Medical and Public Health Law Site
Opinions of the Office of Legal Counsent - DOJ
ACCESS TO CRIMINAL HISTORY RECORDS BY NON-GOVERNMENTAL ENTITIES
PERFORMING AUTHORIZED CRIMINAL JUSTICE FUNCTIONS
Non-governmental entities performing authorized criminal justice functions under contract with government law enforcement agencies may be granted access to criminal history records maintained under the authority of 28 U.S.C. § 534, subject to effective controls to guard against unauthorized use and to insure effective oversight by the Department of Justice.
Because Department of Justice regulations implementing 28 U.S.C. § 534 do not affirmatively authorize dissemination of criminal history records to non-governmental entities under contract to assist law enforcement agencies, those regulations should be amended to provide such authorization before access is granted to those entities.
June 12, 1998
LETTER OPINION FOR THE DEPUTY DIRECTOR OF THE FEDERAL BUREAU OF INVESTIGATION
This responds to your request for our legal opinion concerning the circumstances in which non-governmental entities performing criminal justice functions under contract with government law enforcement agencies may be granted access to criminal history records information ("CHRI") subject to the provisions of 28 U.S.C. § 534 (1994). (1) We conclude that the Attorney General, or her delegee, (2) may permit such access in appropriate circumstances under § 534. Should the Attorney General decide to do so, we believe that the governing regulation, 28 C.F.R. pt. 20 (1997), should be amended in accordance with the rulemaking requirements of the Administrative Procedure Act ("APA"), see 5 U.S.C. § 553 (1994), for the reasons discussed below. Finally, any proposal to permit contractor access to CHRI must incorporate effective controls to guard against unauthorized use or release of CHRI by the contractors and to insure that the Department can maintain effective oversight.
I. Section 534 directs the Attorney General to "acquire, collect, classify, and preserve identification, criminal identification, crime, and other records" and to "exchange such records and information with, and for the official use of, authorized officials of the Federal Government, the States, cities, and penal and other institutions." (3) 28 U.S.C. § 534(a)(1), (4). The statute thus requires the Attorney General to collect, maintain, and exchange criminal identification records with federal, state, and local criminal justice agencies. Although the statute does not expressly preclude such agencies from sharing these records with third parties, it provides that "[t]he exchange of records and information authorized by subsection (a)(4) of this section is subject to cancellation if dissemination is made outside the receiving departments or related agencies." Id. § 534(b). This office has previously construed the phrase "related agencies" to include only those agencies expressly authorized under § 534(a) to receive CHRI directly from the Department. See Memorandum to Files, from Mary C. Lawton, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Railroad Police Access to FBI Criminal Identification Records at 5 (June 22, 1978) ("Lawton Memo").
As we read the statute, it does not on its face forbid the government agencies that are authorized to receive CHRI from sharing it with private contractors assisting them in the performance of their duties. However, § 534(b) provides an enforcement mechanism that enables the Attorney General to oversee the use of CHRI by recipients. This statutory provision, which vests authority in the Attorney General to cancel CHRI exchange arrangements, contemplates that she may invoke that authority in order to guard against the improper use or redissemination of the CHRI that the FBI provides. Accordingly, as further discussed below, the statute would permit the Attorney General to authorize the disclosure of CHRI to private contractors performing criminal justice functions for government agencies that are authorized to receive CHRI, but any such authorization would have to impose controls on the recipients and their contractors to preserve the Attorney General's statutory oversight authority.
Rather than expressly prohibiting categories of CHRI disclosures, § 534(a)(4) merely limits mandatory CHRI exchanges to those that are for the "official use" of the designated "authorized officials." The text of § 534 does not address whether a private contractor acting under the direction, or on behalf, of such "authorized officials" could be said to be engaged in, enabling, or facilitating the "official use" of the CHRI by those officials.
On the other hand, § 534(b) pointedly discourages the "dissemination" of covered records outside "the receiving departments or related agencies," by providing that such dissemination "subject[s]" the noncompliant agency or department to possible cancellation of its exchange privileges under the statute. 28 U.S.C. § 534(b). Moreover, it is clear that this provision was intended "to protect the privacy of rap-sheet subjects,"Department of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 765 (1989), and should be applied in a manner consistent with this purpose. (4) Finally, as this office has previously observed, the only enforcement mechanism expressly authorized by § 534 is the Department's authority to cancel the direct recipient's authority to receive the information, and the statute should be construed to preserve this oversight authority. See Memorandum for Joseph H. Davis, Assistant Director, Legal Counsel Division, Federal Bureau of Investigation, from William P. Barr, Assistant Attorney General, Office of Legal Counsel, Re: Proposal by Federally Chartered or Insured Financial Institutions to Disseminate FBI Criminal History Record Information to CARCO Group, Inc. at 6-7 (Sept. 1, 1989) ("CARCO Memo"); Lawton Memo at 5. To the extent those recipients are permitted to disclose CHRI to their contractors, however, the Department's sole recourse under current regulations would be to rely on "the relationship between the local agency and the third party" to prevent abuses. Lawton Memo at 5. Thus, at least in the absence of effective controls over possible redissemination by the contractors, the Department's ability to limit the use of CHRI by recipients might be impaired if recipients were permitted to pass CHRI on to those contractors.
None of these considerations, however, compel a construction of the statute that precludes authorized criminal justice agencies from sharing CHRI with non-governmental contractors performing law enforcement functions where the arrangements are subject to appropriate controls. First, in providing that the exchange of CHRI is "subject to cancellation" if disseminated beyond the receiving agency or related agencies, Congress has delegated considerable discretion to the Attorney General to determine whether cancellation is appropriate in a given context. The statute does not require the Department to "terminate exchange relationships with users authorized under section 534(a)(1) if those users disseminate FBI criminal history records to unauthorized third parties." CARCO Memo at 6 n.12. This discretion would seem to carry with it the authority to determine that a particular class of disclosures -- i.e., those made to contractors for law enforcement purposes and subject to appropriate controls -- is consistent with the statutory purpose of facilitating law enforcement and not inconsistent with its purpose of protecting relevant privacy interests.
In addition, a strong argument can be made that disclosures of the sort contemplated would not constitute "dissemination" of the information, within the ordinary meaning of that word. Indeed, the dictionary defines "dissemination" to mean "to spread or send out freely or widely as though sowing or strewing seed: make widespread." Webster's Third International Dictionary 656 (1986). Sharing information with contractors who are assisting in law enforcement and who are subject to carefully drawn controls would not appear to fall within this definition. Moreover, although the meaning of the phrase "dissemination" may well vary based on context, (5) it is clear that, at a minimum, the Attorney General could exercise her regulatory authority to define the term in a manner that would permit disclosures to contractors who are assisting law enforcement and who are subject to appropriate controls. See Chevron U.S.A. Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984). Such an interpretation would be consistent with both the language and purpose of the statute.
Although opinions issued by this office have at times taken a restrictive view of § 534, see, e.g., Lawton Memo, we have not interpreted the term "dissemination" to encompass all disclosures of CHRI to non-governmental personnel. (6) Some of these opinions, however, have indicated that CHRI disclosures to non-governmental entities may be made only when the entity "is the only agency, public or private, performing a criminal justice function under public auspices." See Lawton Memo at n.5. In our view, these opinions overstate the statutory limitation on permissible disclosures made by authorized criminal justice agencies in this context. We believe that the proper interpretation is expressed in subsequent OLC opinions, which more aptly state that the receiving private entity must be one that "perform[s] quasi-governmental functions under strict governmental control." CARCO Memo at 4-5; Memorandum for Joseph H. Davis, Assistant Director, Legal Counsel, Federal Bureau of Investigation, from Douglas W. Kmiec, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Creation of a Public Registry of Law Enforcement Officers Killed in the Line of Duty at 2 (July 1, 1988).
Finally, to the extent the Department must retain the ability adequately to control the use of CHRI, and to cancel the privileges of those who make or permit improper disclosures, we note that regulatory measures may be developed that would serve this purpose, while still allowing contractors to access relevant information.
Accordingly, we believe that disclosure of CHRI to authorized criminal justice contractors would not be forbidden by the provisions of § 534 itself. If carefully controlled, moreover, such disclosures would also be compatible with the statutory purpose of facilitating law enforcement while protecting the privacy interests affected.
II. In addition to § 534 itself, however, it is necessary to consider the currently existing regulations that implement the statute. See 28 C.F.R. pt. 20 (1997) (governing "Criminal Justice Information Systems") ("Part 20" or "CJIS Regulations"). Subpart C of Part 20 applies to the CHRI systems maintained by the Department of Justice, other federal agencies, and by state and local criminal justice agencies insofar as they use the services of federal CHRI systems. See 28 C.F.R. § 20.30. The regulations provide that CHRI contained in systems maintained by the Department of Justice "will be made available":
(1) To criminal justice agencies for criminal justice purposes; and
(2) To Federal agencies authorized to receive it pursuant to Federal statute or Executive order.
(3) Pursuant to Public Law 92-544 (86 Stat. 1115) for use in connection with licensing or local/state employment or for other uses only if such dissemination is authorized by Federal or state statutes and approved by the Attorney General of the United States
. . . .
(4) For issuance of press releases and publicity designed to effect the apprehension of wanted persons in connection with serious or significant offenses.
Id. § 20.33(a). The regulations further provide, consistent with § 534(b), that an agency's right to receive CHRI "is subject to cancellation if dissemination is made outside the receiving departments or related agencies." Id. § 20.33(b).
Nothing in the Subpart C regulations authorizes the dissemination of CHRI to private entities acting on behalf of government criminal justice agencies. Closest is the authorization to disclose CHRI to "criminal justice agencies for criminal justice purposes," id. § 20.33(a)(1), but those agencies are expressly defined to include only "courts" and certain "government agencies [and] any subunit thereof," id. § 20.3(c). They do not include non-governmental agencies, even when under contract to perform criminal justice functions. Particularly when read in light of the regulatory purpose of protecting "individual privacy," id. § 20.1, it appears that section 20.33(a) was intended as an exhaustive list of the categories of authorized exchange for the covered records, and this office has previously construed the provision in this manner. (7) Thus, section 20.33(a) does not affirmatively authorize dissemination of CHRI to non-governmental entities under contract to assist federal, state or local law enforcement agencies.
A more difficult question is whether such disclosure of CHRI to private contractors, where subject to strict controls over the handling and use of the CHRI, would constitute a "dissemination" for purposes of the regulation. Although one might plausibly argue that it would not, see supra n.5 and accompanying text, for a number of reasons we believe that such disclosures should not be authorized without first amending the regulations. Although we cannot say with certainty that such an action is legally required, the risks of not doing so are substantial.
At the outset, we note that it is more difficult to construe the regulation's use of the word "dissemination" in a manner that would allow contractor access than the statute's use of the same word. In particular, Subpart B of the regulations, which sets forth the rules governing certain state and local (as opposed to federal) criminal history record information systems, expressly authorizes disclosure to "individuals and agencies pursuant to a specific agreement with a criminal justice agency to provide services required for the administration of criminal justice. . . ." 28 C.F.R. § 20.21(b)(3). Because no similar provision appears in Subpart C, which governs here, one might reasonably infer that such disclosures are not currently permitted under that provision.
Further, as noted in your memorandum of October 3, 1997, earlier opinions of this office have taken a restrictive view of the Department's authority to release CHRI to recipients not specifically identified in § 534, (8) and the Department historically has not permitted third-party access to CHRI. The courts have indicated that when an agency changes its interpretation of a regulation so fundamentally that it is equivalent to an amendment of the regulation, the change must be accomplished through notice-and-comment rulemaking. See Shalala v. Guernsey Memorial Hosp., 514 U.S. 87 (1995); Paralyzed Veterans of America v. D.C. Arena L.P., 117 F.3d 579, 586 (D.C. Cir. 1997).
Finally, by proceeding by notice-and-comment rulemaking, the Department will insure that its interpretation of § 534 receives the full weight of Chevron deference. Although the question is unsettled, a court might well provide less deference to an "interpretative" rule, which is not subject to formal rulemaking, than to a "legislative" rule, which is subject to the notice-and-comment process. (9) Compare Martin v. Occupational Safety & Health Review Comm'n, 499 U.S. 144, 157 (1991) (interpretative rules "not entitled to the same deference as norms that derive from the exercise of the Secretary's delegated lawmaking powers")(dicta) with Elizabeth Blackwell Health Center for Women v. Knoll, 61 F.3d 170, 182 (3d Cir. 1995) (Chevron deference is appropriate "even though the Secretary's interpretation is not contained in a 'legislative rule'"). Receiving full Chevron deference, moreover, may prove important to sustaining the Department's position in potential litigation.
In light of all these considerations, we believe that to proceed without first amending the regulations in accordance with the APA would invite significant legal challenge.
III. If a decision is made to amend the regulations to authorize provision of CHRI to criminal justice contractors, it is essential that this goal be achieved in a manner that will subject contractor access to effective controls against unauthorized use or further dissmenination. As the Supreme Court has observed, Congress intended that § 534 be applied in a manner that is protective of "the privacy of rap-sheet subjects." Reporters Comm. for Freedom of the Press, 489 U.S. at 749, 765. Moreover, § 534(b) provides for Department of Justice oversight of the dissemination of CHRI, by giving the Attorney General the authority to cancel the exchange of CHRI if an authorized dissemination is made. The Department's responsibility to protect the privacy of CHRI will require, in our view, that it have at its disposal the means of controlling the use of this information.
The precise form of such controls will depend upon a variety of factors. As a starting point, however, the Department might consider whether the provisions governing CHRI access agreements between states and criminal justice contractors set forth in Subpart B of the regulations would provide an appropriate model. The Subpart B regulations require that such agreements shall "limit the use of data to purposes for which given, insure the security and confidentiality of the data consistent with these regulations, and provide sanctions for violations thereof." 28 C.F.R. § 20.21(b)(3). We would, of course, be happy to consider whether any particular proposal satisfies statutory requirements.
Finally, we note that authorizing the provision of federal criminal history records to the entities in question would require compliance with the Privacy Act. See 5 U.S.C. § 552a. The criminal history records maintained by the FBI and provided through the NCIC are part of a system of records that is subject to the Privacy Act. Accordingly, covered agencies may not disclose such records to other agencies or institutions unless the subject of the records consents or one of the statute's exemptions apply. Id. § 552a(b). (10)
Here, the criminal justice or law enforcement uses for which the information would be provided would likely qualify for the issuance of a "routine use" exception to the Privacy Act's prohibitions against unconsented disclosures. See 5 U.S.C. § 552a(b)(3). A "routine use" means, with respect to the disclosure of a record, "the use of such record for a purpose which is compatible with the purpose for which it was collected." Id. § 552a(a)(7). We think that the uses of CHRI indicated in the examples you have submitted would generally be compatible with the law enforcement and related purposes for which it was collected by the FBI and other agencies. We have not undertaken, however, to determine whether these particular uses would qualify under any of the existing published routine uses applicable to the relevant systems of records. See, e.g., Privacy Act of 1974; Modified Systems of Records Notice (Fingerprint Identification Records System), 61 Fed. Reg. 6385 (1996); Privacy Act of 1974; Modified System of Records Notice (NCIC), 60 Fed. Reg. 19,774 (1995). Before actually authorizing the disclosure of CHRI to private criminal justice contractors, the Justice Department should issue any new routine use notifications necessary to cover the particular disclosures in question.
RANDOLPH D. MOSS Deputy Assistant Attorney General Office of Legal Counsel
1. Memorandum for Acting Assistant Attorney General, Office of Legal Counsel, from Robert M. Bryant, Deputy Director, FBI,Re: Access to and Dissemination of Information from the Department of Justice (DOJ) Criminal History Record Information (CHRI) System (Oct. 3, 1997) ("FBI Memo").
2. The Attorney General has delegated her CHRI exchange responsibilities to the Federal Bureau of Investigation ("FBI"). See 28 C.F.R. §§ 0.85(b) and 20.31(b).
3. The reference to "other institutions" does not generally provide for disclosure to non-governmental entities. See Memorandum for John Mintz, Legal Counsel, Federal Bureau of Investigation, from Robert Shanks, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Proposed Access to NCIC Files by National Center for Missing and Exploited Children at 2 (July 31, 1984) ("NCMEC Memo"). Rather, only certain "railroad police departments" and "police departments of private colleges or universities" are identified as entities "include[d]" within the meaning of that term. 28 U.S.C. § 534(d).
4. Although at one time this privacy interest was thought to raise potentially significant constitutional limitations on the use of CHRI, thus requiring a narrow construction of the statute, see Menard v. Mitchell, 328 F. Supp. 718 (D.D.C. 1971), rev'd sub nom. Menard v. Saxbe, 498 F.2d 1017 (D.D.C. 1974) and Lawton Memo at 4-5, subsequent developments in the law have made clear that the limitation is not constitutionally derived. See United States Secret Service Use of National Crime Information Center, 6 Op. O.L.C. 313, 322 (1982). As a result, it is not necessary to construe the statute narrowly in order to avoid a significant constitutional problem. Cf. Edward J. DeBartolo Corp. v. Florida Gulf Coast Bldg. & Constr. Trades Council, 485 U.S. 568, 575 (1988); NLRB v. Catholic Bishop of Chicago, 440 U.S. 490, 500 (1979).
5. Compare Zimmerman v. Owens, 561 N.W.2d 475 (Mich. Ct. App. 1997) (holding that placement of a confidential child protective service report in public court file did not constitute a dissemination) with Essential Information, Inc. v. United States Information Agency, 134 F.3d 1165, 1168 (D.C. Cir. 1998) (rejecting argument that the term "dissemination" connoted a much broader dispersal of materials than mere "disclosure" under the particular statute in question, but acknowledging that "the terms may be so distinguishable under some circumstances").
6. See, e.g., NCMEC Memo at 3 (authorizing CHRI disclosure to private non-governmental entity, such as the National Center for Missing and Exploited Children, under limited circumstances and "subject to substantial governmental controls").
7. See Federal Bureau of Investigations -- Disclosure of Criminal Record -- Admission to the Bar, 3 Op. O.L.C. 55 (1979); see also Utz v. Cullinane, 520 F.2d 467, 477 n.20 (D.C. Cir. 1975) ("regulations set apparently stringent standards as to the maximum extent of dissemination").
8. See FBI Memo at 4 n.3 (citing,e.g., Lawton Memo and CARCO Memo).
9. In our view, the availability of Chevron deference should turn on whether Congress intended for deference to apply, and not on whether a rule is "interpretative" or "legislative." We cannot say with any certainty, however, that a reviewing court would adopt this same view.
10. In defining covered "agencies," see 5 U.S.C. § 552a(a)(1), the Privacy Act adopts by cross-reference the Freedom of Information Act's definition of "agency," which "includes any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency." 5 U.S.C. § 552(f)(1).