Additonal Legislation 28cfr22

§ 22.20

28 CFR Ch. I (7–1–04 Edition)

particular area. The term does not include ‘‘intelligence’’ or other information-gathering activities in which information pertaining to specific individuals is obtained for purposes directly related to enforcement of the
criminal laws.
(d) Research or statistical information
means any information which is collected during the conduct of a research
or statistical project and which is intended to be utilized for research or
statistical purposes. The term includes
information which is collected directly
from the individual or obtained from
any agency or individual having possession, knowledge, or control thereof.
(e) Information identifiable to a private
person means information which either—
(1) Is labelled by name or other personal identifiers, or
(2) Can, by virtue of sample size or
other factors, be reasonably interpreted as referring to a particular private person.
(f) Recipient of assistance means any
recipient of a grant, contract, interagency agreement, subgrant, or subcontract under the Act and any person,
including subcontractors, employed by
such recipient in connection with performances of the grant, contract, or
interagency agreement.
(g) Officer or employee of the Federal
Government means any person employed as a regular or special employee
of the U.S. (including experts, consultants, and advisory board members) as
of July 1, 1973, or at any time thereafter.
(h) The act means the Omnibus Crime
Control and Safe Streets Act of 1968, as
amended.
(i) Applicant means any person who
applies for a grant, contract, or
subgrant to be funded pursuant to the
Act.
(j) The Juvenile Justice Act means the
‘‘Juvenile Justice and Delinquency Prevention Act of 1974, as amended.’’
(k) The Victims of Crime Act means the
Victims of Crime Act of 1984.
[41 FR 54846, Dec. 15, 1976, as amended at 43
FR 16974, Apr. 21, 1978; 51 FR 6400, Feb. 24,
1986]

§ 22.20

Applicability.

(a) These regulations govern use and
revelation of research and statistical
information obtained, collected, or produced either directly by BJA, OJJDP,
BJS, NIJ, or OJP or under any interagency agreement, grant, contract, or
subgrant awarded under the Crime
Control Act, the Juvenile Justice Act,
and the Victims of Crime Act.
(b) The regulations do not apply to
any records from which identifiable research or statistical information was
originally obtained; or to any records
which are designated under existing
statutes as public; or to any information extracted from any records designated as public.
(c) The regulations do not apply to
information gained regarding future
criminal conduct.
[41 FR 54846, Dec. 15, 1976, as amended at 43
FR 16974, Apr. 21, 1978; 51 FR 6400, 6401, Feb.
24, 1986]

§ 22.21

Use of identifiable data.

Research or statistical information
identifiable to a private person may be
used only for research or statistical
purposes.
§ 22.22

Revelation of identifiable data.

(a) Except as noted in paragraph (b)
of this section, research and statistical
information relating to a private person may be revealed in identifiable
form on a need-to-know basis only to—
(1) Officers, employees, and subcontractors of the recipient of assistance;
(2) Such individuals as needed to implement sections 202(c)(3), 801, and
811(b) of the Act; and sections
223(a)(12)(A), 223(a)(13), 223(a)(14), and
243 of the Juvenile Justice and Delinquency Prevention Act.
(3) Persons or organizations for research or statistical purposes. Information may only be transferred for such
purposes upon a clear demonstration
that the standards of § 22.26 have been
met and that, except where information is transferred under paragraphs (a)
(1) and (2) of this section, such transfers shall be conditioned on compliance
with a § 22.24 agreement.
(b) Information may be revealed in
identifiable form where prior consent

424

VerDate May<21>2004

00:18 Jul 31, 2004

Jkt 203104

PO 00000

Frm 00424

Fmt 8010

Sfmt 8010

Y:\SGML\203104T.XXX

203104T

Department of Justice

§ 22.24

is obtained from an individual or where
the individual has agreed to participate
in a project with knowledge that the
findings cannot, by virtue of sample
size, or uniqueness of subject, be expected to totally conceal subject identity.
[41 FR 54846, Dec. 15, 1976, as amended at 51
FR 6400, Feb. 24, 1986]

§ 22.23 Privacy certification.
(a) Each applicant for BJA, OJJDP,
BJS, NIJ, or OJP support either directly or under a State plan shall submit a Privacy Certificate as a condition of approval of a grant application
or contract proposal which has a research or statistical project component
under which information identifiable
to a private person will be collected.
(b) The Privacy Certificate shall
briefly describe the project and shall
contain assurance by the applicant
that:
(1) Data identifiable to a private person will not be used or revealed, except
as authorized under §§ 22.21, 22.22.
(2) Access to data will be limited to
those employees having a need therefore and that such persons shall be advised of and agree in writing to comply
with these regulations.
(3) All subcontracts which require access to identifiable data will contain
conditions meeting the requirements of
§ 22.24.
(4) To the extent required by § 22.27
any private persons from whom identifiable data are collected or obtained,
either orally or by means of written
questionnaire, shall be advised that the
data will only be used or revealed for
research or statistical purposes and
that compliance with requests for information is not mandatory. Where the
notification requirement is to be
waived, pursuant to § 22.27(c), a justification must be included in the Privacy Certificate.
(5) Adequate precautions will be
taken to insure administrative and
physical security of identifiable data.
(6) A log will be maintained indicating that identifiable data have been
transmitted to persons other than BJA,
OJJDP, BJS, NIJ, or OJP or grantee/
contractor staff or subcontractors,
that such data have been returned, or
that alternative arrangements have

been agreed upon for future maintenance of such data.
(7) Project plans will be designed to
preserve anonymity of private persons
to whom information relates, including, where appropriate, name-stripping,
coding of data, or other similar procedures.
(8) Project findings and reports prepared for dissemination will not contain information which can reasonably
be expected to be identifiable to a private person except as authorized under
§ 22.22.
(c) The applicant shall attach to the
Privacy Certification a description of
physical and/or administrative procedures to be followed to insure the security of the data to meet the requirements of § 22.25.
[41 FR 5486, Dec. 15, 1976, as amended at 51
FR 6401, Feb. 24, 1986]

§ 22.24 Information
ment.

transfer

Prior to the transfer of any identifiable information to persons other than
BJA, OJJDP, BJS, NIJ, or OJP or
project staff, an agreement shall be entered into which shall provide, as a
minimum, that the recipient of data
agrees that:
(a) Information identifiable to a private person will be used only for research and statistical purposes.
(b) Information identifiable to a private person will not be revealed to any
person for any purpose except where
the information has already been included in research findings (and/or data
bases) and is revealed on a need-toknow basis for research or statistical
purposes, provided that such transfer is
approved by the person providing information under the agreement, or authorized under § 22.24(e).
(c) Knowingly and willfully using or
disseminating information contrary to
the provisions of the agreement shall
constitute a violation of these regulations, punishable in accordance with
the Act.
(d) Adequate administrative and
physical precautions will be taken to
assure security of information obtained
for such purpose.

425

VerDate May<21>2004

00:18 Jul 31, 2004

Jkt 203104

PO 00000

Frm 00425

Fmt 8010

agree-

Sfmt 8010

Y:\SGML\203104T.XXX

203104T