05-3045. Compact Council Procedures for Compliant Conduct and Responsible Use of the Interstate Identification Index (III) System for Noncriminal Justice Purposes

AGENCY:

National Crime Prevention and Privacy Compact Council.

ACTION:

Proposed rule.

SUMMARY:

The Compact Council, established pursuant to the National Crime Prevention and Privacy Compact (Compact), is publishing a rule proposing to establish a procedure for ensuring compliant conduct and responsible use of the Interstate Identification Index (III) System for noncriminal justice purposes as authorized by Article VI of the Compact.

DATES:

Comments must be received on or before March 21, 2005.

ADDRESSES:

Send all written comments concerning this proposed rule to the Compact Council Office, 1000 Custer Hollow Road, Module C3, Clarksburg, WV 26306; Attention: Todd C. Commodore. Comments may also be submitted by fax at [phone]. To ensure proper handling, please reference “Compliant Conduct and Responsible Use of the Interstate Identification Index (III) for Noncriminal Justice Purposes” on your correspondence. You may view an electronic version of this proposed rule at http://www.regulations.gov. You may also comment via electronic mail at [e-mail] or by using the http://www.regulations.gov comment form for this regulation. When submitting comments electronically you must include NCPPC Docket No. 108 in the subject box.

FOR FURTHER INFORMATION CONTACT:

Ms. Donna M. Uzzell, Compact Council Chairman, Florida Department of Law Enforcement, 2331 Philips Road, Tallahassee, Florida 32308-5333, telephone number [phone].

SUPPLEMENTARY INFORMATION:

The National Crime Prevention and Privacy Compact, 42 U.S.C. 14616, establishes uniform rules, procedures, and standards for the interstate and federal-state exchange of criminal history records for noncriminal justice purposes. The Compact was signed into law on October 9, 1998, (Pub. L. 105-251) and became effective on April 28, 1999, when ratified by the second state. The Compact provides for the expeditious provision of Federal and State criminal history records to governmental and nongovernmental agencies that use such records for noncriminal justice purposes authorized by pertinent Federal and State law, while simultaneously enhancing the accuracy of the records and safeguarding the information contained therein from unauthorized disclosure or use.

To carry out its responsibilities under the Compact, the Compact Council is authorized under Article III and Article VI to establish III System rules, procedures, and standards concerning record dissemination and use, response times, data quality, system security, accuracy, privacy protection and other aspects of III System operation for noncriminal justice purposes. Access to records is conditional upon the submission of the subject's fingerprints or other approved forms of positive identification with the record check request as set forth in Article V of the Compact. Further, any record obtained under the Compact may be used only for the official purposes for which the record was requested.

Article III(a) of the Compact requires the Director of the FBI to appoint a Compact Officer (herein referred to as the FBI Compact Officer) to administer the Compact within the Department of Justice (DOJ) and among Federal agencies and other agencies and organizations that submit search requests to the FBI and to ensure that Compact provisions and Compact Council rules, procedures, and standards are complied with by DOJ and other Federal agencies and other agencies and organizations. Article III(b) requires each Party State to appoint a Compact Officer (herein referred to as the State Compact Officer) who shall administer the Compact within the state, ensure that Compact provisions and Compact Council rules, procedures, and standards are complied with, and regulate the in-state use of records received by means of the III System from the FBI or from other Party States.

Background

Pursuant to Articles VI and XI respectively, the Compact Council has the authority to promulgate rules and procedures governing the use of the III system for noncriminal justice purposes and has the initial authority to make determinations with respect to any dispute regarding interpretation of the Compact, any rule or standard established by the Compact Council pursuant to Article VI of the Compact, and any dispute or controversy between any parties to the Compact. Based upon its authority under the Compact, the Compact Council may impose appropriate sanctions against agencies that do not operate in accordance with the Compact and rules and procedures promulgated by the Compact Council.

The Compact Council is establishing this rule to protect and enhance the accuracy and privacy of III System records, to ensure that only authorized access to records is permitted, and to ensure that records are used and disseminated only for particular authorized noncriminal justice purposes. The procedures established by the rule will be used in determining compliant conduct and responsible use of III System records and in addressing any violations that may be detected.

This rule acts as public notice that unauthorized access to the III System for noncriminal justice purposes or misuse of records obtained by means of the System for such purposes may result in the imposition of sanctions by the Compact Council, which may include the suspension of noncriminal justice access to the III System should the violation be found egregious or constitute a serious risk to the integrity of the System.

The Compact requires the FBI Director to appoint an FBI Compact Officer to ensure that federal agencies comply with rules, procedures, and standards established by the Compact Council but does not directly address the FBI's responsibility to ensure state compliance. The Act adopting the Compact, however, provides that all United States departments and agencies shall enforce the Compact and cooperate with one another and with all Party States in enforcing the Compact and effectuating its purposes. Pursuant to this direction and authority, the FBI Criminal Justice Information Services (CJIS) Division has agreed to regularly conduct systematic compliance reviews of state repositories and selected agencies for compliance with the Compact and Compact Council rules on use of the III System. The Compact Council established the audit team and approved the audit methodology that will be used to conduct periodic reviews of the FBI and agencies that submit record check requests to the FBI under federal authority. (For a copy of the FBI Audit Methodology, contact the FBI Compact Council Office). The Compact Council and its Sanctions Committee intend to work in concert with the CJIS Advisory Policy Board's (APB) Ad Hoc Sanctions Subcommittee to examine findings from FBI CJIS Division staff reviews and determine the proper arbiter over the sanctions process for each finding or instance of violation. The APB will continue to serve in its role as an advisor to the FBI, which has exclusive jurisdiction in matters regarding the use of the III System for criminal justice purposes. This advisory capacity includes recommending sanctions to the FBI Director related to violations by criminal justice agencies using the III System for criminal justice purposes. If it is determined that a sanction should be imposed on a criminal justice agency for misusing the III System for a noncriminal justice purpose, the Compact Council will request that the Director of the FBI take appropriate action.

In determining applicable actions or sanctions for noncompliance with Compact provisions or Compact Council rules, the Compact Council shall take into consideration: (1) Any meritorious, unusual or aggravating circumstances which affect the seriousness of the violation; (2) circumstances that could not reasonably have been foreseen by the FBI, state repository, user agency, or others; and (3) the nature and seriousness of the violation, including whether it was intentional, technical, inadvertent, committed maliciously, committed for gain, or repetitive. A pattern or practice of noncompliance by an agency may be grounds for the imposition of sanctions. The Compact Council may evaluate relevant documentary evidence available from any source.

If, as a result of a compliance review or on the basis of other credible information, the Compact Council determines that an agency is not operating in accordance with the Compact and applicable rules, procedures, and standards, prompt notice will be given of the nature of the noncompliance and the possible consequences of failure to take effective corrective action. A concerted effort will be made to persuade the offending agency to comply voluntarily. Efforts to secure voluntary compliance will be undertaken at the outset in every noncompliance situation and will be pursued through each stage of corrective action. However, where a noncompliant agency fails to provide adequate assurance of compliance or apparently breaches the terms of such assurance, the Compact Council will take the appropriate actions which could include imposing sanctions or requiring corrective action necessary to ensure compliance. The Compact Council will be flexible in determining what corrective actions or sanctions are appropriate and generally will require the minimal action or impose the least severe sanction necessary to ensure compliance and deter violations.

Administrative Procedures and Executive Orders

Administrative Procedure Act

This rule is published by the Compact Council as authorized by the National Crime Prevention and Privacy Compact (Compact), an interstate and Federal-State compact which was approved and enacted into legislation by Congress pursuant to Pub. L. 105-251. The Compact Council is composed of 15 members (with 11 State and local governmental representatives).

The Compact Council is not a federal agency as defined in the Administrative Procedure Act. Accordingly, rulemaking by the Compact Council pursuant to the Compact is not subject to the Act. However, the Compact specifically provides that the Compact Council shall prescribe rules and procedures for the effective and proper use of the Interstate Identification Index (III) System for noncriminal justice purposes, and mandates that such rules, procedures, or standards established by the Compact Council be published in the Federal Register. See 42 U.S.C. 14616, Articles II(4), VI(a)(1), and VI(e). This publication complies with those requirements.

Executive Order 12866

The Compact Council is not an executive department or independent regulatory agency as defined in 44 U.S.C. 3502; accordingly, Executive Order 12866 is not applicable.

Executive Order 13132

The Compact Council is not an executive department or independent regulatory agency as defined in 44 U.S.C. 3502; accordingly, Executive Order 13132 is not applicable. Nonetheless, this rule fully complies with the intent that the national government should be deferential to the States when taking action that affects the policymaking discretion of the States.

Executive Order 12988

The Compact Council is not an executive agency or independent establishment as defined in 5 U.S.C. 105; accordingly, Executive Order 12988 is not applicable.

Unfunded Mandates Reform Act

Approximately 75 percent of the Compact Council members are representatives of state and local governments; accordingly, rules prescribed by the Compact Council are not Federal mandates. No actions are deemed necessary under the provisions of the Unfunded Mandates Reform Act of 1995.

Small Business Regulatory Enforcement Fairness Act of 1996

The Small Business Regulatory Enforcement Fairness Act (title 5, U.S.C. 801-804) is not applicable to the Compact Council's rule because the Compact Council is not a “Federal agency” as defined by 5 U.S.C. 804(1). Likewise, the reporting requirement of the Congressional Review Act (subtitle E of the Small Business Regulatory Enforcement Fairness Act) does not apply. See 5 U.S.C. 804.

List of Subjects in 28 CFR Part 907

• Privacy
• Accounting
• Auditing

For the reasons set forth above, the National Crime Prevention and Privacy Compact Council proposes to reserve parts 903, 904, and 905 and add part 907 to chapter IX of title 28 Code of Federal Regulations to read as follows:

PART 907—COMPACT COUNCIL PROCEDURES FOR COMPLIANT CONDUCT AND RESPONSIBLE USE OF THE INTERSTATE IDENTIFICATION INDEX (III) SYSTEM FOR NONCRIMINAL JUSTICE PURPOSES

907.1

Purpose and authority.

907.2

Applicability.

907.3

Assessing compliance.

907.4

Methodology for resolving noncompliance.

907.5

Sanction adjudication.

Authority: 42 U.S.C. 14616.

§ 907.1

Purpose and authority.

The purpose of this part 907 is to establish policies and procedures to ensure that use of the III System for noncriminal justice purposes complies with the National Crime Prevention and Privacy Compact (Compact) and with rules, standards, and procedures established by the Compact Council regarding application and response procedures, record dissemination and use, response times, data quality, system security, accuracy, privacy protection, and other aspects of III System operation for noncriminal justice purposes. The rule is established pursuant to Article VI of the Compact, which authorizes the Compact Council to promulgate rules, procedures, and standards governing the use of the III System for noncriminal justice purposes. The rule requires responsible authorized access to the System and use of records obtained by means of the System. It provides a comprehensive procedure for a coordinated compliance effort among the Compact Council, the FBI, and local, state and federal government agencies, and encourages the cooperation of all affected parties.

§ 907.2

Applicability.

This rule applies to access to the III System for noncriminal justice purposes as covered by the Compact, See 42 U.S.C. 14614 and 14616, and the use of information obtained by means of the System for such purposes. The rule establishes procedures for ensuring that the FBI and the criminal history record repositories of Compact Party States carry out their responsibilities under the Compact, as set out in the National Fingerprint File (NFF) Qualification Requirements, and that federal, state and local agencies that use the III System for noncriminal justice purposes comply with the Compact and with applicable Compact Council rules.

§ 907.3

Assessing compliance.

(a) The FBI CJIS Division staff shall regularly conduct systematic compliance reviews of state repositories. These reviews may include, as necessary, reviews of III System user agencies, including governmental and nongovernmental noncriminal justice entities that submit fingerprints to the state repositories and criminal justice and noncriminal justice entities with direct access to the III System. These reviews may include, as necessary, the governmental and nongovernmental noncriminal justice agencies authorized to submit fingerprints directly to the FBI. The reviews may consist of systematic analyses and evaluations, including on-site investigations, and shall be as comprehensive as necessary to adequately ensure compliance with the Compact and Compact Council rules. Violations may also be reported or detected independently of a review.

(b) The FBI CJIS Division staff or the audit team established to review the FBI shall prepare a draft report describing the nature and results of each review and setting out all findings of compliance and noncompliance, including any reasons for noncompliance and the circumstances surrounding the noncompliance. If the agency under review is the FBI or another federal agency, the draft report shall be forwarded to the FBI Compact Officer. If the agency under review is a state agency in a Party State, the draft report shall be forwarded to the State Compact Officer. If the agency under review is a state agency in a Nonparty State, the draft report shall be forwarded to the chief administrator of the state repository.

(c) The Compact Officer of the FBI or a Party State or the chief administrator of the state repository in a Nonparty State shall be afforded the opportunity to forward comments and supporting materials to the FBI CJIS Division staff or to the audit team.

(d) The FBI CJIS Division staff or the audit team shall review any comments and materials received and shall incorporate applicable revisions into a final report. The final report shall be provided to the Compact Officer of the FBI or a Party State or the chief administrator of the state repository in a Nonparty State to whom the draft report was sent. If the agency under review is a state agency, a copy of the report shall be provided to the FBI Compact Officer. If the agency under review is being reviewed for the first time, the letter transmitting the report shall provide that sanctions will not be imposed regarding any deficiencies set out in the report. The letter shall also advise, however, that the deficiencies must be remedied and failure to do so before the agency is reviewed again will result in the initiation of remedial action pursuant to § 907.4.

§ 907.4

Methodology for resolving noncompliance.

(a) Subsequent to each compliance review that is not a first-time agency review, the final report shall be forwarded to the Compact Council Sanctions Committee (Sanctions Committee). The Sanctions Committee shall review the report and if it concludes that no violations occurred or no violations occurred that are serious enough to require further action, it shall so advise the Compact Council Chairman. The Compact Council Chairman shall send a letter to this effect to the FBI or Party State Compact Officer or the chief administrator of the state repository in a Nonparty State which has executed a Memorandum of Understanding. For all remaining states, the FBI Director or Designee shall send the letter to the chief administrator of the state repository. If the agency under review is a state agency, a copy of the letter shall be provided to the FBI Compact Officer.

(b) Should the Sanctions Committee conclude that a violation has occurred that is serious enough to require redress, the Sanctions Committee shall recommend to the Compact Council a course of action necessary to bring the offending agency into compliance and require the offending agency to provide assurances that subsequent violations will not occur. In making its recommendation, the Sanctions Committee shall consider the minimal action necessary to ensure compliance or shall explain why corrective action is not required. This may include, but not be limited to, requiring a plan of action by the offending agency to achieve compliance, with benchmarks and performance measures, and/or requiring the agency to seek technical assistance to identify sources of the problem and proposed resolutions. If the Compact Council approves the Sanctions Committee's recommendations, the following progressive actions shall be initiated:

(1) The Compact Council Chairman shall send a letter to the Compact Officer of the FBI or Party State or the chief administrator of the state repository in a Nonparty State which has executed a Memorandum of Understanding. For all remaining states, the FBI Director or Designee shall send the letter to the chief administrator of the state repository. The letter shall identify the violations and set out the actions necessary to come into compliance. The letter shall provide that if compliance is not achieved and assurances provided that minimize the probability that subsequent violations will occur, and non-compliance is not excused, the Compact Council may authorize the FBI to refuse to process requests for criminal history record checks for noncriminal justice purposes from the offending agency and, if the offending agency is a criminal justice agency, may request the Director of the FBI to take appropriate action against the offending agency consistent with the recommendations of the Compact Council. The letter shall direct the Compact Officer of the FBI or Party State or the chief administrator of the state repository in a Nonparty State to submit a written response within 30 calendar days from the date of the letter, unless a more expeditious response is required. If the offending agency is a state agency, a copy of the letter shall be provided to the FBI Compact Officer. Written responses from the FBI, Party States, and Nonparty States that have executed a Memorandum of Understanding shall be sent to the Compact Council Chairman. The written response for all remaining states shall be sent to the FBI Director or Designee. The offending agency's response letter shall go to the Compact Officer of the FBI or Party State or the chief administrator of the state repository in a Nonparty State and shall outline the course of action it will undertake to correct the deficiencies and provide assurances that subsequent violations will not recur. Response letters that are received by the FBI Director or Designee shall be made available to the Compact Council Chairman. The Compact Council Chairman shall refer the response to the Sanctions Committee for appropriate action.

(2) If the Sanctions Committee deems the response letter under paragraph (b)(1) of this section to be insufficient, or if no response is received within the allotted time, the Sanctions Committee shall report its finding to the Compact Council. If the Compact Council agrees with the Sanctions Committee's finding, it shall direct the Compact Council Chairman to send a letter to the Director of the FBI (if the offending agency is the FBI or another federal agency) or to the head of the state agency in which the state repository resides (if the offending agency is a state agency), requesting assistance in correcting the deficiencies. The letter shall provide that the offending agency is being placed on probationary status. A copy of the letter shall be sent to the Compact Officer of the FBI or Party State or the chief administrator of the state repository in a Nonparty State. If the offending agency is a state agency, a copy of the letter shall be provided to the FBI Compact Officer. The offending agency's written response to the letter shall be required within 20 calendar days from the date of the letter unless the Compact Council requires a more expeditious response. The Compact Council Chairman shall refer the response letter to the Sanctions Committee for appropriate action.

(3) If the Sanctions Committee deems the response letter under paragraph (b)(2) of this section to be insufficient, or if no response is received within the allotted time, the Sanctions Committee shall report its finding to the Compact Council. If the Compact Council agrees with the Sanctions Committee's finding, it shall direct the Compact Council Chairman to send a letter to the U.S. Attorney General (if the offending agency is the FBI or another federal agency) or to the elected/appointed state official who has oversight of the department in which the state repository resides (if the offending agency is a state agency), requesting assistance in correcting the deficiencies. If the state official is not the Governor, a copy of the letter shall be sent to the Governor. A copy of the letter shall also be sent to the FBI Compact Officer and (if the offending agency is a state agency) to the State Compact Officer or the chief administrator of the state repository in a Nonparty State. The letter shall provide that a written response is required within 20 calendar days of the date of the letter, and that if a sufficient response is not received within that time, sanctions may be imposed that could result in suspension of the offending agency's access to the III System for noncriminal justice purposes. The Compact Council Chairman shall refer the response letter to the Sanctions Committee for appropriate action.

(4) If no response letter is received under paragraph (b)(3) of this section within the allotted time, or if the Sanctions Committee deems the response to be insufficient, the Sanctions Committee shall report its finding to the Compact Council. If the Compact Council agrees with the Sanctions Committee's finding, the Compact Council Chairman shall direct the FBI Compact Officer to take appropriate action to suspend noncriminal justice access to the III System by the offending agency. If the offending agency is a criminal justice agency, the Compact Council Chairman shall request the Director of the FBI to take appropriate action to suspend noncriminal justice access to the III System by the offending agency.

(5) Reinstatement of full service by the FBI shall occur after the Compact Officer of the FBI or a Party State or the chief administrator of the state repository in a Nonparty State provides to the Compact Council Chairman and the Sanctions Committee satisfactory documentation that the deficiencies have been corrected or a process has been initiated and approved by the Sanctions Committee and the Compact Council Chairman to correct the deficiencies. If the Sanctions Committee approves the documentation in consultation with the Compact Council Chairman, the Compact Council Chairman shall request the FBI Compact Officer to take appropriate action to reinstate full service. Letters to this effect shall be sent to all persons who have previously received letters relating to the deficiencies and resulting suspension of service. The decision to reinstate full service shall be considered for ratification by the Compact Council at its next regularly scheduled meeting.

(c) For good cause, the Compact Council Chairman shall be authorized to extend the number of days allowed for the response letters required by paragraphs (b) (1) through (3) of this section.

§ 907.5

Sanction adjudication.

A Compact Officer of the FBI or a Party State or the chief administrator of the state repository in a Nonparty State may dispute a sanction under this Part by asking the Compact Council Chairman for an opportunity to address the Compact Council.

Unresolved disputes based on the Compact Council's issuance of sanctions under this Part may be referred to the Compact Council Dispute Adjudication Committee when pertaining to disputes described under ARTICLE XI(a) of the Compact.

Nothing prohibits the Compact Council from requesting the FBI to exercise immediate and necessary action to preserve the integrity of the III System pursuant to Article XI(b) of the Compact.

Dated: January 28, 2005.

Donna M. Uzzell,

Compact Council Chairman.