Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal Justice Functions ( 1998 )

Access to Criminal History Records by Non-Governmental
Entities Performing Authorized Criminal Justice Functions
N on-govem m ental entities perform ing authorized crim inal ju stice functions under contract w ith govern­
m ent law enforcem ent agencies may be granted access to crim inal history records m aintained under
the authority o f 28 U.S.C. § 534, subject to effective controls to guard against unauthorized use
and to ensure effective oversight by the D epartm ent o f Justice.
B ecause D epartm ent o f Justice regulations im plem enting 28 U S C. § 534 do not affirm atively authorize
dissem ination o f crim inal history records to non-govem m ental entities under contract to assist law
enforcem ent agencies, those regulations should be am ended to provide such authorization before
access is granted to those entities.
June 12, 1998
M e m o r a n d u m O p in io n f o r t h e D e p u t y D ir e c t o r
F e d e r a l B u r e a u o f In v e s t i g a t i o n
This responds to your request for our legal opinion concerning the circumstances
in which non-govemmental entities performing criminal justice functions under
contract with government law enforcement agencies may be granted access to
criminal history records information ( “ CHRI” ) subject to the provisions of 28
U.S.C. §534 (1994).' We conclude that the Attorney General, or her delegee,2
may permit such access in appropriate circumstances under § 534. Should the
Attorney General decide to do so, we believe that the governing regulation, 28
C.F.R. pt. 20 (1997), should be amended in accordance with the rulemaking
requirements of the Administrative Procedure Act (“ APA” ), see 5 U.S.C. §553(1994), for the reasons discussed below.* Finally, any proposal to permit con­
tractor access to CHRI must incorporate effective controls to guard against
unauthorized use or release of CHRI by the contractors and to insure that the
Department can maintain effective oversight.
I.
Section 534 directs the Attorney General to “ acquire, collect, classify, and pre­
serve identification, criminal identification, crime, and other records” and to
“ exchange such records and information with, and for the official use of, author­
ized officials of the Federal Government, the States, cities, and penal and other
* Editor’s Note. The Department’s regulations have since been amended to authorize the category o f controlled
access discussed in this opinion See 28 C.F.R § 20 33(a)(7) (2000).
1Memorandum for Dawn Johnsen, Acting Assistant Attorney General, Office o f Legal Counsel, from Robert M
Bryant, Deputy Director, FBI, Re Access to and Dissemination o f Information from the Department o f Justice (DOJ)
Criminal History Record Information (CHRI) System (Oct. 3, 1997) ( “ FBI M emo” )
2 The Attorney General has delegated her CHRI exchange responsibilities to the Federal Bureau of Investigation
( “ FBI” ). See 28 C.F R. § § 0 85(b), 20 31(b) (1997).
119
Opinions o f the Office o f Legal Counsel in Volume 22
institutions.” 3 28 U.S.C. § 534(a)(1), (4). The statute thus requires the Attorney
General to collect, maintain, and exchange criminal identification records with
federal, state, and local criminal justice agencies. Although the statute does not
expressly preclude such agencies from sharing these records with third parties,
it provides that “ [t]he exchange o f records and information authorized by sub­
section (a)(4) of this section is subject to cancellation if dissemination is made
outside the receiving departments o r related agencies.” Id. § 534(b). This office
has previously construed the phrase “ related agencies” to include only those
agencies expressly authorized under § 534(a) to receive CHRI directly from the
Department. See Memorandum to Files, from Mary C. Lawton, Deputy Assistant
Attorney General, Office of Legal Counsel, Re: Railroad Police Access to FBI
Criminal Identification Records at 5 (June 22, 1978) (“ Lawton M emo” ).
As we read the statute, it does not on its face forbid the government agencies
that are authorized to receive CHRI from sharing it with private contractors
assisting them in the performance o f their duties. However, § 534(b) provides an
enforcement mechanism that enables the Attorney General to oversee the use of
CHRI by recipients. This statutory provision, which vests authority in the Attorney
General to cancel CHRI exchange arrangements, contemplates that she may invoke
that authority in order to guard against the improper use or redissemination of
the CHRI that the FBI provides. Accordingly, as further discussed below, the
statute would permit the Attorney General to authorize the disclosure of CHRI
to private contractors performing criminal justice functions for government agen­
cies that are authorized to receive CHRI, but any such authorization would have
to impose controls on the recipients and their contractors to preserve the Attorney
General’s statutory oversight authority.
Rather than expressly prohibiting categories of CHRI disclosures, § 534(a)(4)
merely limits mandatory CHRI exchanges to those that are for the “ official use”
of the designated “ authorized officials.” The text of §534 does not address
whether a private contractor acting under the direction, or on behalf, of such
“ authorized officials” could be said to be engaged in, enabling, or facilitating
the “ official use” of the CHRI by those officials.
On the other hand, § 534(b) pointedly discourages the “ dissemination” of cov­
ered records outside “ the receiving departments or related agencies,” by providing
that such dissemination “ subjects]” the noncompliant agency or department to
possible cancellation of its exchange privileges under the statute. 28 U.S.C.
§ 534(b). Moreover, it is clear that this provision was intended “ to protect the
privacy of rap-sheet subjects,” Departm ent o f Justice v. Reporters Comm, fo r
3 The reference to “ other institutions” does n o t generally provide for disclosure to non-govemmental entities.
See M emorandum for John Mintz, Legal Counsel, Federal Bureau o f Investigation, from Robert Shanks, Deputy
Assistant A ttorney General, Office o f Legal Counsel, Re- Proposed Access to NC1C Files by National Center fo r
Missing and Exploited Children at 2 (July 31, 1984) ( “ NCMEC M emo” ) Rather, only certain “ railroad police
departm ents” and “ police departments of private colleges or universities” are identified as entities “ include[d]”
within the meaning o f that term 28 U S C § 534(d)
120
Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal
Justice Functions
Freedom o f the Press, 489 U.S. 749, 765 (1989), and should be applied in a
manner consistent with this purpose.4 Finally, as this office has previously
observed, the only enforcement mechanism expressly authorized by § 534 is the
Department’s authority to cancel the direct recipient’s authority to receive the
information, and the statute should be construed to preserve this oversight
authority. See Memorandum for Joseph H. Davis, Assistant Director, Legal
Counsel Division, Federal Bureau of Investigation, from William P. Barr, Assist­
ant Attorney General, Office of Legal Counsel, Re: Proposal by Federally Char­
tered o r Insured Financial Institutions to Disseminate FBI Criminal History
Record Information to CARCO Group, Inc. at 6-7 (Sept. 1, 1989) ( “ CARCO
Memo” ); Lawton Memo at 5. To the extent those recipients are permitted to dis­
close CHRI to their contractors, however, the Department’s sole recourse under
current regulations would be to rely on “ the relationship between the local agency
and the third party” to prevent abuses. Lawton Memo at 5. Thus, at least in
the absence of effective controls over possible redissemination by the contractors,
the Department’s ability to limit the use of CHRI by recipients might be impaired
if recipients were permitted to pass CHRI on to those contractors.
None of these considerations, however, compel a construction of the statute
that precludes authorized criminal justice agencies from sharing CHRI with non-
govemmental contractors performing law enforcement functions where the
arrangements are subject to appropriate controls. First, in providing that the
exchange of CHRI is “ subject to cancellation” if disseminated beyond the
receiving agency or related agencies, Congress has delegated considerable discre­
tion to the Attorney General to determine whether cancellation is appropriate in
a given context. The statute does not require the Department to “ terminate
exchange relationships with users authorized under section 534(a)(1) if those users
disseminate FBI criminal history records to unauthorized third parties.” CARCO
Memo at 6 n.12. This discretion would seem to carry with it the authority to
determine that a particular class of disclosures— i.e., those made to contractors
for law enforcement purposes and subject to appropriate controls— is consistent
with the statutory purpose of facilitating law enforcement and not inconsistent
with its purpose of protecting relevant privacy interests.
In addition, a strong argument can be made that disclosures of the sort con­
templated would not constitute “ dissemination” of the information, within the
ordinary meaning of that word. Indeed, the dictionary defines “ dissemination”
to mean “ to spread or send out freely or widely as though sowing or strewing
4 Although at one tim e this privacy interest was thought to raise potentially significant constitutional limitations
on the use of CHRI, thus requiring a narrow construction o f the statute, see Menard v Mitchell, 328 F Supp.
718 (D D C. 1971), rev’d sub nom Menard v Saxbe, 498 F.2d 1017 (D.D.C. 1974), Lawton Memo at 4—5, subsequent
developments in the law have made clear that the limitation is not constitutionally derived See United States Secret
Service Use o f National Crime Information Center, 6 Op. O .L C 313, 322 (1982). As a result, it is not necessary
to construe the statute narrowly in order to avoid a significant constitutional problem. Cf. Edward J DeBartolo
Corp. v. Florida G ulf Coast Bldg & Constr. Trades Council, 485 U S 568, 575 (1988); NLRB v Catholic Bishop
o f Chicago, 440 U.S 490,5 0 0 (1 9 7 9 )
121
Opinions o f the Office o f Legal Counsel in Volume 22
seed: make widespread.” Webster’s Third International Dictionary 656 (1986).
Sharing information with contractors who are assisting in law enforcement and
who are subject to carefully drawn controls would not appear to fall within this
definition. Moreover, although the meaning of the phrase “ dissemination” may
well vary based on context,5 it is clear that, at a minimum, the Attorney General
could exercise her regulatory authority to define the term in a manner that would
permit disclosures to contractors who are assisting law enforcement and who are
subject to appropriate controls. See Chevron U.S.A. Inc. v. Natural Resources
Defense Council, Inc., 467 U.S. 837 (1984). Such an interpretation would be con­
sistent with both the language and purpose of the statute.
Although opinions issued by this office have at times taken a restrictive view
of §534, see, e.g., Lawton Memo, we have not interpreted the term “ dissemina­
tion” to encompass all disclosures of CHRI to non-govemmental personnel.6
Some of these opinions, however, have indicated that CHRI disclosures to non-
govemmental entities may be made only when the entity “ is the only agency,
public or private, performing a criminal justice function under public auspices.”
See Lawton Memo at n.5. In our view, these opinions overstate the statutory
limitation on permissible disclosures made by authorized criminal justice agencies
in this context. We believe that the proper interpretation is expressed in subsequent
OLC opinions, which more aptly state that the receiving private entity must be
one that ‘‘perform[s] quasi-govemmental functions under strict governmental con­
trol.” CARCO Memo at 4-5; Memorandum for Joseph H. Davis, Assistant
Director, Legal Counsel, Federal Bureau of Investigation, from Douglas W.
Kmiec, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Creation
o f a Public Registry o f Law Enforcement Officers Killed in the Line o f Duty at
2 (July 1, 1988).
Finally, to the extent the Department must retain the ability adequately to control
the use of CHRI, and to cancel the privileges of those who make or permit
improper disclosures, we note that regulatory measures may be developed that
would serve this purpose, while still allowing contractors to access relevant
information.
Accordingly, we believe that disclosure of CHRI to authorized criminal justice
contractors would not be forbidden by the provisions of §534 itself. If carefully
controlled, moreover, such disclosures would also be compatible with the statutory
purpose o f facilitating law enforcement while protecting the privacy interests
affected.
5 Compare Zimmerman v Owens, 561 N W 2d 475 (Mich Ct App 1997) (holding that placement of a confidential
child protective service report in public court file did not constitute a dissemination) with Essential Information,
Inc. v. U nited Slates Information Agency, 134 F.3d 1165, 1168 (D C Cir 1998) (rejecting argument that the term
“ dissem ination” connoted a much broader dispersal of materials than mere “ disclosure” under the particular statute
in question, but acknowledging that “ the terms may be so distinguishable under some circumstances” )
6 See, e.g , N CM EC M emo at 3 (authorizing C H RI disclosure to private non-govemmental entity, such as the
National Center for M issing and Exploited Children, under limited circumstances and “ subject to substantial govern­
mental controls” ).
122
Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal
Justice Functions
ii .
In addition to §534 itself, however, it is necessary to consider the currently
existing regulations that implement the statute. See 28 C.F.R. pt. 20 (1997) (gov­
erning “ Criminal Justice Information Systems” ) (“ Part 20” or “ CJIS Regula­
tions” ). Subpart C of part 20 applies to the CHRI systems maintained by the
Department of Justice, other federal agencies, and by state and local criminal ju s­
tice agencies insofar as they use the services of federal CHRI systems. See 28
C.F.R. §20.30. The regulations provide that CHRI contained in systems main­
tained by the Department of Justice “ will be made available” :
(1) To criminal justice agencies for criminal justice purposes; and
(2) To Federal agencies authorized to receive it pursuant to Federal
statute or Executive order.
(3) Pursuant to Public Law 92-544 (86 Stat. 1115) for use in
connection with licensing or local/state employment or for other
uses only if such dissemination is authorized by Federal or state
statutes and approved by the Attorney General of the United States.
(4) For issuance of press releases and publicity designed to effect
the apprehension of wanted persons in connection with serious or
significant offenses.
Id. § 20.33(a). The regulations further provide, consistent with § 534(b), that an
agency’s right to receive CHRI “ is subject to cancellation if dissemination is made
outside the receiving departments or related agencies.” Id. § 20.33(b).
Nothing in the subpart C regulations authorizes the dissemination of CHRI to
private entities acting on behalf of government criminal justice agencies. Closest
is the authorization to disclose CHRI to “ criminal justice agencies for criminal
justice purposes,” id. § 20.33(a)(1), but those agencies are expressly defined to
include only “ courts” and certain “ government agencies [and] any subunit
thereof,” id. § 20.3(c). They do not include non-govemmental agencies, even
when under contract to perform criminal justice functions. Particularly when read
in light of the regulatory purpose of protecting “ individual privacy,” id. §20.1,
it appears that section 20.33(a) was intended as an exhaustive list of the categories
of authorized exchange for the covered records, and this office has previously
123
Opinions o f the Office o f Legal Counsel in Volume 22
construed the provision in this manner.7 Thus, section 20.33(a) does not affirma­
tively authorize dissemination of CHRI to non-govemmental entities under con­
tract to assist federal, state or local law enforcement agencies.
A more difficult question is whether such disclosure of CHRI to private contrac­
tors, where subject to strict controls over the handling and use of the CHRI, would
constitute a “ dissemination” for purposes of the regulation. Although one might
plausibly argue that it would not, see supra n.5 and accompanying text, for a
number of reasons we believe that such disclosures should not be authorized with­
out first amending the regulations. Although we cannot say with certainty that
such an action is legally required, the risks of not doing so are substantial.
At the outset, we note that it is more difficult to construe the regulation’s use
of the word “ dissemination” in a manner that would allow contractor access than
to do so with regard to the statute’s use of the same word. In particular, subpart
B o f the regulations, which sets forth the rules governing certain state and local
(as opposed to federal) criminal history record information systems, expressly
authorizes disclosure to “ individuals and agencies pursuant to a specific agree­
ment with a criminal justice agency to provide services required for the adminis­
tration of criminal justice.” 28 C.F.R. § 20.21(b)(3). Because no similar provision
appears in subpart C, which governs here, one might reasonably infer that such
disclosures are not currently permitted under that provision.
Further, as noted in your memorandum of October 3, 1997, earlier opinions
of this office have taken a restrictive view of the Department’s authority to release
CHRI to recipients not specifically identified in §534,8 and the Department
historically has not permitted third-party access to CHRI. The courts have
indicated that when an agency changes its interpretation of a regulation so fun­
damentally that it is equivalent to an amendment of the regulation, the change
must be accomplished through notice-and-comment rulemaking. See Shalala v.
Guernsey M em orial Hosp., 514 U.S. 87 (1995); Paralyzed Veterans o f America
v. D.C. Arena L.P., 117 F.3d 579, 586 (D.C. Cir. 1997), cert denied, 523 U.S.
1003 (1998).
Finally, by proceeding by notice-and-comment rulemaking, the Department will
insure that its interpretation of § 534 receives the full weight of Chevron deference.
Although the question is unsettled, a court might well provide less deference to
an “ interpretative” rule, which is not subject to formal rulemaking, than to a
“ legislative” rule, which is subject to the notice-and-comment process.9 Compare
Martin v. Occupational Safety & Health Review Comm'n, 499 U.S. 144, 157
(1991) (interpretative rules “ not entitled to the same deference as norms that
1 See Federal Bureau o f Investigations—Disclosure o f Criminal Record—Admission to the Bar, 3 Op. O L.C. 55
(1979), see also Vtz v. Cullm ane, 520 F 2d 467, 477 n 20 (D C C ir 1975) ( “ regulations set apparently stringent
standards as to the maximum extent o f dissemination” )
8See FBI M emo at 4 n.3 (citing, e.g., Lawton M emo and CARCO Memo)
9 In our view, the availability o f Chevron deference should turn on whether Congress intended for deference to
apply, and not on w hether a rule is “ interpretative” or “ legislative ” We cannot say with any certainty, however,
that a reviewing court would adopt this same view
124
Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal
Justice Functions
derive from the exercise of the Secretary’s delegated lawmaking powers” ) (dicta)
with Elizabeth Blackwell Health Ctr. fo r Women v. Knoll, 61 F.3d 170, 182 (3d
Cir. 1995) ( Chevron deference is appropriate “ even though the Secretary’s
interpretation is not contained in a ‘legislative rule’ ” ), cert, denied, 516 U.S.
1093 (1996). Receiving full Chevron deference, moreover, may prove important
to sustaining the Department’s position in potential litigation.
In light of all these considerations, we believe that to proceed without first
amending the regulations in accordance with the APA would invite significant
legal challenge.
III.
If a decision is made to amend the regulations to authorize provision of CHRI
to criminal justice contractors, it is essential that this goal be achieved in a manner
that will subject contractor access to effective controls against unauthorized use
or further dissemination. As the Supreme Court has observed, Congress intended
that §534 be applied in a manner that is protective of “ the privacy of rap-sheet
subjects.” Reporters Comm, fo r Freedom o f the Press, 489 U.S. at 749, 765.
Moreover, § 534(b) provides for Department of Justice oversight of the dissemina­
tion of CHRI by giving the Attorney General the authority to cancel the exchange
of CHRI if an unauthorized dissemination is made. The Department’s responsi­
bility to protect the privacy of CHRI will require, in our view, that it have at
its disposal the means of controlling the use of this information.
The precise form of such controls will depend upon a variety of factors. As
a starting point, however, the Department might consider whether the provisions
governing CHRI access agreements between states and criminal justice contractors
set forth in subpart B of the CJIS Regulations would provide an appropriate model.
The subpart B regulations require that such agreements shall “ limit the use of
data to purposes for which given, insure the security and confidentiality of the
data consistent with these regulations, and provide sanctions for violations
thereof.” 28 C.F.R. § 20.21(b)(3). We would, of course, be happy to consider
whether any particular proposal satisfies statutory requirements.
Finally, we note that authorizing the provision of federal criminal history records
to the entities in question would require compliance with the Privacy Act. See
5 U.S.C. §552a (1994 & Supp. II 1996). The criminal history records maintained
by the FBI and provided through the NCIC are part of a system of records that
is subject to the Privacy Act. Accordingly, covered agencies may not disclose
such records to other agencies or institutions unless the subject of the records
consents or one of the statute’s exemptions apply. Id. § 552a(b).'°
l0 In defining covered “ agencies.’' see 5 U .SC. § 552a(a)( 1). the Privacy Act adopts by cross-reference the
Freedom of Information Act’s definition o f “ agency,” which “ includes any executive department, military depart­
ment, Government corporation. Government controlled corporation, or other establishment in the executive branch
Continued
125
Opinions o f the Office o f Legal Counsel in Volume 22
Here, the criminal justice or law enforcement uses for which the information
would be provided would likely qualify for the issuance o f a “ routine use” excep­
tion to the Privacy Act’s prohibitions against unconsented disclosures. See 5
U.S.C. §552a(b)(3). A “ routine use” means, with respect to the disclosure of
a record, “ the use of such record for a purpose which is compatible with the
purpose for which it was collected.” Id. §552a(a)(7). We think that the uses of
CHRI indicated in the examples you have submitted would generally be compat­
ible with the law enforcement and related purposes for which it was collected
by the FBI and other agencies. We have not undertaken, however, to determine
whether these particular uses would qualify under any of the existing published
routine uses applicable to the relevant systems o f records. See, e.g., Privacy Act
of 1974; Modified Systems of Records Notice (Fingerprint Identification Records
System), 61 Fed. Reg. 6385 (1996); Privacy Act of 1974; Modified System of
Records Notice (NCIC), 60 Fed. Reg. 19,774 (1995). Before actually authorizing
the disclosure of CHRI to private criminal justice contractors, the Justice Depart­
ment should issue any new routine use notifications necessary to cover the par­
ticular disclosures in question.
RANDOLPH D. MOSS
Deputy Assistant Attorney General
Office o f Legal Counsel
o f the Governm ent (including the Executive O ffice of the President), or any independent regulatory agency ” 5
U .S C §5 5 2 (0 (1 ) (Supp II 1996)
126