Attachment A

Attachment A: Confidentiality Law

TITLE 42 ‑ THE PUBLIC HEALTH AND WELFARE

CHAPTER 46 ‑ JUSTICE SYSTEM IMPROVEMENT

SUBCHAPTER VIII ‑ ADMINISTRATIVE PROVISIONS

42 U.S.C. 3789g Confidentiality of information

(a) Research or statistical information; immunity from process; prohibition against admission as evidence or use in any proceedings

Except as provided by Federal law other than this chapter, no officer or employee of the Federal Government, and no recipient of assistance under the provisions of this chapter shall use or reveal any research or statistical information furnished under this chapter by any person and identifiable to any specific private person for any purpose other than the purpose for which it was obtained in accordance with this chapter. Such information and copies thereof shall be immune from legal process, and shall not, without the consent of the person furnishing such information, be admitted as evidence or used for any purpose in any action, suit, or other judicial, legislative, or administrative proceedings.

(b) Criminal history information; disposition and arrest data; procedures for collection, storage, dissemination, and current status; security and privacy; availability for law enforcement, criminal justice, and other lawful purposes; automated systems: review, challenge, and correction of information

All criminal history information collected, stored, or disseminated through support under this chapter shall contain, to the maximum extent feasible, disposition as well as arrest data where arrest data is included therein. The collection, storage, and dissemination of such information shall take place under procedures reasonably designed to insure that all such information is kept current therein; the Office of Justice Programs shall assure that the security and privacy of all information is adequately provided for and that information shall only be used for law enforcement and criminal justice and other lawful purposes. In addition, an individual who believes that criminal history information concerning him contained in an automated system is inaccurate, incomplete, or maintained in violation of this chapter, shall, upon satisfactory verification of his identity, be entitled to review such information and to obtain a copy of it for the purpose of challenge or correction.

(c) Criminal intelligence systems and information; prohibition against violation of privacy and constitutional rights of individuals

All criminal intelligence systems operating through support under this chapter shall collect, maintain, and disseminate criminal intelligence information in conformance with policy standards which are prescribed by the Office of Justice Programs and which are written to assure that the funding and operation of these systems furthers the purpose of this chapter and to assure that such systems are not utilized in violation of the privacy and constitutional rights of individuals.

(d) Violations; fine as additional penalty

Any person violating the provisions of this section, or of any rule, regulation, or order issued thereunder, shall be fined not to exceed $10,000, in addition to any other penalty imposed by law.

(Pub. L. 90‑351, title I, Sec. 812, formerly Sec. 818, as added Pub. L. 96‑157, Sec. 2, Dec. 27, 1979, 93 Stat. 1213; renumbered Sec. 812 and amended Pub. L. 98‑473, title II, Sec. 609B(f), (k), Oct. 12, 1984, 98 Stat. 2093, 2096.)

PRIOR PROVISIONS

A prior section 812 of Pub. L. 90‑351 was classified to section 3789a of this title prior to repeal by section 609B(e) of Pub. L. 98‑473.

AMENDMENTS

1984 ‑ Subsecs. (b), (c). Pub. L. 98‑473, 609B(k), substituted ''Office of Justice Programs'' for ''Office of Justice Assistance, Research, and Statistics''.

EFFECTIVE DATE OF 1984 AMENDMENT

Amendment by section 609B(k) of Pub. L. 98‑473 effective Oct. 12, 1984, see section 609AA(a) of Pub. L. 98‑473, set out as an Effective Date note under section 3711 of this title.

From: http://www.access.gpo.gov/nara/cfr/waisidx_04/28cfr22_04.html

TITLE 28--JUDICIAL ADMINISTRATION

CHAPTER I--DEPARTMENT OF JUSTICE

PART 22_CONFIDENTIALITY OF IDENTIFIABLE RESEARCH AND STATISTICAL

INFORMATION--Table of Contents

Sec.

22.1 Purpose.

22.2 Definitions.

22.20 Applicability.

22.21 Use of identifiable data.

22.22 Revelation of identifiable data.

22.23 Privacy certification.

22.24 Information transfer agreement.

22.25 Final disposition of identifiable materials.

22.26 Requests for transfer of information.

22.27 Notification.

22.28 Use of data identifiable to a private person for judicial,

legislative or administrative purposes.

22.29 Sanctions.

Authority: Secs. 801(a), 812(a), Omnibus Crime Control and Safe

Streets Act of 1968, 42 U.S.C. 3701, et seq., as amended (Pub. L. 90-

351, as amended by Pub. L. 93-83, Pub. L. 93-415, Pub. L. 94-430, Pub.

L. 94-503, Pub. L. 95-115, Pub. L. 96-157, and Pub. L. 98-473); secs.

262(b), 262(d), Juvenile Justice and Delinquency Prevention Act of 1974, 42 U.S.C. 5601, et seq., as amended (Pub. L. 93-415, as amended by Pub. L. 94-503, Pub. L. 95-115, Pub. L. 99-509, and Pub. L. 98-473); and secs. 1407(a) and 1407(d) of the Victims of Crime Act of 1984, 42 U.S.C. 10601, et seq., Pub. L. 98-473; Pub. L. 101-410, 104 Stat. 890, as amended by Pub. L. 104-134, 110 Stat. 1321.

Source: 41 FR 54846, Dec. 15, 1976, unless otherwise noted.

22.1 Purpose

The purpose of these regulations is to:

(a) Protect privacy of individuals by requiring that information

identifiable to a private person obtained in a research or statistical

program may only be used and/or revealed for the purpose for which

obtained;

(b) Insure that copies of such information shall not, without the

consent of the person to whom the information pertains, be admitted as

evidence or used for any purpose in any judicial or administrative

proceedings;

(c) Increase the credibility and reliability of federally-supported

research and statistical findings by minimizing subject concern over

subsequent uses of identifiable information;

(d) Provide needed guidance to persons engaged in research and

statistical activities by clarifying the purposes for which identifiable information may be used or revealed; and

(e) Insure appropriate balance between individual privacy and

essential needs of the research community for data to advance the state

of knowledge in the area of criminal justice.

(f) Insure the confidentiality of information provided by crime

victims to crisis intervention counselors working for victim services

programs receiving funds provided under the Crime Control Act, and

Juvenile Justice Act, and the Victims of Crime Act.

[41 FR 54846, Dec. 15, 1976, as amended at 51 FR 6400, Feb. 24, 1986]

Sec. 22.2 Definitions.

(a) Person means any individual, partnership, corporation,

association, public or private organization or governmental entity, or

combination thereof.

(b) Private person means any person defined in Sec. 22.2(a) other

than an agency, or department of Federal, State, or local government, or any component or combination thereof. Included as a private person is an individual acting in his or her official capacity.

(c) Research or statistical project means any program, project, or

component thereof which is supported in whole or in part with funds

appropriated under the Act and whose purpose is to develop, measure,

evaluate, or otherwise advance the state of knowledge in a particular area. The term does not include ``intelligence'' or other information-gathering activities in which information pertaining to specific individuals is obtained for purposes directly related to

enforcement of the criminal laws.

(d) Research or statistical information means any information which

is collected during the conduct of a research or statistical project and which is intended to be utilized for research or statistical purposes. The term includes information which is collected directly from the individual or obtained from any agency or individual having possession, knowledge, or control thereof.

(e) Information identifiable to a private person means information

which either--

(1) Is labelled by name or other personal identifiers, or

(2) Can, by virtue of sample size or other factors, be reasonably

interpreted as referring to a particular private person.

(f) Recipient of assistance means any recipient of a grant,

contract, interagency agreement, subgrant, or subcontract under the Act

and any person, including subcontractors, employed by such recipient in

connection with performances of the grant, contract, or interagency

agreement.

(g) Officer or employee of the Federal Government means any person

employed as a regular or special employee of the U.S. (including

experts, consultants, and advisory board members) as of July 1, 1973, or at any time thereafter.

(h) The act means the Omnibus Crime Control and Safe Streets Act of

1968, as amended.

(i) Applicant means any person who applies for a grant, contract, or subgrant to be funded pursuant to the Act.

(j) The Juvenile Justice Act means the ``Juvenile Justice and

Delinquency Prevention Act of 1974, as amended.''

(k) The Victims of Crime Act means the Victims of Crime Act of 1984.

[41 FR 54846, Dec. 15, 1976, as amended at 43 FR 16974, Apr. 21, 1978;

51 FR 6400, Feb. 24, 1986]

Sec. 22.20 Applicability.

(a) These regulations govern use and revelation of research and

statistical information obtained, collected, or produced either directly by BJA, OJJDP, BJS, NIJ, or OJP or under any interagency agreement, grant, contract, or subgrant awarded under the Crime Control Act, the Juvenile Justice Act, and the Victims of Crime Act.

(b) The regulations do not apply to any records from which

identifiable research or statistical information was originally

obtained; or to any records which are designated under existing statutes as public; or to any information extracted from any records designated as public.

(c) The regulations do not apply to information gained regarding

future criminal conduct.

[41 FR 54846, Dec. 15, 1976, as amended at 43 FR 16974, Apr. 21, 1978;

51 FR 6400, 6401, Feb. 24, 1986]

Sec. 22.21 Use of identifiable data.

Research or statistical information identifiable to a private person may be used only for research or statistical purposes.

Sec. 22.22 Revelation of identifiable data.

(a) Except as noted in paragraph (b) of this section, research and

statistical information relating to a private person may be revealed in

identifiable form on a need-to-know basis only to--

(1) Officers, employees, and subcontractors of the recipient of

assistance;

(2) Such individuals as needed to implement sections 202(c)(3), 801, and 811(b) of the Act; and sections 223(a)(12)(A), 223(a)(13),

223(a)(14), and 243 of the Juvenile Justice and Delinquency Prevention

Act.

(3) Persons or organizations for research or statistical purposes.

Information may only be transferred for such purposes upon a clear

demonstration that the standards of Sec. 22.26 have been met and that,

except where information is transferred under paragraphs (a) (1) and (2) of this section, such transfers shall be conditioned on compliance with a Sec. 22.24 agreement.

(b) Information may be revealed in identifiable form where prior

consent is obtained from an individual or where the individual has agreed to participate in a project with knowledge that the findings cannot, by virtue of sample size, or uniqueness of subject, be expected to totally conceal subject identity.

[41 FR 54846, Dec. 15, 1976, as amended at 51 FR 6400, Feb. 24, 1986]

Sec. 22.23 Privacy certification.

(a) Each applicant for BJA, OJJDP, BJS, NIJ, or OJP support either

directly or under a State plan shall submit a Privacy Certificate as a

condition of approval of a grant application or contract proposal which

has a research or statistical project component under which information

identifiable to a private person will be collected.

(b) The Privacy Certificate shall briefly describe the project and

shall contain assurance by the applicant that:

(1) Data identifiable to a private person will not be used or

revealed, except as authorized under Sec. Sec. 22.21, 22.22.

(2) Access to data will be limited to those employees having a need

therefore and that such persons shall be advised of and agree in writing to comply with these regulations.

(3) All subcontracts which require access to identifiable data will

contain conditions meeting the requirements of Sec. 22.24.

(4) To the extent required by Sec. 22.27 any private persons from

whom identifiable data are collected or obtained, either orally or by

means of written questionnaire, shall be advised that the data will only be used or revealed for research or statistical purposes and that

compliance with requests for information is not mandatory. Where the

notification requirement is to be waived, pursuant to Sec. 22.27(c), a

justification must be included in the Privacy Certificate.

(5) Adequate precautions will be taken to insure administrative and

physical security of identifiable data.

(6) A log will be maintained indicating that identifiable data have

been transmitted to persons other than BJA, OJJDP, BJS, NIJ, or OJP or

grantee/contractor staff or subcontractors, that such data have been

returned, or that alternative arrangements have been agreed upon for

future maintenance of such data.

(7) Project plans will be designed to preserve anonymity of private

persons to whom information relates, including, where appropriate, name-stripping, coding of data, or other similar procedures.

(8) Project findings and reports prepared for dissemination will not contain information which can reasonably be expected to be identifiable to a private person except as authorized under Sec. 22.22.

(c) The applicant shall attach to the Privacy Certification a

description of physical and/or administrative procedures to be followed

to insure the security of the data to meet the requirements of Sec.

22.25.

[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]

Sec. 22.24 Information transfer agreement.

Prior to the transfer of any identifiable information to persons

other than BJA, OJJDP, BJS, NIJ, or OJP or project staff, an agreement

shall be entered into which shall provide, as a minimum, that the

recipient of data agrees that:

(a) Information identifiable to a private person will be used only

for research and statistical purposes.

(b) Information identifiable to a private person will not be

revealed to any person for any purpose except where the information has

already been included in research findings (and/or data bases) and is

revealed on a need-to-know basis for research or statistical purposes,

provided that such transfer is approved by the person providing

information under the agreement, or authorized under Sec. 22.24(e).

(c) Knowingly and willfully using or disseminating information

contrary to the provisions of the agreement shall constitute a violation of these regulations, punishable in accordance with the Act.

(d) Adequate administrative and physical precautions will be taken

to assure security of information obtained for such purpose.

(e) Access to information will be limited to those employees or

subcontractors having a need therefore in connection with performance of the activity for which obtained, and that such persons shall be advised of, and agree to comply with, these regulations.

(f) Project plans will be designed to preserve anonymity of private

persons to whom information relates, including, where appropriate,

required name-stripping and/or coding of data or other similar

procedures.

(g) Project findings and reports prepared for dissemination will not contain information which can reasonably be expected to be identifiable to a private person.

(h) Information identifiable to a private person (obtained in

accordance with this agreement) will, unless otherwise agreed upon, be

returned upon completion of the project for which obtained and no copies of that information retained.

[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]

Sec. 22.25 Final disposition of identifiable materials.

Upon completion of a research or statistical project the security of identifiable research or statistical information shall be protected by:

(a) Complete physical destruction of all copies of the materials or

the identifiable portion of such materials after a three-year required

recipient retention period or as soon as authorized by law, or

(b) Removal of identifiers from data and separate maintenance of a

name-code index in a secure location.

The Privacy Certificate shall indicate the procedures to be followed and shall, in the case of paragraph (b) of this section, describe procedures to secure the name index.

Sec. 22.26 Requests for transfer of information.

(a) Requests for transfer of information identifiable to an

individual shall be submitted to the person submitting the Privacy

Certificate pursuant to Sec. 22.23.

(b) Except where information is requested by BJA, OJJDP, BJS, NIJ,

or OJP, the request shall describe the general objectives of the project for which information is requested, and specifically justify the need for such information in identifiable form. The request shall also indicate, and provide justification for the conclusion that conduct of the project will not, either directly or indirectly, cause legal, economic, physical, or social harm to individuals whose identification is revealed in the transfer of information.

(c) Data may not be transferred pursuant to this section where a

clear showing of the criteria set forth above is not made by the person

requesting the data.

[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]

Sec. 22.27 Notification.

(a) Any person from whom information identifiable to a private

person is to be obtained directly, either orally, by questionnaire, or

other written documents, shall be advised:

(1) That the information will only be used or revealed for research

or statistical purposes; and

(2) That compliance with the request for information is entirely

voluntary and may be terminated at any time.

(b) Except as noted in paragraph (c) of this section, where

information is to be obtained through observation of individual activity or performance, such individuals shall be advised:

(1) Of the particular types of information to be collected;

(2) That the data will only be utilized or revealed for research or

statistical purposes; and

(3) That participation in the project in question is voluntary and

may be terminated at any time.

(c) Notification, as described in paragraph (b) of this section, may be eliminated where information is obtained through field observation of individual activity or performance and in the judgment of the researcher such notification is impractical or may seriously impede the progress of the research.

(d) Where findings in a project cannot, by virtue of sample size, or uniqueness of subject, be expected to totally conceal subject identity, an individual shall be so advised.

Sec. 22.28 Use of data identifiable to a private person for judicial,

legislative or administrative purposes.

(a) Research or statistical information identifiable to a private

person shall be immune from legal process and shall only be admitted as

evidence or used for any purpose in any action, suit, or other judicial, legislative or administrative proceeding with the written consent of the individual to whom the data pertains.

(b) Where consent is obtained, such consent shall:

(1) Be obtained at the time that information is sought for use in

judicial, legislative or administrative proceedings;

(2) Set out specific purposes in connection with which information

will be used;

(3) Limit, where appropriate, the scope of the information subject

to such consent.

[41 FR 54846, Dec. 15, 1976, as amended at 45 FR 62038, Sept. 18, 1980]

Sec. 22.29 Sanctions.

Where BJA, OJJDP, BJS, NIJ, or OJP believes that a violation of

section 812(a) of the Act or section 1407(d) of the Victims of Crime

Act, these regulations, or any grant or contract conditions entered into thereunder has occurred, it may initiate administrative actions leading to termination of a grant or contract, commence appropriate personnel and/or other procedures in cases involving Federal employees, and/or initiate appropriate legal actions leading to imposition of a civil penalty not to exceed $10,000 for a violation occurring before September 29, 1999, and not to exceed $11,000 for a violation occurring on or after September 29, 1999 against any person responsible for such

violations.

[Order No. 2249-99, 64 FR 47102, Aug. 30, 1999]