[Title 28 CFR 20]
[Code of Federal Regulations (annual edition) - July 1, 2002 Edition]
[Title 28 - JUDICIAL ADMINISTRATION]
[Chapter I - DEPARTMENT OF JUSTICE]
[Part 20 - CRIMINAL JUSTICE INFORMATION SYSTEMS]
[From the U.S. Government Printing Office]


28JUDICIAL ADMINISTRATION12002-07-012002-07-01falseCRIMINAL JUSTICE INFORMATION SYSTEMS20PART 20JUDICIAL ADMINISTRATIONDEPARTMENT OF JUSTICE
PART 20--CRIMINAL JUSTICE INFORMATION SYSTEMS--Table of Contents




                      Subpart A--General Provisions

Sec.
20.1  Purpose.
20.2  Authority.
20.3  Definitions.

 Subpart B--State and Local Criminal History Record Information Systems

20.20  Applicability.
20.21  Preparation and submission of a Criminal History Record 
          Information Plan.
20.22  Certification of compliance.
20.23  Documentation: Approval by OJARS.
20.24  State laws on privacy and security.
20.25  Penalties.

   Subpart C--Federal Systems and Exchange of Criminal History Record 
                               Information

20.30  Applicability.
20.31  Responsibilities.
20.32  Includable offenses.
20.33  Dissemination of criminal history record information.
20.34  Individual's right to access criminal history record information.
20.35  Criminal Justice Information Services Advisory Policy Board.
20.36  Participation in the Interstate Identification Index System.
20.37  Responsibility for accuracy, completeness, currency, and 
          integrity.
20.38  Sanction for noncompliance.

Appendix to Part 20--Commentary on Selected Sections of the Regulations 
          on Criminal History Record Information Systems

    Authority: 28 U.S.C. 534; Pub. L. 92-544, 86 Stat. 1115; 42 U.S.C. 
3711, et seq.; Pub. L. 99-169, 99 Stat. 1002, 1008-1011, as amended by 
Pub. L. 99-569, 100 Stat. 3190, 3196; Pub. L. 101-410, 104 Stat. 890, as 
amended by Pub. L. 104-134, 110 Stat. 1321.

    Source: Order No. 601-75, 40 FR 22114, May 20, 1975, unless 
otherwise noted.



                      Subpart A--General Provisions

    Source: 41 FR 11714, Mar. 19, 1976, unless otherwise noted.

[[Page 394]]



Sec. 20.1  Purpose.

    It is the purpose of these regulations to assure that criminal 
history record information wherever it appears is collected, stored, and 
disseminated in a manner to ensure the accuracy, completeness, currency, 
integrity, and security of such information and to protect individual 
privacy.

[Order No. 2258-99, 64 FR 52226, Sept. 28, 1999]



Sec. 20.2  Authority.

    These regulations are issued pursuant to sections 501 and 524(b) of 
the Omnibus Crime Control and Safe Streets Act of 1968, as amended by 
the Crime Control Act of 1973, Public Law 93-83, 87 Stat. 197, 42 U.S.C. 
3701, et seq. (Act), 28 U.S.C. 534, and Public Law 92-544, 86 Stat. 
1115.



Sec. 20.3  Definitions.

    As used in these regulations:
    (a) Act means the Omnibus Crime Control and Safe Streets Act, 42 
U.S.C. 3701, et seq., as amended.
    (b) Administration of criminal justice means performance of any of 
the following activities: Detection, apprehension, detention, pretrial 
release, post-trial release, prosecution, adjudication, correctional 
supervision, or rehabilitation of accused persons or criminal offenders. 
The administration of criminal justice shall include criminal 
identification activities and the collection, storage, and dissemination 
of criminal history record information.
    (c) Control Terminal Agency means a duly authorized state, foreign, 
or international criminal justice agency with direct access to the 
National Crime Information Center telecommunications network providing 
statewide (or equivalent) service to its criminal justice users with 
respect to the various systems managed by the FBI CJIS Division.
    (d) Criminal history record information means information collected 
by criminal justice agencies on individuals consisting of identifiable 
descriptions and notations of arrests, detentions, indictments, 
informations, or other formal criminal charges, and any disposition 
arising therefrom, including acquittal, sentencing, correctional 
supervision, and release. The term does not include identification 
information such as fingerprint records if such information does not 
indicate the individual's involvement with the criminal justice system.
    (e) Criminal history record information system means a system 
including the equipment, facilities, procedures, agreements, and 
organizations thereof, for the collection, processing, preservation, or 
dissemination of criminal history record information.
    (f) Criminal history record repository means the state agency 
designated by the governor or other appropriate executive official or 
the legislature to perform centralized recordkeeping functions for 
criminal history records and services in the state.
    (g) Criminal justice agency means:
    (1) Courts; and
    (2) A governmental agency or any subunit thereof that performs the 
administration of criminal justice pursuant to a statute or executive 
order, and that allocates a substantial part of its annual budget to the 
administration of criminal justice. State and federal Inspector General 
Offices are included.
    (h) Direct access means having the authority to access systems 
managed by the FBI CJIS Division, whether by manual or automated 
methods, not requiring the assistance of or intervention by any other 
party or agency.
    (i) Disposition means information disclosing that criminal 
proceedings have been concluded and the nature of the termination, 
including information disclosing that the police have elected not to 
refer a matter to a prosecutor or that a prosecutor has elected not to 
commence criminal proceedings; or disclosing that proceedings have been 
indefinitely postponed and the reason for such postponement. 
Dispositions shall include, but shall not be limited to, acquittal, 
acquittal by reason of insanity, acquittal by reason of mental 
incompetence, case continued without finding, charge dismissed, charge 
dismissed due to insanity, charge dismissed due to mental incompetency, 
charge still pending due to insanity, charge still pending due to mental 
incompetence, guilty plea, nolle prosequi, no paper, nolo contendere

[[Page 395]]

plea, convicted, youthful offender determination, deceased, deferred 
disposition, dismissed-civil action, found insane, found mentally 
incompetent, pardoned, probation before conviction, sentence commuted, 
adjudication withheld, mistrial-defendant discharged, executive 
clemency, placed on probation, paroled, or released from correctional 
supervision.
    (j) Executive order means an order of the President of the United 
States or the Chief Executive of a state that has the force of law and 
that is published in a manner permitting regular public access.
    (k) Federal Service Coordinator means a non-Control Terminal Agency 
that has a direct telecommunications line to the National Crime 
Information Center network.
    (l) Fingerprint Identification Records System or ``FIRS'' means the 
following FBI records: Criminal fingerprints and/or related criminal 
justice information submitted by authorized agencies having criminal 
justice responsibilities; civil fingerprints submitted by federal 
agencies and civil fingerprints submitted by persons desiring to have 
their fingerprints placed on record for personal identification 
purposes; identification records, sometimes referred to as ``rap 
sheets,'' which are compilations of criminal history record information 
pertaining to individuals who have criminal fingerprints maintained in 
the FIRS; and a name index pertaining to all individuals whose 
fingerprints are maintained in the FIRS. See the FIRS Privacy Act System 
Notice periodically published in the Federal Register for further 
details.
    (m) Interstate Identification Index System or ``III System'' means 
the cooperative federal-state system for the exchange of criminal 
history records, and includes the National Identification Index, the 
National Fingerprint File, and, to the extent of their participation in 
such system, the criminal history record repositories of the states and 
the FBI.
    (n) National Crime Information Center or ``NCIC'' means the 
computerized information system, which includes telecommunications lines 
and any message switching facilities that are authorized by law, 
regulation, or policy approved by the Attorney General of the United 
States to link local, state, tribal, federal, foreign, and international 
criminal justice agencies for the purpose of exchanging NCIC related 
information. The NCIC includes, but is not limited to, information in 
the III System. See the NCIC Privacy Act System Notice periodically 
published in the Federal Register for further details.
    (o) National Fingerprint File or ``NFF'' means a database of 
fingerprints, or other uniquely personal identifying information, 
relating to an arrested or charged individual maintained by the FBI to 
provide positive identification of record subjects indexed in the III 
System.
    (p) National Identification Index or ``NII'' means an index 
maintained by the FBI consisting of names, identifying numbers, and 
other descriptive information relating to record subjects about whom 
there are criminal history records in the III System.
    (q) Nonconviction data means arrest information without disposition 
if an interval of one year has elapsed from the date of arrest and no 
active prosecution of the charge is pending; information disclosing that 
the police have elected not to refer a matter to a prosecutor, that a 
prosecutor has elected not to commence criminal proceedings, or that 
proceedings have been indefinitely postponed; and information that there 
has been an acquittal or a dismissal.
    (r) State means any state of the United States, the District of 
Columbia, the Commonwealth of Puerto Rico, and any territory or 
possession of the United States.
    (s) Statute means an Act of Congress or of a state legislature or a 
provision of the Constitution of the United States or of a state.

[Order No. 2258-99, 64 FR 52226, Sept. 28, 1999]



 Subpart B--State and Local Criminal History Record Information Systems

    Source: 41 FR 11715, Mar. 19, 1976, unless otherwise noted.

[[Page 396]]



Sec. 20.20  Applicability.

    (a) The regulations in this subpart apply to all State and local 
agencies and individuals collecting, storing, or disseminating criminal 
history record information processed by manual or automated operations 
where such collection, storage, or dissemination has been funded in 
whole or in part with funds made available by the Law Enforcement 
Assistance Administration subsequent to July 1, 1973, pursuant to title 
I of the Act. Use of information obtained from the FBI Identification 
Division or the FBI/NCIC system shall also be subject to limitations 
contained in subpart C.
    (b) The regulations in this subpart shall not apply to criminal 
history record information contained in:
    (1) Posters, announcements, or lists for identifying or apprehending 
fugitives or wanted persons;
    (2) Original records of entry such as police blotters maintained by 
criminal justice agencies, compiled chronologically and required by law 
or long standing custom to be made public, if such records are organized 
on a chronological basis;
    (3) Court records of public judicial proceedings;
    (4) Published court or administrative opinions or public judicial, 
administrative or legislative proceedings;
    (5) Records of traffic offenses maintained by State departments of 
transportation, motor vehicles or the equivalent thereof for the purpose 
of regulating the issuance, suspension, revocation, or renewal of 
driver's, pilot's or other operators' licenses;
    (6) Announcements of executive clemency.
    (c) Nothing in these regulations prevents a criminal justice agency 
from disclosing to the public criminal history record information 
related to the offense for which an individual is currently within the 
criminal justice system. Nor is a criminal justice agency prohibited 
from confirming prior criminal history record information to members of 
the news media or any other person, upon specific inquiry as to whether 
a named individual was arrested, detained, indicted, or whether an 
information or other formal charge was filed, on a specified date, if 
the arrest record information or criminal record information disclosed 
is based on data excluded by paragraph (b) of this section. The 
regulations do not prohibit the dissemination of criminal history record 
information for purposes of international travel, such as issuing visas 
and granting of citizenship.



Sec. 20.21  Preparation and submission of a Criminal History Record Information Plan.

    A plan shall be submitted to OJARS by each State on March 16, 1976, 
to set forth all operational procedures, except those portions relating 
to dissemination and security. A supplemental plan covering these 
portions shall be submitted no later than 90 days after promulgation of 
these amended regulations. The plan shall set forth operational 
procedures to--
    (a) Completeness and accuracy. Insure that criminal history record 
information is complete and accurate.
    (1) Complete records should be maintained at a central State 
repository. To be complete, a record maintained at a central State 
repository which contains information that an individual has been 
arrested, and which is available for dissemination, must contain 
information of any dispositions occurring within the State within 90 
days after the disposition has occurred. The above shall apply to all 
arrests occurring subsequent to the effective date of these regulations. 
Procedures shall be established for criminal justice agencies to query 
the central repository prior to dissemination of any criminal history 
record information unless it can be assured that the most up-to-date 
disposition data is being used. Inquiries of a central State repository 
shall be made prior to any dissemination except in those cases where 
time is of the essence and the repository is technically incapable of 
responding within the necessary time period.
    (2) To be accurate means that no record containing criminal history 
record information shall contain erroneous information. To accomplish 
this end, criminal justice agencies shall institute a process of data 
collection, entry, storage, and systematic audit that will minimize the 
possibility of

[[Page 397]]

recording and storing inaccurate information and upon finding inaccurate 
information of a material nature, shall notify all criminal justice 
agencies known to have received such information.
    (b) Limitations on dissemination. Insure that dissemination of 
nonconviction data has been limited, whether directly or through any 
intermediary only to:
    (1) Criminal justice agencies, for purposes of the administration of 
criminal justice and criminal justice agency employment;
    (2) Individuals and agencies for any purpose authorized by statute, 
ordinance, executive order, or court rule, decision, or order, as 
construed by appropriate State or local officials or agencies;
    (3) Individuals and agencies pursuant to a specific agreement with a 
criminal justice agency to provide services required for the 
administration of criminal justice pursuant to that agreement. The 
agreement shall specifically authorize access to data, limit the use of 
data to purposes for which given, insure the security and 
confidentiality of the data consistent with these regulations, and 
provide sanctions for violation thereof;
    (4) Individuals and agencies for the express purpose of research, 
evaluative, or statistical activities pursuant to an agreement with a 
criminal justice agency. The agreement shall specifically authorize 
access to data, limit the use of data to research, evaluative, or 
statistical purposes, insure the confidentiality and security of the 
data consistent with these regulations and with section 524(a) of the 
Act and any regulations implementing section 524(a), and provide 
sanctions for the violation thereof. These dissemination limitations do 
not apply to conviction data.
    (c) General policies on use and dissemination. (1) Use of criminal 
history record information disseminated to noncriminal justice agencies 
shall be limited to the purpose for which it was given.
    (2) No agency or individual shall confirm the existence or 
nonexistence of criminal history record information to any person or 
agency that would not be eligible to receive the information itself.
    (3) Subsection (b) does not mandate dissemination of criminal 
history record information to any agency or individual. States and local 
governments will determine the purposes for which dissemination of 
criminal history record information is authorized by State law, 
executive order, local ordinance, court rule, decision or order.
    (d) Juvenile records. Insure that dissemination of records 
concerning proceedings relating to the adjudication of a juvenile as 
delinquent or in need or supervision (or the equivalent) to noncriminal 
justice agencies is prohibited, unless a statute, court order, rule or 
court decision specifically authorizes dissemination of juvenile 
records, except to the same extent as criminal history records may be 
disseminated as provided in paragraph (b) (3) and (4) of this section.
    (e) Audit. Insure that annual audits of a representative sample of 
State and local criminal justice agencies chosen on a random basis shall 
be conducted by the State to verify adherence to these regulations and 
that appropriate records shall be retained to facilitate such audits. 
Such records shall include, but are not limited to, the names of all 
persons or agencies to whom information is disseminated and the date 
upon which such information is disseminated. The reporting of a criminal 
justice transaction to a State, local or Federal repository is not a 
dissemination of information.
    (f) Security. Wherever criminal history record information is 
collected, stored, or disseminated, each State shall insure that the 
following requirements are satisfied by security standards established 
by State legislation, or in the absence of such legislation, by 
regulations approved or issued by the Governor of the State.
    (1) Where computerized data processing is employed, effective and 
technologically advanced software and hardware designs are instituted to 
prevent unauthorized access to such information.
    (2) Access to criminal history record information system facilities, 
systems operating environments, data file contents whether while in use 
or when

[[Page 398]]

stored in a media library, and system documentation is restricted to 
authorized organizations and personnel.
    (3)(i) Computer operations, whether dedicated or shared, which 
support criminal justice information systems, operate in accordance with 
procedures developed or approved by the participating criminal justice 
agencies that assure that:
    (a) Criminal history record information is stored by the computer in 
such manner that it cannot be modified, destroyed, accessed, changed, 
purged, or overlaid in any fashion by non-criminal justice terminals.
    (b) Operation programs are used that will prohibit inquiry, record 
updates, or destruction of records, from any terminal other than 
criminal justice system terminals which are so designated.
    (c) The destruction of records is limited to designated terminals 
under the direct control of the criminal justice agency responsible for 
creating or storing the criminal history record information.
    (d) Operational programs are used to detect and store for the output 
of designated criminal justice agency employees all unauthorized 
attempts to penetrate any criminal history record information system, 
program or file.
    (e) The programs specified in paragraphs (f)(3)(i) (b) and (d) of 
this section are known only to criminal justice agency employees 
responsible for criminal history record information system control or 
individuals and agencies pursuant to a specific agreement with the 
criminal justice agency to provide such programs and the program(s) are 
kept continuously under maximum security conditions.
    (f) Procedures are instituted to assure that an individual or agency 
authorized direct access is responsible for (1) the physical security of 
criminal history record information under its control or in its custody 
and (2) the protection of such information from unauthorized access, 
disclosure or dissemination.
    (g) Procedures are instituted to protect any central repository of 
criminal history record information from unauthorized access, theft, 
sabotage, fire, flood, wind, or other natural or manmade disasters.
    (ii) A criminal justice agency shall have the right to audit, 
monitor and inspect procedures established above.
    (4) The criminal justice agency will:
    (i) Screen and have the right to reject for employment, based on 
good cause, all personnel to be authorized to have direct access to 
criminal history record information.
    (ii) Have the right to initiate or cause to be initiated 
administrative action leading to the transfer or removal of personnel 
authorized to have direct access to such information where such 
personnel violate the provisions of these regulations or other security 
requirements established for the collection, storage, or dissemination 
of criminal history record information.
    (iii) Institute procedures, where computer processing is not 
utilized, to assure that an individual or agency authorized direct 
access is responsible for
    (a) The physical security of criminal history record information 
under its control or in its custody and
    (b) The protection of such information from unauthorized access, 
disclosure, or dissemination.
    (iv) Institute procedures, where computer processing is not 
utilized, to protect any central repository of criminal history record 
information from unauthorized access, theft, sabotage, fire, flood, 
wind, or other natural or manmade disasters.
    (v) Provide that direct access to criminal history record 
information shall be available only to authorized officers or employees 
of a criminal justice agency and, as necessary, other authorized 
personnel essential to the proper operation of the criminal history 
record information system.
    (5) Each employee working with or having access to criminal history 
record information shall be made familiar with the substance and intent 
of these regulations.
    (g) Access and review. Insure the individual's right to access and 
review of criminal history information for purposes of accuracy and 
completeness by instituting procedures so that--
    (1) Any individual shall, upon satisfactory verification of his 
identity, be

[[Page 399]]

entitled to review without undue burden to either the criminal justice 
agency or the individual, any criminal history record information 
maintained about the individual and obtain a copy thereof when necessary 
for the purpose of challenge or correction;
    (2) Administrative review and necessary correction of any claim by 
the individual to whom the information relates that the information is 
inaccurate or incomplete is provided;
    (3) The State shall establish and implement procedures for 
administrative appeal where a criminal justice agency refuses to correct 
challenged information to the satisfaction of the individual to whom the 
information relates;
    (4) Upon request, an individual whose record has been corrected 
shall be given the names of all non-criminal justice agencies to whom 
the data has been given;
    (5) The correcting agency shall notify all criminal justice 
recipients of corrected information; and
    (6) The individual's right to access and review of criminal history 
record information shall not extend to data contained in intelligence, 
investigatory, or other related files and shall not be construed to 
include any other information than that defined by Sec. 20.3(b).

[41 FR 11715, Mar. 19, 1976, as amended at 42 FR 61595, Dec. 6, 1977]



Sec. 20.22  Certification of compliance.

    (a) Each State to which these regulations are applicable shall with 
the submission of its plan provide a certification that to the maximum 
extent feasible action has been taken to comply with the procedures set 
forth in the plan. Maximum extent feasible, in this subsection, means 
actions which can be taken to comply with the procedures set forth in 
the plan that do not require additional legislative authority or involve 
unreasonable cost or do not exceed existing technical ability.
    (b) The certification shall include--
    (1) An outline of the action which has been instituted. At a 
minimum, the requirements of access and review under Sec. 20.21(g) must 
be completely operational;
    (2) A description of any legislation or executive order, or attempts 
to obtain such authority that has been instituted to comply with these 
regulations;
    (3) A description of the steps taken to overcome any fiscal, 
technical, and administrative barriers to the development of complete 
and accurate criminal history record information;
    (4) A description of existing system capability and steps being 
taken to upgrade such capability to meet the requirements of these 
regulations; and
    (5) A listing setting forth categories of non-criminal justice 
dissemination. See Sec. 20.21(b).



Sec. 20.23  Documentation: Approval by OJARS.

    Within 90 days of the receipt of the plan, OJARS shall approve or 
disapprove the adequacy of the provisions of the plan and certification. 
Evaluation of the plan by OJARS will be based upon whether the 
procedures set forth will accomplish the required objectives. The 
evaluation of the certification(s) will be based upon whether a good 
faith effort has been shown to initiate and/or further compliance with 
the plan and regulations. All procedures in the approved plan must be 
fully operational and implemented by March 1, 1978. A final 
certification shall be submitted on March 1, 1978.

Where a State finds it is unable to provide final certification that all 
required procedures as set forth in Sec. 20.21 will be operational by 
March 1, 1978, a further extension of the deadline will be granted by 
OJARS upon a showing that the State has made a good faith effort to 
implement these regulations to the maximum extent feasible. 
Documentation justifying the request for the extension including a 
proposed timetable for full compliance must be submitted to OJARS by 
March 1, 1978. Where a State submits a request for an extension, the 
implementation date will be extended an additional 90 days while OJARS 
reviews the documentation for approval or disapproval. To be approved, 
such revised schedule must be consistent with the timetable and 
procedures set out below:
    (a) July 31, 1978--Submission of certificate of compliance with:

[[Page 400]]

    (1) Individual access, challenge, and review requirements;
    (2) Administrative security;
    (3) Physical security to the maximum extent feasible.
    (b) Thirty days after the end of a State's next legislative session-
-Submission to OJARS of a description of State policy on dissemination 
of criminal history record information.
    (c) Six months after the end of a State's legislative session--
Submission to OJARS of a brief and concise description of standards and 
operating procedures to be followed by all criminal justice agencies 
covered by OJARS regulations in complying with the State policy on 
dissemination.
    (d) Eighteen months after the end of a State's legislative session--
Submission to OJARS of a certificate attesting to the conduct of an 
audit of the State central repository and of a random number of other 
criminal justice agencies in compliance with OJARS regulations.

[41 FR 11715, Mar. 19, 1976, as amended at 42 FR 61596, Dec. 6, 1977]



Sec. 20.24  State laws on privacy and security.

    Where a State originating criminal history record information 
provides for sealing or purging thereof, nothing in these regulations 
shall be construed to prevent any other State receiving such 
information, upon notification, from complying with the originating 
State's sealing or purging requirements.



Sec. 20.25  Penalties.

    Any agency or individual violating subpart B of these regulations 
shall be subject to a civil penalty not to exceed $10,000 for a 
violation occurring before September 29, 1999, and not to exceed $11,000 
for a violation occurring on after September 29, 1999. In addition, 
OJARS may initiate fund cut-off procedures against recipients of OJARS 
assistance.

[41 FR 11715, Mar. 19, 1976, as amended by Order No. 2249-99, 64 FR 
47102, Aug. 30, 1999]



   Subpart C--Federal Systems and Exchange of Criminal History Record 
                               Information

    Source: Order No. 2258-99, 64 FR 52227, Sept. 28, 1999, unless 
otherwise noted.



Sec. 20.30  Applicability.

    The provisions of this subpart of the regulations apply to the III 
System and the FIRS, and to duly authorized local, state, tribal, 
federal, foreign, and international criminal justice agencies to the 
extent that they utilize the services of the III System or the FIRS. 
This subpart is applicable to both manual and automated criminal history 
records.



Sec. 20.31  Responsibilities.

    (a) The Federal Bureau of Investigation (FBI) shall manage the NCIC.
    (b) The FBI shall manage the FIRS to support identification and 
criminal history record information functions for local, state, tribal, 
and federal criminal justice agencies, and for noncriminal justice 
agencies and other entities where authorized by federal statute, state 
statute pursuant to Public Law 92-544, 86 Stat. 1115, Presidential 
executive order, or regulation or order of the Attorney General of the 
United States.
    (c) The FBI CJIS Division may manage or utilize additional 
telecommunication facilities for the exchange of fingerprints, criminal 
history record related information, and other criminal justice 
information.
    (d) The FBI CJIS Division shall maintain the master fingerprint 
files on all offenders included in the III System and the FIRS for the 
purposes of determining first offender status; to identify those 
offenders who are unknown in states where they become criminally active 
but are known in other states through prior criminal history records; 
and to provide identification assistance in disasters and for other 
humanitarian purposes.



Sec. 20.32  Includable offenses.

    (a) Criminal history record information maintained in the III System 
and

[[Page 401]]

the FIRS shall include serious and/or significant adult and juvenile 
offenses.
    (b) The FIRS excludes arrests and court actions concerning 
nonserious offenses, e.g., drunkenness, vagrancy, disturbing the peace, 
curfew violation, loitering, false fire alarm, non-specific charges of 
suspicion or investigation, and traffic violations (except data will be 
included on arrests for vehicular manslaughter, driving under the 
influence of drugs or liquor, and hit and run), when unaccompanied by a 
Sec. 20.32(a) offense. These exclusions may not be applicable to 
criminal history records maintained in state criminal history record 
repositories, including those states participating in the NFF.
    (c) The exclusions enumerated above shall not apply to federal 
manual criminal history record information collected, maintained, and 
compiled by the FBI prior to the effective date of this subpart.



Sec. 20.33  Dissemination of criminal history record information.

    (a) Criminal history record information contained in the III System 
and the FIRS may be made available:
    (1) To criminal justice agencies for criminal justice purposes, 
which purposes include the screening of employees or applicants for 
employment hired by criminal justice agencies;
    (2) To federal agencies authorized to receive it pursuant to federal 
statute or Executive order;
    (3) For use in connection with licensing or employment, pursuant to 
Public Law 92-544, 86 Stat. 1115, or other federal legislation, and for 
other uses for which dissemination is authorized by federal law. Refer 
to Sec. 50.12 of this chapter for dissemination guidelines relating to 
requests processed under this paragraph;
    (4) For issuance of press releases and publicity designed to effect 
the apprehension of wanted persons in connection with serious or 
significant offenses;
    (5) To criminal justice agencies for the conduct of background 
checks under the National Instant Criminal Background Check System 
(NICS);
    (6) To noncriminal justice governmental agencies performing criminal 
justice dispatching functions or data processing/ information services 
for criminal justice agencies; and
    (7) To private contractors pursuant to a specific agreement with an 
agency identified in paragraphs (a)(1) or (a)(6) of this section and for 
the purpose of providing services for the administration of criminal 
justice pursuant to that agreement. The agreement must incorporate a 
security addendum approved by the Attorney General of the United States, 
which shall specifically authorize access to criminal history record 
information, limit the use of the information to the purposes for which 
it is provided, ensure the security and confidentiality of the 
information consistent with these regulations, provide for sanctions, 
and contain such other provisions as the Attorney General may require. 
The power and authority of the Attorney General hereunder shall be 
exercised by the FBI Director (or the Director's designee).
    (b) The exchange of criminal history record information authorized 
by paragraph (a) of this section is subject to cancellation if 
dissemination is made outside the receiving departments, related 
agencies, or service providers identified in paragraphs (a)(6) and 
(a)(7) of this section.
    (c) Nothing in these regulations prevents a criminal justice agency 
from disclosing to the public factual information concerning the status 
of an investigation, the apprehension, arrest, release, or prosecution 
of an individual, the adjudication of charges, or the correctional 
status of an individual, which is reasonably contemporaneous with the 
event to which the information relates.
    (d) Criminal history records received from the III System or the 
FIRS shall be used only for the purpose requested and a current record 
should be requested when needed for a subsequent authorized use.



Sec. 20.34  Individual's right to access criminal history record information.

    The procedures by which an individual may obtain a copy of his or 
her identification record from the FBI to review and request any change, 
correction, or update are set forth in Secs. 16.30-16.34 of this 
chapter. The procedures by

[[Page 402]]

which an individual may obtain a copy of his or her identification 
record from a state or local criminal justice agency are set forth in 
Sec. 20.34 of the appendix to this part.



Sec. 20.35  Criminal Justice Information Services Advisory Policy Board.

    (a) There is established a CJIS Advisory Policy Board, the purpose 
of which is to recommend to the FBI Director general policy with respect 
to the philosophy, concept, and operational principles of various 
criminal justice information systems managed by the FBI's CJIS Division.
    (b) The Board includes representatives from state and local criminal 
justice agencies; members of the judicial, prosecutorial, and 
correctional segments of the criminal justice community; a 
representative of federal agencies participating in the CJIS systems; 
and representatives of criminal justice professional associations.
    (c) All members of the Board will be appointed by the FBI Director.
    (d) The Board functions solely as an advisory body in compliance 
with the provisions of the Federal Advisory Committee Act. Title 5, 
United States Code, Appendix 2.



Sec. 20.36  Participation in the Interstate Identification Index System.

    (a) In order to acquire and retain direct access to the III System, 
each Control Terminal Agency and Federal Service Coordinator shall 
execute a CJIS User Agreement (or its functional equivalent) with the 
Assistant Director in Charge of the CJIS Division, FBI, to abide by all 
present rules, policies, and procedures of the NCIC, as well as any 
rules, policies, and procedures hereinafter recommended by the CJIS 
Advisory Policy Board and adopted by the FBI Director.
    (b) Entry or updating of criminal history record information in the 
III System will be accepted only from state or federal agencies 
authorized by the FBI. Terminal devices in other agencies will be 
limited to inquiries.



Sec. 20.37  Responsibility for accuracy, completeness, currency, and integrity.

    It shall be the responsibility of each criminal justice agency 
contributing data to the III System and the FIRS to assure that 
information on individuals is kept complete, accurate, and current so 
that all such records shall contain to the maximum extent feasible 
dispositions for all arrest data included therein. Dispositions should 
be submitted by criminal justice agencies within 120 days after the 
disposition has occurred.



Sec. 20.38  Sanction for noncompliance.

    Access to systems managed or maintained by the FBI is subject to 
cancellation in regard to any agency or entity that fails to comply with 
the provisions of subpart C of this part.

Appendix to Part 20--Commentary on Selected Sections of the Regulations 
             on Criminal History Record Information Systems

    Subpart A-Sec. 20.3(d). The definition of criminal history record 
information is intended to include the basic offender-based transaction 
statistics/III System (OBTS/III) data elements. If notations of an 
arrest, disposition, or other formal criminal justice transaction occurs 
in records other than the traditional ``rap sheet,'' such as arrest 
reports, any criminal history record information contained in such 
reports comes under the definition of this subsection.
    The definition, however, does not extend to other information 
contained in criminal justice agency reports. Intelligence or 
investigative information (e.g., suspected criminal activity, 
associates, hangouts, financial information, and ownership of property 
and vehicles) is not included in the definition of criminal history 
information.
    Sec. 20.3(g). The definitions of criminal justice agency and 
administration of criminal justice in Sec. 20.3(b) of this part must be 
considered together. Included as criminal justice agencies would be 
traditional police, courts, and corrections agencies, as well as 
subunits of noncriminal justice agencies that perform the administration 
of criminal justice pursuant to a federal or state statute or executive 
order and allocate a substantial portion of their budgets to the 
administration of criminal justice. The above subunits of noncriminal 
justice agencies would include, for example, the Office of Investigation 
of the

[[Page 403]]

Food and Drug Administration, which has as its principal function the 
detection and apprehension of persons violating criminal provisions of 
the Federal Food, Drug and Cosmetic Act. Also included under the 
definition of criminal justice agency are umbrella-type administrative 
agencies supplying criminal history information services, such as New 
York's Division of Criminal Justice Services.
    Sec. 20.3(i). Disposition is a key concept in section 524(b) of the 
Act and in Secs. 20.21(a)(1) and 20.21(b) of this part. It therefore is 
defined in some detail. The specific dispositions listed in this 
subsection are examples only and are not to be construed as excluding 
other, unspecified transactions concluding criminal proceedings within a 
particular agency.
    Sec. 20.3(q). The different kinds of acquittals and dismissals 
delineated in Sec. 20.3(i) are all considered examples of nonconviction 
data.
    Subpart B--Sec. 20.20(a). These regulations apply to criminal 
justice agencies receiving funds under the Omnibus Crime Control and 
Safe Streets Act for manual or automated systems subsequent to July 1, 
1973. In the hearings on the regulations, a number of those testifying 
challenged LEAA's authority to promulgate regulations for manual systems 
by contending that section 524(b) of the Act governs criminal history 
information contained in automated systems.
    The intent of section 524(b), however, would be subverted by only 
regulating automated systems. Any agency that wished to circumvent the 
regulations would be able to create duplicate manual files for purposes 
contrary to the letter and spirit of the regulations.
    Regulation of manual systems, therefore, is authorized by section 
524(b) when coupled with section 501 of the Act which authorizes the 
Administration to establish rules and regulations ``necessary to the 
exercise of its functions * * *.''
    The Act clearly applies to all criminal history record information 
collected, stored, or disseminated with LEAA support subsequent to July 
1, 1973.
    Limitations as contained in subpart C also apply to information 
obtained from the FBI Identification Division or the FBI/NCIC System.
    Sec. 20.20 (b) and (c). Section 20.20 (b) and (c) exempts from 
regulations certain types of records vital to the apprehension of 
fugitives, freedom of the press, and the public's right to know. Court 
records of public judicial proceedings are also exempt from the 
provisions of the regulations.
    Section 20.20(b)(2) attempts to deal with the problem of 
computerized police blotters. In some local jursidictions, it is 
apparently possible for private individuals and/or newsmen upon 
submission of a specific name to obtain through a computer search of the 
blotter a history of a person's arrests. Such files create a partial 
criminal history data bank potentially damaging to individual privacy, 
especially since they do not contain final dispositions. By requiring 
that such records be accessed solely on a chronological basis, the 
regulations limit inquiries to specific time periods and discourage 
general fishing expeditions into a person's private life.
    Subsection 20.20(c) recognizes that announcements of ongoing 
developments in the criminal justice process should not be precluded 
from public disclosure. Thus, announcements of arrest, convictions, new 
developments in the course of an investigation may be made. It is also 
permissible for a criminal justice agency to confirm certain matters of 
public record information upon specific inquiry. Thus, if a question is 
raised: ``Was X arrested by your agency on January 3, 1975'' and this 
can be confirmed or denied by looking at one of the records enumerated 
in subsection (b) above, then the criminal justice agency may respond to 
the inquiry. Conviction data as stated in Sec. 20.21(b) may be 
disseminated without limitation.
    Sec. 20.21. The regulations deliberately refrain from specifying who 
within a State should be responsible for preparing the plan. This 
specific determination should be made by the Governor. The State has 90 
days from the publication of these revised regulations to submit the 
portion of the plan covering Secs. 20.21(b) and 20.21(f).
    Sec. 20.21(a)(1). Section 524(b) of the Act requires that LEAA 
insure criminal history information be current and that, to the maximum 
extent feasible, it contain disposition as well as current data.
    It is, however, economically and administratively impractical to 
maintain complete criminal histories at the local level. Arrangements 
for local police departments to keep track of dispositions by agencies 
outside of the local jurisdictions generally do not exist. It would, 
moreover, be bad public policy to encourage such arrangements since it 
would result in an expensive duplication of files.
    The alternatives to locally kept criminal histories are records 
maintained by a central State repository. A central State repository is 
a State agency having the function pursuant to a statute or executive 
order of maintaining comprehensive statewide criminal history record 
information files. Ultimately, through automatic data processing the 
State level will have the capability to handle all requests for in-State 
criminal history information.
    Section 20.20(a)(1) is written with a centralized State criminal 
history repository in mind. The first sentence of the subsection states 
that complete records should be retained at a central State repository. 
The word ``should'' is permissive; it suggests but does not mandate a 
central State repository.

[[Page 404]]

    The regulations do require that States establish procedures for 
State and local criminal justice agencies to query central State 
repositories wherever they exist. Such procedures are intended to insure 
that the most current criminal justice information is used.
    As a minimum, criminal justice agencies subject to these regulations 
must make inquiries of central State repositories whenever the 
repository is capable of meeting the user's request within a reasonable 
time. Presently, comprehensive records of an individual's transactions 
within a State are maintained in manual files at the State level, if at 
all. It is probably unrealistic to expect manual systems to be able 
immediately to meet many rapid-access needs of police and prosecutors. 
On the other hand, queries of the State central repository for most 
noncriminal justice purposes probably can and should be made prior to 
dissemination of criminal history record information.
    Sec. 20.21(b). The limitations on dissemination in this subsection 
are essential to fulfill the mandate of section 524(b) of the Act which 
requires the Administration to assure that the ``privacy of all 
information is adequately provided for and that information shall only 
be used for law enforcement and criminal justice and other lawful 
purposes.'' The categories for dissemination established in this section 
reflect suggestions by hearing witnesses and respondents submitting 
written commentary.
    The regulations distinguish between conviction and nonconviction 
information insofar as dissemination is concerned. Conviction 
information is currently made available without limitation in many 
jurisdictions. Under these regulations, conviction data and pending 
charges could continue to be disseminated routinely. No statute, 
ordinance, executive order, or court rule is necessary in order to 
authorize dissemination of conviction data. However, nothing in the 
regulations shall be construed to negate a State law limiting such 
dissemination.
    After December 31, 1977, dissemination of nonconviction data would 
be allowed, if authorized by a statute, ordinance, executive order, or 
court rule, decision, or order. The December 31, 1977, deadline allows 
the States time to review and determine the kinds of dissemination for 
non-criminal justice purposes to be authorized. When a State enacts 
comprehensive legislation in this area, such legislation will govern 
dissemination by local jurisdictions within the State. It is possible 
for a public record law which has been construed by the State to 
authorize access to the public of all State records, including criminal 
history record information, to be considered as statutory authority 
under this subsection. Federal legislation and executive orders can also 
authorize dissemination and would be relevant authority.
    For example, Civil Service suitablity investigations are conducted 
under Executive Order 10450. This is the authority for most 
investigations conducted by the Commission. Section 3(a) of 10450 
prescribes the minimum scope of investigation and requires a check of 
FBI fingerprint files and written inquiries to appropriate law 
enforcement agencies.
    Sec. 20.21(b)(3). This subsection would permit private agencies such 
as the Vera Institute to receive criminal histories where they perform a 
necessary administration of justice function such as pretrial release. 
Private consulting firms which commonly assist criminal justice agencies 
in information systems development would also be included here.
    Sec. 20.21(b)(4). Under this subsection, any good faith researchers 
including private individuals would be permitted to use criminal history 
record information for research purposes. As with the agencies 
designated in Sec. 20.21(b)(3) researchers would be bound by an 
agreement with the disseminating criminal justice agency and would, of 
course, be subject to the sanctions of the Act.
    The drafters of the regulations expressly rejected a suggestion 
which would have limited access for research purposes to certified 
research organizations. Specifically ``certification'' criteria would 
have been extremely difficult to draft and would have inevitably led to 
unnecessary restrictions on legitimate research.
    Section 524(a) of the Act which forms part of the requirements of 
this section states:

``Except as provided by Federal law other than this title, no officer or 
employee of the Federal Government, nor any recipient of assistance 
under the provisions of this title shall use or reveal any research or 
statistical information furnished under this title by any person and 
identifiable to any specific private person for any purpose other than 
the purpose for which it was obtained in accordance with this title. 
Copies of such information shall be immune from legal process, and shall 
not, without the consent of the person furnishing such information, be 
admitted as evidence or used for any purpose in any action suit, or 
other judicial or administrative proceedings.''

LEAA anticipates issuing regulations, pursuant to section 524(a) as soon 
as possible.
    Sec. 20.21(c)(2). Presently some employers are circumventing State 
and local dissemination restrictions by requesting applicants to obtain 
an official certification of no criminal record. An employer's request 
under the above circumstances gives the applicant the unenviable choice 
of invasion of his privacy or loss of possible job opportunities. Under 
this subsection routine certifications of no

[[Page 405]]

record would no longer be permitted. In extraordinary circumstances, 
however, an individual could obtain a court order permitting such a 
certification.
    Sec. 20.21(c)(3). The language of this subsection leaves to the 
States the question of who among the agencies and individuals listed in 
Sec. 20.21(b) shall actually receive criminal records. Under these 
regulations a State could place a total ban on dissemination if it so 
wished. The State could, on the other hand, enact laws authorizing any 
member of the private sector to have access to non-conviction data.
    Sec. 20.21(d). Non-criminal justice agencies will not be able to 
receive records of juveniles unless the language of a statute or court 
order, rule, or court decision specifies that juvenile records shall be 
available for dissemination. Perhaps the most controversial part of this 
subsection is that it denies access to records of juveniles by Federal 
agencies conducting background investigations for eligibility to 
classified information under existing legal authority.
    Sec. 20.21(e) Since it would be too costly to audit each criminal 
justice agency in most States (Wisconsin, for example, has 1075 criminal 
justice agencies) random audits of a ``representative sample'' of 
agencies are the next best alternative. The term ``representative 
sample'' is used to insure that audits do not simply focus on certain 
types of agencies. Although this subsection requires that there be 
records kept with the names of all persons or agencies to whom 
information is disseminated, criminal justice agencies are not required 
to maintain dissemination logs for ``no record'' responses.
    Sec. 20.21(f). Requirements are set forth which the States must meet 
in order to assure that criminal history record information is 
adequately protected. Automated systems may operate in shared 
environments and the regulations require certain minimum assurances.
    Sec. 20.21(g)(1). A ``challenge'' under this section is an oral or 
written contention by an individual that his record is inaccurate or 
incomplete; it would require him to give a correct version of his record 
and explain why he believes his version to be correct. While an 
individual should have access to his record for review, a copy of the 
record should ordinarily only be given when it is clearly established 
that it is necessary for the purpose of challenge.
The drafters of the subsection expressly rejected a suggestion that 
would have called for a satisfactory verification of identity by 
fingerprint comparison. It was felt that States ought to be free to 
determine other means of identity verification.
    Sec. 20.21(g)(5). Not every agency will have done this in the past, 
but henceforth adequate records including those required under 20.21(e) 
must be kept so that notification can be made.
    Sec. 20.21(g)(6). This section emphasizes that the right to access 
and review extends only to criminal history record information and does 
not include other information such as intelligence or treatment data.
    Sec. 20.22(a). The purpose for the certification requirement is to 
indicate the extent of compliance with these regulations. The term 
``maximum extent feasible'' acknowledges that there are some areas such 
as the completeness requirement which create complex legislative and 
financial problems.
    Note: In preparing the plans required by these regulations, States 
should look for guidance to the following documents: National Advisory 
Commission on Criminal Justice Standards and Goals, Report on the 
Criminal Justice System; Project SEARCH: Security and Privacy 
Considerations in Criminal History Information Systems, Technical 
Reports No. 2 and No. 13; Project SEARCH: A Model State Act for Criminal 
Offender Record Information, Technical Memorandum No. 3; and Project 
SEARCH: Model Administrative Regulations for Criminal Offender Record 
Information, Technical Memorandum No. 4.
    Subpart C-Sec. 20.31. This section defines the criminal history 
record information system managed by the Federal Bureau of 
Investigation. Each state having a record in the III System must have 
fingerprints on file in the FBI CJIS Division to support the III System 
record concerning the individual.
    Paragraph (b) is not intended to limit the identification services 
presently performed by the FBI for local, state, tribal, and federal 
agencies.
    Sec. 20.32. The grandfather clause contained in paragraph (c) of 
this section is designed, from a practical standpoint, to eliminate the 
necessity of deleting from the FBI's massive files the non-includable 
offenses that were stored prior to February, 1973. In the event a person 
is charged in court with a serious or significant offense arising out of 
an arrest involving a non-includable offense, the non-includable offense 
will also appear in the arrest segment of the III System record.
    Sec. 20.33(a)(3). This paragraph incorporates provisions cited in 28 
CFR 50.12 regarding dissemination of identification records outside the 
federal government for noncriminal justice purposes.
    Sec. 20.33(a)(6). Noncriminal justice governmental agencies are 
sometimes tasked to perform criminal justice dispatching functions or 
data processing/information services for criminal justice agencies as 
part, albeit not a principal part, of their responsibilities. Although 
such inter-governmental delegated tasks involve the administration of 
criminal justice, performance of those tasks does not convert an 
otherwise non-criminal justice agency to a criminal justice agency. This

[[Page 406]]

regulation authorizes this type of delegation if it is effected pursuant 
to executive order, statute, regulation, or interagency agreement. In 
this context, the noncriminal justice agency is servicing the criminal 
justice agency by performing an administration of criminal justice 
function and is permitted access to criminal history record information 
to accomplish that limited function. An example of such delegation would 
be the Pennsylvania Department of Administration's Bureau of 
Consolidated Computer Services, which performs data processing for 
several state agencies, including the Pennsylvania State Police. 
Privatization of the data processing/information services or dispatching 
function by the noncriminal justice governmental agency can be 
accomplished pursuant to Sec. 20.33(a)(7) of this part.
    Sec. 20.34. The procedures by which an individual may obtain a copy 
of his manual identification record are set forth in 28 CFR 16.30-16.34.
    The procedures by which an individual may obtain a copy of his III 
System record are as follows: If an individual has a criminal record 
supported by fingerprints and that record has been entered in the III 
System, it is available to that individual for review, upon presentation 
of appropriate identification, and in accordance with applicable state 
and federal administrative and statutory regulations. Appropriate 
identification includes being fingerprinted for the purpose of insuring 
that he is the individual that he purports to be. The record on file 
will then be verified as his through comparison of fingerprints.
    Procedure. 1. All requests for review must be made by the subject of 
the record through a law enforcement agency which has access to the III 
System. That agency within statutory or regulatory limits can require 
additional identification to assist in securing a positive 
identification.
    2. If the cooperating law enforcement agency can make an 
identification with fingerprints previously taken which are on file 
locally and if the FBI identification number of the individual's record 
is available to that agency, it can make an on-line inquiry through NCIC 
to obtain his III System record or, if it does not have suitable 
equipment to obtain an on-line response, obtain the record from 
Clarksburg, West Virginia, by mail. The individual will then be afforded 
the opportunity to see that record.
    3. Should the cooperating law enforcement agency not have the 
individual's fingerprints on file locally, it is necessary for that 
agency to relate his prints to an existing record by having his 
identification prints compared with those already on file in the FBI, 
or, possibly, in the state's central identification agency.
    4. The subject of the requested record shall request the appropriate 
arresting agency, court, or correctional agency to initiate action 
necessary to correct any stated inaccuracy in his record or provide the 
information needed to make the record complete.
    Sec. 20.36. This section refers to the requirements for obtaining 
direct access to the III System.
    Sec. 20.37. The 120-day requirement in this section allows 30 days 
more than the similar provision in subpart B in order to allow for 
processing time that may be needed by the states before forwarding the 
disposition to the FBI.

[Order No. 662-76, 41 FR 34949, Aug. 18, 1976, as amended by Order No. 
1438-90, 55 FR 32075, Aug. 7, 1990; Order No. 2258-99, 64 FR 52229, 
Sept. 28, 1999]