[Federal Register Volume 61, Number 139 (Thursday, July 18, 1996)]
[Notices]
[Pages 37495-37498]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 96-18328]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF JUSTICE
[AAG/A Order No. 119-96]
Privacy Act of 1974; New System of Records
Pursuant to the provisions of the Privacy Act (5 U.S.C. 552a) and
Office of Management and Budget Circular No. A-130, notice is hereby
given that the Department of Justice proposes to establish a new system
of records to be maintained by the Federal Bureau of Investigation.
The National DNA Index System (NDIS) (JUSTICE/FBI-017) is a new
system of records for which no public notice consistent with the
provisions of 5 U.S.C. 552a(e) (4) and (11) has been published in the
Federal Register.
In order to comply with 5 U.S.C. 552a(e) (4) and (11), the public
must be given a 30-day period in which to comment on new routine use
disclosures; and the Office of Management and Budget (OMB), which has
oversight responsibility under the Act, requires a 40-day period in
which to review the system before it is implemented. Therefore, the
public, the OMB, and the Congress are invited to submit written
comments to Patricia E. Neely, Program Analyst, Information Management
and Security Staff, Information Resources Management, Department of
Justice, Washington, DC 20530 (Room 850, WCTR Building). Comments from
the public must be received by August 19, 1996. No further notice will
appear in the Federal Register unless comments are received and
publication pursuant thereto is deemed appropriate. A proposed rule to
exempt the system is also being published in the ``Proposed Rules''
Section of today's Federal Register.
In accordance with Privacy Act requirements, the Department of
Justice has provided a report on the proposed system of records to OMB
and the Congress.
Dated: July 8, 1996.
Stephen R. Colgate,
Assistant Attorney General for Administration.
JUSTICE/FBI-017
System name:
National DNA Index System (NDIS).
System location:
Federal Bureau of Investigation: FBI Laboratory, U.S. Department of
Justice, J. Edgar Hoover Building, 935 Pennsylvania Ave., NW.,
Washington, DC 20535-0001.
Categories of individuals covered by the system:
Individuals in this system include persons designated by criminal
justice agencies as belonging to one or more of the following groups:
A. Convicted offenders: Persons who have been convicted of crimes
in Federal, State, and/or local courts where the applicable law permits
establishment of a DNA record for the convicted person.
B. Missing persons and their close biological relatives: Persons
reported missing or whose whereabouts are unknown and sought and their
close biological relatives, such as parents, siblings, and children.
C. Victims: Persons, living or dead, who have been victims of
crimes where the perpetrator of the crime may have
[[Page 37496]]
carried DNA of the victim away from the crime scene.
D. DNA personnel: Personnel in Federal, State, and/or local
criminal justice agencies who perform duties related to or are
responsible for DNA records.
Categories of records in the system:
The following definitions are used in this notice:
A. A DNA sample is a body tissue or fluid sample usually a blood
and/or buccal sample, that can be subjected to DNA analysis.
B. A DNA profile consists of a set of DNA identification
characteristics, i.e., the particular chemical form at the various DNA
locations (loci), which permit the DNA of one person to be
distinguishable from that of another person.
C. A target DNA profile is a DNA profile submitted by a criminal
justice agency for the purpose of identifying DNA profiles maintained
by NDIS which match the target DNA profile.
D. A target DNA profile search is a search of appropriate NDIS DNA
records for those records with DNA profiles that may match the target
DNA profile.
E. Personally identifiable information is information such as
names, dates of birth, or social security numbers which are normally
used to identify individuals. Personally identifiable information, as
used in this notice, does not include information derived from the
examination of a DNA sample.
F. A DNA record includes the DNA profile as well as data required
to manage and operate NDIS, i.e., the NDIS Agency identifier which
serves to identify the submitting agency; the NDIS Specimen
Identification Number; information related to the reliability and
maintainability of the DNA profiles; and names of the participating
laboratories and DNA personnel associated with DNA profile analyses.
Records in this system do not include DNA samples but do include
DNA profiles of persons described under ``Categories of Individuals
Covered by the System'' in paragraph A-C. DNA records are input by
criminal justice agencies for use by the NDIS. NDIS includes the names
of DNA personnel associated with DNA profile analyses, the date after
which DNA records from a given DNA analyst can be accepted, and, when
applicable, the date after which associated DNA records are not
accepted. NDIS does not contain case-related or other personally
identifying information about the person from whom the DNA sample was
collected.
DNA records are maintained as follows:
1. The Convicted Offender Index, consisting of DNA records from
convicted offenders;
2. The Missing Persons Index, consisting of DNA records from
missing persons;
3. The Close Biological Relatives Index, consisting of DNA records
from close biological relatives of missing persons;
4. The Unidentified Persons Index, consisting of DNA records from
recovered living persons (e.g., children who can't and others who can't
or refuse to identify themselves), and recovered dead persons
(including their body parts and tissues), whose identities are not
known;
5. The Victims Index, consisting of DNA records from victims,
living or dead, from whom DNA may have been carried away by
perpetrators;
6. The Forensic Index, consisting of DNA records from persons whose
identities are not known with certainty and who left DNA at the scene
of a crime or whose DNA was carried away from it; and
7. The Population File, consisting of DNA profiles intended to
represent various population segments found in the United States. The
Population File consists of DNA records from individuals whose
identities may be: (a) Known to; (b) not known, but determinable under
some circumstances by; or (c) not known and not determinable by the
criminal justice agency submitting the DNA records to NDIS.
Authority for maintenance of the system:
The Violent Crime Control and Law Enforcement Act of 1994, Pub. L.
No. 103-322, 108 Stat. 1796.
Purpose(s):
The purpose of this system and the DNA records maintained in the
system is to provide a national storage medium for DNA records input by
criminal justice agencies. These records can be searched in order to
identify DNA associations with a DNA record obtained during an
investigation of a crime or a missing person. The system is also
maintained for statistical, identification research, and protocol
development and quality control purposes.
In addition to DNA records, records about DNA personnel are
maintained in the system. The purposes of these DNA personnel records
are to control the acceptance of DNA records by NDIS and to facilitate
criminal justice agency contracts required to resolve potential DNA
matches.
Routine uses of records maintained in the system, including categories
of users and the purposes of such uses:
1. Direct disclosures of NDIS records are made to the Federal,
State, and local criminal justice agencies who participate in NDIS. As
a result of an NDIS search by a criminal justice agency, the NDIS
system analyzes the target DNA profile entered by the search agency and
may identify a potential match. Where NDIS identifies a potential
match, the matching DNA's records will be disclosed to the criminal
justice agencies associated with the match.
2. The Federal statute which authorizes NDIS also provides that the
FBI and other criminal justice agencies participating in NDIS may make
secondary or indirect disclosures of DNA records:
(A) To criminal justice agencies for law enforcement identification
purposes;
(B) In judicial proceedings, if otherwise admissible pursuant to
applicable statutes or rules;
(C) For criminal defense purposes, to a defendant, who shall have
access to samples and analyses performed in connection with the case in
which defendant is charged; or
(D) If personally identifiable information is removed, for a
population statistics database, for identification research and
protocol development purposes, or for quality control purposes.
Note: Personal information such as names are not found in NDIS.
However, operational identifiers such as the Specimen No., Criminal
Justice Agency Identifier, and DNA Personnel identifier, are
contained in NDIS. Although unlikely, the identity of an individual
could, under some circumstances, be ascertained with the disclosure
of such numbers for purposes stated in (D) above. This is only
possible when access to a criminal justice agency's records is
provided to the holder of the operational identifiers. Therefore, to
ensure that such associations are not made, these operational
numbers will be removed before disclosure for these purposes.
3. A record may be disclosed from this system of records to the
National Archives and Records Administration and the General Services
Administration in records management inspections conducted under the
authority of 44 U.S.C. 2904 and 2906, to the extent that legislation
governing the records permits.
[[Page 37497]]
Policies and practices for storing, retrieving, accessing, retaining,
and disposing of records in the system:
Storage:
Information maintained in NDIS is stored electronically for use in
a computer environment.
Retrievability:
The primary method for retrieving information from NDIS is the
target DNA profile search described in the routine use disclosure
provisions of this notice.
The NDIS Custodian may retrieve records based on: the DNA profile,
the NDIS Agency identifier, the NDIS Specimen Identification Number,
and/or DNA personnel identifier. Criminal justice agencies with direct
access to NDIS may retrieve their records by the NDIS Agency
identifier, NDIS Specimen Identification Number, or DNA personnel
identifier but only to inspect, modify, or delete their own DNA
records.
Since NDIS records contained in NDIS do not include personal
identifiers of the individuals from whom the DNA samples were
collected, retrieval by personal identifiers of these record subjects
is not possible.
Safeguards:
All records in NDIS are protected from unauthorized access through
appropriate administrative, physical, and technical safeguards. These
safeguards include restricting access to those with a need-to-know to
perform their official duties, using locks and alarm devices, and
encrypting data communications.
No personally identifiable information about individuals who
provided DNA samples is maintained in NDIS. Therefore, names and
personally identifiable information of NDIS DNA records cannot be
disclosed directly from NDIS. (NDIS does, however, maintain the names
of NDA personnel.)
NDIS will disclose to a criminal justice agency the DNA records of
another criminal justice agency only when there is a potential DNA
match. Any additional disclosures of personally identifiable
information or other case-related data are made directly by the
criminal justice agencies from their own files and records, not from
NDIS.
Although ostensibly devoid of personally identifiable information,
DNA records in NDIS contain an NDIS Specimen Identification Number,
NDIS Agency identifier, and a DNA personnel identifier for law
enforcement and/or general operational purposes. Since it is possible,
in some circumstances, to use those numbers together with the
appropriate agency's own records to identify the individuals
represented by the DNA records, additional precautions are taken.
The precautions involve removal of the Specimen Identification
Numbers, NDIS Agency identifiers, and DNA personnel identifiers, prior
to disclosure pursuant to the 2(D) routine use. (See the ``Routine Uses
of Records Maintained in the System'' section of this notice.) Thus,
NDIS will periodically generate DNA profile data sets, consisting of
anonymous DNA profiles, for population statistics databases, for
identification research and protocol development purposes, or for
quality control purposes.
Criminal justice agencies are prohibited from submitting a DNA
record for inclusion in the NDIS Population File for investigative
purposes. The only target DNA profile searches conducted against the
Population File are those necessary to eliminate duplicate DNA profiles
representing the same individual.
Finally, criminal justice agencies with direct access to NDIS must
agree to adhere to national quality assurance standards for DNA
testing, undergo semi-annual external proficiency testing, and restrict
access to DNA samples and data. The NDIS will not accept DNA analyses
from those agencies and/or DNA personnel who fail to comply with these
standards and restrictions; and the NDIS Custodian is authorized to
restrict access to and delete any DNA records previously entered into
the system.
Retention and Disposal:
DNA records generated by criminal justice agencies, together with
the personal identifying information of DNA personnel, shall be
retained in NDIS as long as they are substantiated by internal records
of the submitting agency and are permitted either by consent, by
judicial/criminal justice authority, or by Federal, State, or local
law. Records may be deleted by the originating criminal justice agency
or by other Federal, State, or local authorities who are responsible
for deleting any records that are no longer permitted or appropriate
for retention in NDIS. DNA records submitted to NDIS and then found to
be inaccurate shall either be modified to achieve accuracy or deleted
from NDIS by the submitting agency.
Agencies granted access to NDIS are required to establish and
maintain a system of controls to ensure that continued use of their DNA
records in NDIS is lawfully permitted. Such a system of controls shall
ensure that DNA records in NDIS which are authorized by the consent of
individuals, for example, are retained in NDIS only for the duration
and within the scope of the consent.
The NDIS Custodian has the authority to determine that certain DNA
records in NDIS should be deleted or, alternatively, suspended from use
for a period of time determined appropriate by the NDIS Custodian. The
criminal justice agencies whose records are affected by a determination
to delete or suspend records in NDIS shall be notified of this
determination and the nature of the deletion or suspension. The NDIS
Custodian may subsequently decide to either restore or delete the
suspended records, and shall notify the affected agency of this
subsequent determination.
The DNA personnel identifier for a single individual is deleted
from NDIS only after all DNA records associated with that individual
are deleted.
System manager(s) and address:
Director, Federal Bureau of Investigation, c/o National DNA Index
System Custodian, FBI Laboratory, U.S. Department of Justice, J. Edgar
Hoover Building, 935 Pennsylvania Avenue, NW., Washington, DC 20535-
0001.
Notification procedure:
None. This system of records has been exempted from subsections (d)
and (e)(4)(G) pursuant to subsection (j)(2) of the Privacy Act, and
thus is exempt from the notification provision.
Records access procedure:
This system of records has been exempted from subsection (d) and
(e)(4)(H) pursuant to subsection (j)(2) of the Privacy Act, and thus is
exempt from its access provisions. NDIS does not retain information
that would allow the NDIS Custodian, independent of the agency which
originated the DNA record, to personally identify the record by name or
other personal identifier. However, subject to applicable Federal,
State, and local law and procedures, the following alternative
procedures are available by which an individual may request access to
records in NDIS.
1. Subjects of DNA Records:
a. Convicted Offender Records: The individual may contact the
Federal, State or local authority (the authorized agency) which
ultimately received the collected DNA sample to obtain instructions on
how to access his/her record. The authorized agency has the DNA record,
if one exists, including information as to whether the DNA record has
been submitted to NDIS. Only the authorized agency would have
information sufficiently specific to
[[Page 37498]]
permit retrieval of the record from its files by name or other
personally identifiable information. The authorized agency may also
retrieve the DNA record, if any, that was submitted to NDIS, once
locally specified requirements are met.
In addition, where a convicted offender is relocated voluntarily or
involuntarily to a criminal justice agency (i.e., penal institution or
parole and probation authorities) for custodial or supervisory purposes
in another State or jurisdiction, the DNA record may be created by the
new host criminal justice agency or other State (or Federal) authority
from a DNA sample collected from the Convicted Offender at the new host
criminal justice agency or other State (or Federal) authority. In such
circumstances, the individual may contact such agency or authority for
access instructions.
b. Close Biological Relatives of Missing Persons and Victims;
Living Victims; and Missing Persons Who Have Been Located: These
individuals must contact the criminal justice agency (Federal, State,
or local) which collected and processed the DNA sample to generate the
DNA record. The criminal justice agency can then advise the individual
about procedures for access to the DNA record. Such agency may also
retrieve the DNA record, if any, that was submitted to NDIS, once
locally specified requirements are met.
2. Records of DNA Personnel: These individuals may write to the
Federal, State, or local criminal justice agency by which they are or
were employed.
3. FBI generated records: The subject of an FBI-generated DNA
record may address a Freedom of Information/Privacy Act (FOIA/PA)
request to the Director, FBI, at the address given at the end of this
paragraph. DNA personnel employed by the FBI may also address their
requests to the system manager; however, all the information in NDIS
concerning DNA personnel is also contained in the FBI's Central Records
System (CRS), which may contain additional information. To request
access to the CRS, DNA personnel may address an FOIA/PA request to the
Director, FBI, U.S. Department of Justice, J. Edgar Hoover Building,
935 Pennsylvania Ave., NW., Washington, DC 20535-0001.
Contesting records procedure:
This system of records has been exempted from subsections (d) and
(e)(4)(H) pursuant to subsection (j)(2) of the Privacy Act, and is thus
exempt from its amendment and correction provisions. However, subject
to applicable Federal, State, and local laws and procedures, the
following alternative procedures are available by which an individual
may contest his/her records:
1. All Subjects of DNA Records: The requester must follow the same
procedures for contesting records as those outlined under ``Record
Access Procedures.'' In addition, the requester should be aware of the
following:
a. DNA records submitted to NDIS and contested on the basis of
inaccurate information must be resolved with the criminal justice
agency that submitted the DNA record NDIS. If a contested DNA record is
found to be inaccurate by the criminal justice agency submitting the
DNA record, such agency shall correct the inaccurate DNA record by
either amending or deleting the record.
b. DNA records submitted to NDIS and contested on the basis of the
authority to retain the DNA record must be resolved with the criminal
justice agency that submitted the contested DNA record. If such agency
determines that the contested DNA records should not be included in
NDIS, such agency must delete the contested DNA record.
2. Records of All DNA Personnel: DNA personnel must follow the same
procedures for contesting records as those outlined under ``Record
Access Procedures.''
record source categories:
DNA records in NDIS are received from Federal, State, and local
criminal justice agencies. These DNA records may be derived from DNA
samples obtained by Federal, State, and local and criminal justice
agencies or their agents (public or private).
Systems exempted from certain provisions of the Act:
The Attorney General has exempted this system of records from
subsection (c) (3) and (4); (d); (e) (1), (2), and (3); (e)(4) (G) and
(H); (e) (5) and (8); and (g) of the Privacy Act pursuant to 5 U.S.C.
552a(j)(2). Rules are being promulgated in accordance with the
requirements of 5 U.S.C. 553 (b), (c), and (e); and are being published
in the Federal Register.
[FR Doc. 96-18328 Filed 7-17-96; 8:45 am]
BILLING CODE 4410-02-M
