[Title 28 CFR 22]
[Code of Federal Regulations (annual edition) - July 1, 2002 Edition]
[Title 28 - JUDICIAL ADMINISTRATION]
[Chapter I - DEPARTMENT OF JUSTICE]
[Part 22 - CONFIDENTIALITY OF IDENTIFIABLE RESEARCH AND STATISTICAL INFORMATION]
[From the U.S. Government Printing Office]


28JUDICIAL ADMINISTRATION12002-07-012002-07-01false22PART 22JUDICIAL ADMINISTRATIONDEPARTMENT OF JUSTICE
PART 22--CONFIDENTIALITY OF IDENTIFIABLE RESEARCH AND STATISTICAL INFORMATION--Table of Contents




Sec.
22.1  Purpose.
22.2  Definitions.
22.20  Applicability.
22.21  Use of identifiable data.
22.22  Revelation of identifiable data.
22.23  Privacy certification.
22.24  Information transfer agreement.
22.25  Final disposition of identifiable materials.
22.26  Requests for transfer of information.
22.27  Notification.
22.28  Use of data identifiable to a private person for judicial, 
          legislative or administrative purposes.
22.29  Sanctions.

    Authority: Secs. 801(a), 812(a), Omnibus Crime Control and Safe 
Streets Act of 1968, 42 U.S.C. 3701, et seq., as amended (Pub. L. 90-
351, as amended by Pub. L. 93-83, Pub. L. 93-415, Pub. L. 94-430, Pub. 
L. 94-503, Pub. L. 95-115, Pub. L. 96-157, and Pub. L. 98-473); secs. 
262(b), 262(d), Juvenile Justice and Delinquency Prevention Act of 1974, 
42 U.S.C. 5601,

[[Page 411]]

et seq., as amended (Pub. L. 93-415, as amended by Pub. L. 94-503, Pub. 
L. 95-115, Pub. L. 99-509, and Pub. L. 98-473); and secs. 1407(a) and 
1407(d) of the Victims of Crime Act of 1984, 42 U.S.C. 10601, et seq., 
Pub. L. 98-473; Pub. L. 101-410, 104 Stat. 890, as amended by Pub. L. 
104-134, 110 Stat. 1321.

    Source: 41 FR 54846, Dec. 15, 1976, unless otherwise noted.



Sec. 22.1  Purpose.

    The purpose of these regulations is to:
    (a) Protect privacy of individuals by requiring that information 
identifiable to a private person obtained in a research or statistical 
program may only be used and/or revealed for the purpose for which 
obtained;
    (b) Insure that copies of such information shall not, without the 
consent of the person to whom the information pertains, be admitted as 
evidence or used for any purpose in any judicial or administrative 
proceedings;
    (c) Increase the credibility and reliability of federally-supported 
research and statistical findings by minimizing subject concern over 
subsequent uses of identifiable information;
    (d) Provide needed guidance to persons engaged in research and 
statistical activities by clarifying the purposes for which identifiable 
information may be used or revealed; and
    (e) Insure appropriate balance between individual privacy and 
essential needs of the research community for data to advance the state 
of knowledge in the area of criminal justice.
    (f) Insure the confidentiality of information provided by crime 
victims to crisis intervention counselors working for victim services 
programs receiving funds provided under the Crime Control Act, and 
Juvenile Justice Act, and the Victims of Crime Act.

[41 FR 54846, Dec. 15, 1976, as amended at 51 FR 6400, Feb. 24, 1986]



Sec. 22.2  Definitions.

    (a) Person means any individual, partnership, corporation, 
association, public or private organization or governmental entity, or 
combination thereof.
    (b) Private person means any person defined in Sec. 22.2(a) other 
than an agency, or department of Federal, State, or local government, or 
any component or combination thereof. Included as a private person is an 
individual acting in his or her official capacity.
    (c) Research or statistical project means any program, project, or 
component thereof which is supported in whole or in part with funds 
appropriated under the Act and whose purpose is to develop, measure, 
evaluate, or otherwise advance the state of knowledge in a particular 
area. The term does not include ``intelligence'' or other information-
gathering activities in which information pertaining to specific 
individuals is obtained for purposes directly related to enforcement of 
the criminal laws.
    (d) Research or statistical information means any information which 
is collected during the conduct of a research or statistical project and 
which is intended to be utilized for research or statistical purposes. 
The term includes information which is collected directly from the 
individual or obtained from any agency or individual having possession, 
knowledge, or control thereof.
    (e) Information identifiable to a private person means information 
which either--
    (1) Is labelled by name or other personal identifiers, or
    (2) Can, by virtue of sample size or other factors, be reasonably 
interpreted as referring to a particular private person.
    (f) Recipient of assistance means any recipient of a grant, 
contract, interagency agreement, subgrant, or subcontract under the Act 
and any person, including subcontractors, employed by such recipient in 
connection with performances of the grant, contract, or interagency 
agreement.
    (g) Officer or employee of the Federal Government means any person 
employed as a regular or special employee of the U.S. (including 
experts, consultants, and advisory board members) as of July 1, 1973, or 
at any time thereafter.
    (h) The act means the Omnibus Crime Control and Safe Streets Act of 
1968, as amended.
    (i) Applicant means any person who applies for a grant, contract, or 
subgrant to be funded pursuant to the Act.

[[Page 412]]

    (j) The Juvenile Justice Act means the ``Juvenile Justice and 
Delinquency Prevention Act of 1974, as amended.''
    (k) The Victims of Crime Act means the Victims of Crime Act of 1984.

[41 FR 54846, Dec. 15, 1976, as amended at 43 FR 16974, Apr. 21, 1978; 
51 FR 6400, Feb. 24, 1986]



Sec. 22.20  Applicability.

    (a) These regulations govern use and revelation of research and 
statistical information obtained, collected, or produced either directly 
by BJA, OJJDP, BJS, NIJ, or OJP or under any interagency agreement, 
grant, contract, or subgrant awarded under the Crime Control Act, the 
Juvenile Justice Act, and the Victims of Crime Act.
    (b) The regulations do not apply to any records from which 
identifiable research or statistical information was originally 
obtained; or to any records which are designated under existing statutes 
as public; or to any information extracted from any records designated 
as public.
    (c) The regulations do not apply to information gained regarding 
future criminal conduct.

[41 FR 54846, Dec. 15, 1976, as amended at 43 FR 16974, Apr. 21, 1978; 
51 FR 6400, 6401, Feb. 24, 1986]



Sec. 22.21  Use of identifiable data.

    Research or statistical information identifiable to a private person 
may be used only for research or statistical purposes.



Sec. 22.22  Revelation of identifiable data.

    (a) Except as noted in paragraph (b) of this section, research and 
statistical information relating to a private person may be revealed in 
identifiable form on a need-to-know basis only to--
    (1) Officers, employees, and subcontractors of the recipient of 
assistance;
    (2) Such individuals as needed to implement sections 202(c)(3), 801, 
and 811(b) of the Act; and sections 223(a)(12)(A), 223(a)(13), 
223(a)(14), and 243 of the Juvenile Justice and Delinquency Prevention 
Act.
    (3) Persons or organizations for research or statistical purposes. 
Information may only be transferred for such purposes upon a clear 
demonstration that the standards of Sec. 22.26 have been met and that, 
except where information is transferred under paragraphs (a) (1) and (2) 
of this section, such transfers shall be conditioned on compliance with 
a Sec. 22.24 agreement.
    (b) Information may be revealed in identifiable form where prior 
consent is obtained from an individual or where the individual has 
agreed to participate in a project with knowledge that the findings 
cannot, by virtue of sample size, or uniqueness of subject, be expected 
to totally conceal subject identity.

[41 FR 54846, Dec. 15, 1976, as amended at 51 FR 6400, Feb. 24, 1986]



Sec. 22.23  Privacy certification.

    (a) Each applicant for BJA, OJJDP, BJS, NIJ, or OJP support either 
directly or under a State plan shall submit a Privacy Certificate as a 
condition of approval of a grant application or contract proposal which 
has a research or statistical project component under which information 
identifiable to a private person will be collected.
    (b) The Privacy Certificate shall briefly describe the project and 
shall contain assurance by the applicant that:
    (1) Data identifiable to a private person will not be used or 
revealed, except as authorized under Secs. 22.21, 22.22.
    (2) Access to data will be limited to those employees having a need 
therefore and that such persons shall be advised of and agree in writing 
to comply with these regulations.
    (3) All subcontracts which require access to identifiable data will 
contain conditions meeting the requirements of Sec. 22.24.
    (4) To the extent required by Sec. 22.27 any private persons from 
whom identifiable data are collected or obtained, either orally or by 
means of written questionnaire, shall be advised that the data will only 
be used or revealed for research or statistical purposes and that 
compliance with requests for information is not mandatory. Where the 
notification requirement is to be waived, pursuant to Sec. 22.27(c), a 
justification must be included in the Privacy Certificate.

[[Page 413]]

    (5) Adequate precautions will be taken to insure administrative and 
physical security of identifiable data.
    (6) A log will be maintained indicating that identifiable data have 
been transmitted to persons other than BJA, OJJDP, BJS, NIJ, or OJP or 
grantee/contractor staff or subcontractors, that such data have been 
returned, or that alternative arrangements have been agreed upon for 
future maintenance of such data.
    (7) Project plans will be designed to preserve anonymity of private 
persons to whom information relates, including, where appropriate, name-
stripping, coding of data, or other similar procedures.
    (8) Project findings and reports prepared for dissemination will not 
contain information which can reasonably be expected to be identifiable 
to a private person except as authorized under Sec. 22.22.
    (c) The applicant shall attach to the Privacy Certification a 
description of physical and/or administrative procedures to be followed 
to insure the security of the data to meet the requirements of 
Sec. 22.25.

[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]



Sec. 22.24  Information transfer agreement.

    Prior to the transfer of any identifiable information to persons 
other than BJA, OJJDP, BJS, NIJ, or OJP or project staff, an agreement 
shall be entered into which shall provide, as a minimum, that the 
recipient of data agrees that:
    (a) Information identifiable to a private person will be used only 
for research and statistical purposes.
    (b) Information identifiable to a private person will not be 
revealed to any person for any purpose except where the information has 
already been included in research findings (and/or data bases) and is 
revealed on a need-to-know basis for research or statistical purposes, 
provided that such transfer is approved by the person providing 
information under the agreement, or authorized under Sec. 22.24(e).
    (c) Knowingly and willfully using or disseminating information 
contrary to the provisions of the agreement shall constitute a violation 
of these regulations, punishable in accordance with the Act.
    (d) Adequate administrative and physical precautions will be taken 
to assure security of information obtained for such purpose.
    (e) Access to information will be limited to those employees or 
subcontractors having a need therefore in connection with performance of 
the activity for which obtained, and that such persons shall be advised 
of, and agree to comply with, these regulations.
    (f) Project plans will be designed to preserve anonymity of private 
persons to whom information relates, including, where appropriate, 
required name-stripping and/or coding of data or other similar 
procedures.
    (g) Project findings and reports prepared for dissemination will not 
contain information which can reasonably be expected to be identifiable 
to a private person.
    (h) Information identifiable to a private person (obtained in 
accordance with this agreement) will, unless otherwise agreed upon, be 
returned upon completion of the project for which obtained and no copies 
of that information retained.

[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]



Sec. 22.25  Final disposition of identifiable materials.

    Upon completion of a research or statistical project the security of 
identifiable research or statistical information shall be protected by:
    (a) Complete physical destruction of all copies of the materials or 
the identifiable portion of such materials after a three-year required 
recipient retention period or as soon as authorized by law, or
    (b) Removal of identifiers from data and separate maintenance of a 
name-code index in a secure location.

The Privacy Certificate shall indicate the procedures to be followed and 
shall, in the case of paragraph (b) of this section, describe procedures 
to secure the name index.

[[Page 414]]



Sec. 22.26  Requests for transfer of information.

    (a) Requests for transfer of information identifiable to an 
individual shall be submitted to the person submitting the Privacy 
Certificate pursuant to Sec. 22.23.
    (b) Except where information is requested by BJA, OJJDP, BJS, NIJ, 
or OJP, the request shall describe the general objectives of the project 
for which information is requested, and specifically justify the need 
for such information in identifiable form. The request shall also 
indicate, and provide justification for the conclusion that conduct of 
the project will not, either directly or indirectly, cause legal, 
economic, physical, or social harm to individuals whose identification 
is revealed in the transfer of information.
    (c) Data may not be transferred pursuant to this section where a 
clear showing of the criteria set forth above is not made by the person 
requesting the data.

[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]



Sec. 22.27  Notification.

    (a) Any person from whom information identifiable to a private 
person is to be obtained directly, either orally, by questionnaire, or 
other written documents, shall be advised:
    (1) That the information will only be used or revealed for research 
or statistical purposes; and
    (2) That compliance with the request for information is entirely 
voluntary and may be terminated at any time.
    (b) Except as noted in paragraph (c) of this section, where 
information is to be obtained through observation of individual activity 
or performance, such individuals shall be advised:
    (1) Of the particular types of information to be collected;
    (2) That the data will only be utilized or revealed for research or 
statistical purposes; and
    (3) That participation in the project in question is voluntary and 
may be terminated at any time.
    (c) Notification, as described in paragraph (b) of this section, may 
be eliminated where information is obtained through field observation of 
individual activity or performance and in the judgment of the researcher 
such notification is impractical or may seriously impede the progress of 
the research.
    (d) Where findings in a project cannot, by virtue of sample size, or 
uniqueness of subject, be expected to totally conceal subject identity, 
an individual shall be so advised.



Sec. 22.28  Use of data identifiable to a private person for judicial, legislative or administrative purposes.

    (a) Research or statistical information identifiable to a private 
person shall be immune from legal process and shall only be admitted as 
evidence or used for any purpose in any action, suit, or other judicial, 
legislative or administrative proceeding with the written consent of the 
individual to whom the data pertains.
    (b) Where consent is obtained, such consent shall:
    (1) Be obtained at the time that information is sought for use in 
judicial, legislative or administrative proceedings;
    (2) Set out specific purposes in connection with which information 
will be used;
    (3) Limit, where appropriate, the scope of the information subject 
to such consent.

[41 FR 54846, Dec. 15, 1976, as amended at 45 FR 62038, Sept. 18, 1980]



Sec. 22.29  Sanctions.

    Where BJA, OJJDP, BJS, NIJ, or OJP believes that a violation of 
section 812(a) of the Act or section 1407(d) of the Victims of Crime 
Act, these regulations, or any grant or contract conditions entered into 
thereunder has occurred, it may initiate administrative actions leading 
to termination of a grant or contract, commence appropriate personnel 
and/or other procedures in cases involving Federal employees, and/or 
initiate appropriate legal actions leading to imposition of a civil 
penalty not to exceed $10,000 for a violation occurring before September 
29, 1999, and not to exceed $11,000 for a violation occurring on or 
after September 29, 1999 against any person responsible for such 
violations.

[Order No. 2249-99, 64 FR 47102, Aug. 30, 1999]

[[Page 415]]