Registration Branch for processing. The $5 registration renewal fee is processed by the FAA cashier and accounting offices or, if paid by credit card, pay.gov 3 . Aircraft Registry
does not contain a ny payment information. A transaction identification number will be assigned upon confirmation of payment.
For small unmanned aircraft owners registered using the streamlined, web

- based application , they will renew their registration via an on line renewal process and pay the renewal fee. The registration renewal fe e is $5. A Certificate of Aircraft Registration will be available to print within the registration system or sent to the registrant via email following the initial registration and subsequent r enewals. The certificate of registration is generally valid until the owner’s address changes, the aircraft is sold or destroyed, it has expired under the
three

- year renewal period, the owner’s eligibility status changes, or the owner registers the aircraf t in a foreign country. 

### Fair Information Practice Principles (FIPPs) Analysis

The DOT PIA template is based on the fair information pra c tice principles (FIPPs). The FIPPs, rooted in the tenets of the Privacy Act, are mirrored in the laws of many U.S. stat es, as well as many foreign nations and international organizations. The FIPPs provide a framework that will support DOT efforts to appropriately identify and mitigate privacy risk. The FIPPs

- based analysis conducted by DOT is predicated on the privacy con trol families articulated in the Federal Enterprise Architecture Security and Privacy Profile (FEA

- SPP) v3 4 , sponsored by the National Institute of Standards and Technology (NIST), the Office of Management and Budget (OMB), and the Federal Chief Informatio n Officers Council and the Privacy Controls articulated in Appendix J of the NIST Special Publication 800

- 53 Security and Privacy Controls for Federal Information Systems and Organizations 5

. 

### Transparency

Sections 522a(e)(3) and (e)(4) of the Privacy Act a nd Section 208 of the E

- Government Act require public notice of an organization’s information practices and the privacy impact of government programs and activities. Accordingly, DOT is open and transparent about policies, procedures, and technologies that directly affect individuals and/or their personally identifiable information (PII). Additionally, the Department should not maintain any system of records the existence of which is not known to the public.
The DOT deploys multiple techniques to ensure that individuals are informed of the need to register their
aircraft and the purposes for which the Department collects and maintains personally identifiable information (PII) in support of aircraft registrati on and certification activities.
The FAA retrieves records in the Aircraft Registr y by an individual’s name and other personal identifiers and
protects Privacy Act records in accordance with the Department’s published system of records notice (SORN)

3 Applicable SORN located at https://www.fiscal.treasury.gov/fsservices/gov/rvnColl/otcNet/sorn.pdf

4 http://www.cio.gov/documents/FEA

- Security

- Privacy

- Profile

- v3

- 09

- 30

- 2010.pdf

5 http://csrc.nist.gov/publications/drafts/800

- 53

- Appdendix

- J/IPDraft_800

- 53

- privacy

- appendix

- J.pdfFAA/Office of Aviation Safety Aircraft Registration

- 6

- entitl ed DOT/FAA 801 Aircraft Registration Records. An amended SORN was published in the Federal Register ( available at www.transportation.gov/privacy ) to ensure that the public is made aware that records created to comply with the sUAS registration requirement s are also covered by this notice. As required, a Privacy Act statement discussing the Department’s privacy practices regarding the collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information is included on all applicable
forms used to register aircraft with the FAA. 6 A Privacy Act Statement is also available on the s UAS Registration S ite

. The publication of this PIA demonstrates DOT’s commitment to provide appropriate transparency into the Aircraft Registry and the s UAS Registration S ite. You may submit comments, identified by docket number
DOT

- OST

- 2015

- 0258

, by any of the following methods:

• Federal e

- Rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting

comments.

• Mail: Doc ket Management Facility, U.S. Department of Transportation, 1200 New Jersey Ave. SE., West Building Ground Floor, Room W12

– 140, Washington, DC 20590

– 0001.

• Hand Delivery or Courier: West Building Ground Floor, Room W12

– 140, 1200 New Jersey Ave. SE., between 9 a.m. and 5 p.m. ET, Monday through Friday, except Federal Holidays.


### Individual Participation and Redress

DOT should provide a reasonable opportunity and capability for individuals to make informed decisions about the collection, use, and disclosure of their PII. As required by the Privacy Act, individuals should be active participants in the decision making process regarding the collection and use of their PII and be provided reasonable access to their PII and the opportunity to have their PII corrected, amended, or deleted, as appropriate.
Under the provisions of the Privacy Act, individuals may request sear ches to determine if any records have
been ad ded that may pertain to them. Individuals wishing to know if their records appear in this system may inquire in person or in writing to:

Federal Aviation Administration Privacy Office 800 Independence Ave. SW W ashington, DC 20591
Included in the request must be the following:

• Name

• Mailing address

• Phone number and/or email address

• A description of the records sought, and if possible, the location of the records
Contesting record procedures:
Individuals wanting to contest information about themselves that is contained in this system should make their requests in writing, detailing the reasons for why the records should be corrected to the following address:

6 The complete listing of aircraft registration forms may be found on the FAA’s public website

- http://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_registry/aircraft_regn_forms/

.FAA/Office of Aviation Safety Aircraft Registration

- 7

- Federal Aviation Administration Privacy Office 800 Ind ependence Ave. SW Washington

, DC 20591

All aircraft must register with the FAA to operate in the NAS. For aircraft registered under 14 CFR part 47,
i nformation in the Aircraft Registry is collected directly from the aircraft owner through the use of paper

- based
forms and other hard copy supplemental documentation submitted by the aircraft owner. Once received by the FAA, these documents are converted into electronic documents and maintained in the Aircraft Registration System. Individuals may verify that the FAA has received and uploaded their forms and documentation in the Aircraft Registry by conducting a search for their records in the Aircraft Registry using the FAA’s Aircraft Inquiry tool. 7 For small unmanned aircraft registered under 14 C.F.R. part 48, information is also collected directly from the aircraft owner through a web

- based application . Aircraft owners may verify that the i r information is correct by accessing their account via the registration website. Individuals may also confirm

t he ir name and address information is correct by using the public search function available on the FAA’s
website , which allows searches by unique identifier only.

Aircraft owners may update their information during the registration renewal process or at a ny other time the
aircraft owner chooses.


### Purpose Specification DOT should (i) identify the legal bases that authorize a particular PII collection, activity, or technology that impacts privacy; and (ii) specify the purpose(s) for which its collects, uses, maintains, or disseminates PII.

Under 49 U.S.C. §§ 44102 and 44103, t he FAA is required to register aircraft and maintain an aircraft registry. The Aircraft Registry is use d to:

• Provide a register of United States civil aircraft to aid in the national defense and to support a safe and economically strong civil aviation system, and to meet treaty requirements under the Convention on
Inte rnational Civil Aviation, Annex ;

• Determines that aircraft are registered in accordance with the provisions of 49 U.S.C. 44103 ;

• Supports FAA safety programs and agency management;

• Aids law enforcement and aircraft accident investigations;

• Serves as a repository of legal documents to determine legal ownership of aircraft ;

• Provide aircraft owners and operator information about potential mechanical defects or unsafe
conditions of their aircraft in the form of airworthiness directives ;

• Educate owners on safe operating requirements; and

• Receive and record payment of aircraft registration fee.

FAA collects the name of the aircraft owner and address , so that aircraft ca n be associated with an owner . This assists the FAA in its compliance efforts, by allowing the FAA to identify the owner and when there is an incident, and educate them on safe operating requirements and

, whe n appropriate, take enforcement action against individuals who violate the rules or operate unsafely. Under the legacy, paper

- based system in 14

7 http://regist ry.faa.gov/aircraftinquiry/Aircraft_Inquiry.aspxFAA/Office of Aviation Safety Aircraft Registration

- 8

- CFR part 47, t he FAA also collects legal documents estab lishing title and lienholders to establish aircraft ownership for registered aircraft

. 

### Data Minimization & Retention
DOT should collect, use, and retain only PII that is relevant and necessary for the specified purpose for which it was originally collected. DOT should retain PII for only as long as necessary to fulfill the specified purpose(s) and in accordance with a National Archives and Records Administration (NARA)

- approved record disposition schedule.
Under both the paper

- based system in 14 CFR part 47 and the streamlined, web

- b ased system for small unmanned aircraft in part 48, the FAA collects the minimum amount of information necessary to establish and
maintain the record for all United States civil aircraft. The digital images of aircraft registration are the official legal record. For the part 47 process, t he paper forms are maintained until it has been confirmed that the digital image meets quality standards and in accordance with retention policies and are destroy upon completion of quality review

. The National Archives and Records Administration (NARA) working in partnership with the FAA has designated the Civil Aviation Registry , to include Aviation Registry aircraft registration records and image file
i ndexes, as the Permanent Record for United States civil aircraft registration information . These records are therefore kept as permanent records in accordance with the NARA approved records disposition schedule N1

- 237

- 0 4

- 0 3

. The permanent retention of the records allows for research and a complete histor y of specific
aircraft and documents the development and progression of registration of the American Aircraft Re gistration System

. The FAA is working with NARA to establish an appropriate retention period for records collected under part 48. C onsistent with the Federal Records Act will manage these records as permanent records until NARA ha s determined their historical value and issued an approved records disposition schedule.



### Use Limitation

DOT shall limit the scope of its PII use to ensure that the Department does not use PII in any manner that is not specified in notices, incompatible with the specified purposes for which the information was collected, or for any purpose not otherwise permi tted by law.
The DOT/FAA 801 Aircraft Registration Records SORN includes one system specific routin e use permitting the sharing of Privacy Act records :

• To the public (including government entities, title companies, financial institutions, international

or ganizations, FAA designee airworthiness inspectors, and others) information through the Aircraft Registry, including aircraft owner’s name, address, United States Registration Number, aircraft type, and legal documents related to title or financing. Email addresses and credit card information will not be disclosed pursuant to this Routine Use. The public may only retrieve the name and address of owners of sUAS used for recreational purposes by aircraft registration number

• To law enforcement when necessary and relevant to a FAA enforcement activity.FAA/Office of Aviation Safety Aircraft Registration

- 9

- The Department has also published 14 additional routine uses applicable to all DOT Privacy Act systems of records, including this system. These routine uses are published in the Federal Register at 75 FR 82132, December 29, 2010, and 77 FR 42796, July 20, 2012, under ‘‘Prefatory Statement of General Routine Uses’’ (available at http://www.transportation.gov/ privacy/privacyactnotices ).


### Data Quality and Integrity In accordance with Section 552a(e)(2) of the Priva cy Act of 1974, DOT should ensure that any PII collected and maintained by the organization is accurate, relevant, timely, and complete for the purpose for which it is to be used, as specified in the Department’s public notice(s).

FAA collects, uses, and retains data that is relevant and necessary for the purpose for which it was collected.
The Aircraft Registry performs extensive edit checks on all data that is entered into the system. It maintains
ima ges of the documents it receives on aircraft owners as the legal record; database entries are checked against these images and the images can be referred to at any time as an authoritative source. The aircraft information is inspected by Quality Control and Quality Assurance pro cesses to ensure accuracy.
Aircraft owners must renew their aircraft registration every three years; at that time, they must certify that the information associated with their registration is still accurate. If it is not accurate, they are required to make the appropriate updates. For registrations under the paper

- based system in 14 CFR part 47, r egistered owners are required to notify the FAA in writing of any change of address within 30 day after any change in owner’s mailing address. Register ed owner can also send a letter to the FAA for name change.
Under the paper

- based system, i n compliance with statutory requirements, documents are processed in date

received order. Applicants may check to see if their documents have been received by using the FAA website “Aircraft Registration” link, and selecting the “Download the Aircraft Registration Database” link to search the document index. The FAA updates the “Aircraft Registration Inquiry” site at midnight on each federal workday. Applicant can f ind new information immediately following this update.
Occasionally, items of sensitive PII ( S PII) not necessary to accomplish aircraft registration are submitted for
inclusion in the aircraft record

. Like any information submitted as part of the aviatio n registration activity,
SPII is considered to have been knowingly submitted to a public record. Such submission to a known public record is considered tantamount to permission to release the data . Any individual whose SPII appears in the aircraft record may request the redaction of that information. The FAA will take immediate action to redact SPII from publically accessible records that is not necessary to maintain the integrity of the aircraft record.
With respect to thos e registering small unmanned aircraft under 14 CFR part 48, these owners are responsible for the accuracy of their information. They must certify the information is accurate and required to make the appropriate updates. sUAS o wner can also access their o nline account and update their information when

necessary

. Lastly

, the owner must renew their registration every 3 years.


### Security DOT shall implement administrative, technical, and physical measures to protect PII collected or maintained by the Department against loss, unauthorized access, or disclosure, as required by the Privacy Act, and to ensure that organizational planning and responses to privacy incidents comply with OMB policies and guidance.

FA A protects PII with reasonable security safeguards against loss or unauthorized access, destruction, usage, modification, or disclosure. These safeguards incorporate standards and practices required for federalFAA/Office of Aviation Safety Aircraft Registration

- 10

- information systems under the Federal Inform ation Security Management Act (FISMA ) and are detailed in Federal Information Processing Standards (FI P S) Publication 200, Minimum Security Requirements for
Federal Information and Information Systems, dated March 2006, and National Institute of Standards and Technology (NIST) Special Publication (SP) 800

- 53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, dated A pril 2013.

The A ircraft Registry i s considered a high

- risk system and was issued a three

- year authority to operate (ATO)

on June 24

, 201 4

. Access to the system is limited to those with appropriate security credentials, an authorized purpose, and need

- to

- know. The FAA deploys role

- based access controls in addition to o ther protection measures reviewed and certified by the FAA’s cybersecurity professionals to maintain the confidentiality, integrity, and availability requirements of the system.
The sUAS Registration System is a moderate

- risk system and will be issued an a uthority to operate based on the outcome of security testing and evaluation no later than December 16, 2015.


### Accountability and Auditing DOT shall implement effective governance controls, monitoring controls, risk management, and assessment controls to demonstrate that the Department is complying with all applicable privacy protection requirements and minimizing the privacy risk to individuals.

FAA’s Office of the Chief Information Officer, Office of information Systems Security, Privacy Division is

resp onsible for governance and administration of FAA Order 1280.1B, Protecting Personally Identifiable Information (PII). FAA Order 1280.1 implements the various privacy laws based on the Privacy Act of 1974 (the Privacy Act), the E

- Government Act of 2002 (P ublic Law 107

- 347, the Federal Information Security Management Act (FISMA), Department of Transportation (DOT) privacy regulations, Office of Management and Budget (OMB) mandates, and other applicable DOT and FAA information and information technology

mana gement procedures and guidance.
In addition to these practices, additional policies and procedures will be consistently applied, especially as they
relate to the access, protection, retention, and destruction of personally identifiable information . Federal and contract employees are given clear guidance in their duties as they relate to collecting, using, processing, and security privacy data. Guidance was to be provided in the form of mandatory annual security and privacy awareness training, as well as FAA Privacy Rules of Behavior. The DOT and FAA Privacy Office s will conduct periodic privacy compliance reviews of Aircraft Registry and UAS Registration Site with the requirements of OMB Circular A

- 130. 

### Responsible Official
Jana Hammer Civil A vi a tion Registry, Program Manager Office of Aviation Safety



### Approval
Claire W. Barrett Chief Privacy & Information Asset Officer Office of the Chief Information OfficerFAA/Office of Aviation Safety Aircraft Registration

- 11

-