United States Participation in Interpol Computerized Search File Project ( 1981 )

United States Participation in
Interpol Computerized Search File Project
Neither state nor federal law would prohibit participation by the United States National
Central Bureau o f Interpol (USNCB) in a proposed computerized information exchange
system, provided the USNCB complies with all disclosure, accounting, and publication
requirements imposed by applicable federal statutes, such as 22 U.S.C. § 263a, the
Privacy Act, and other federal restrictions on the exchange of criminal history informa­
tion. As a matter of comity, the USNCB may comply with relevant state laws and
regulations that restrict the disclosure and dissemination o f personally identifiable
information; however, under the Supremacy Clause, as a federal law enforcement
agency it is not bound to do so.
The requirements o f the Privacy A ct may affect the structure and functioning o f any
computerized information exchange system in which the USNCB participates, particu­
larly insofar as it would require the USNCB to verify the accuracy o f data in its
records prior to disclosure.
Applicable international guidelines and agreements relating to information exchange and
privacy protection are broader in scope than the Privacy Act, and may restrict federal
law enforcement agencies’ ability to participate fully in the proposed system. More­
over, there are a number o f possible international conflicts o f law issues raised by the
United States’ participation in Interpol generally, and in any automated information
exchange system it may implement.
December 9, 1981
MEMORANDUM OPINION FOR TH E ASSISTANT ATTORNEY
GENERAL FOR ADMINISTRATION
This responds to your request for this Office’s advice on legal issues
implicated by the proposed Interpol Computerized Search File Project,
Fisher Informatise de Recherches (F.I.R.). This project, if approved by
the Interpol General Assembly, will result in computerization of infor­
mation now maintained by the Interpol General Secretariat and the
exchange of information among member national central bureaus
(NCBs) and the General Secretariat. While our discussion focuses on
the F.I.R. project, our analysis may, as you recognize in your request,
have implications for other recent initiatives dealing with the computer­
ized exchange of personally identifiable information. One such initiative
would be the recommendation of the Attorney General’s Task Force
on Violent Crime for establishment of an Interstate Identification Index
as an alternative to a national centralized computerized criminal history
file. We will, as appropriate, point out that overlap and the possible
effects of our analysis on the Interstate Identification Index proposal.
373
We understand that the primary purpose of the F.I.R. project is to
facilitate more rapid exchange of information through Interpol; such
exchanges are presently accomplished largely on a manual basis. Imple­
mentation of the F.I.R. project would not alter the obligations and
responsibilities of member NCBs with respect to the exchange of infor­
mation, except insofar as will be necessary for technical operation of
the system. Therefore, we do not believe that the computerization of
the General Secretariat’s files and the exchange of information among
members of Interpol raise any unique legal issues. The more difficult
questions will undoubtedly be those of policy and technical feasibility.
You have also asked us to address more generally, however, the legal
issues raised with respect to the collection and exchange of information
among the member NCBs and the General Secretariat, so that you may
evaluate how they affect the usefulness, desirability, and design of the
F.I.R. project. We focus in this memorandum on the following: (1)
restrictions imposed by state or federal law on the information that the
United States National Central Bureau (USNCB) may contribute to the
F.I.R. system; (2) the USNCB’s responsibility to verify data it discloses
through the system; and (3) the effect on federal law enforcement
agencies of the voluntary privacy protection guidelines recently
adopted by the Organization for Economic Cooperation and Develop­
ment and of the Convention for the Protection of Individuals with
Regard to Automatic Processing of Personal Data adopted by the
Council of Europe. We will also discuss briefly conflict of laws prob­
lems raised by the F.I.R. project.
1. Background
Currently, NCBs exchange criminal justice and certain humanitarian
information directly with the General Secretariat, which maintains a
centralized file in St. Cloud, France, and directly with other NCBs.
Under the F.I.R. project, the centralized records now maintained by
the General Secretariat in manual form, which consist primarily of
information contributed by member NCBs, would be put in a comput­
erized data base accessible by member NCBs through remote terminals.
This would be similar in design to the Computerized Criminal History
File (CCH) now maintained as part of the Federal Bureau of Investiga­
tion’s (FBI’s) National Crime Information Center (NCIC). Channels
would also be created between member NCBs allowing direct commu­
nication of requests and information without intermediate processing at
the Interpol General Secretariat. It is our understanding that the FBI’s
NCIC system does not permit direct communication between state and
local governments, but that such communication may be accomplished
independently through the National Law Enforcement Telecommunica­
tions System (NLETS).
374
An alternative system design would be a central index maintained by
the General Secretariat which would include only names or other
identifying characteristics and corresponding index entries indicating
which NCB maintains relevant information. A requesting NCB could
not obtain information directly from the General Secretariat under such
a system, but would be referred to the NCB that has information
responsive to the request. The FBI’s proposed Interstate Identification
Index, which has been undergoing a trial in Florida, is based on the
index concept.
We understand that the F.I.R. project has as yet only been proposed
in principle, and that it will be submitted to the Interpol General
Assembly early in 1982 for approval. Assuming the project is approved,
the details of its design and operation will be addressed by the General
Assembly only after the project has been approved in concept.1
II. Restrictions on Exchanges of Information
You have asked us to address specifically whether state or federal
laws impose binding restrictions on the types of information the
USNCB can contribute to the F.I.R. system. The USNCB now ex­
changes a wide variety of information with other NCBs and the
Interpol General Secretariat, including: humanitarian records (missing
persons, amnesia victims, victim locate requests, and identification of
decedents); criminal subject records (stolen property, wanted persons,
criminal history records); criminal investigative records (persons in­
volved in or property associated with a criminal act); and criminal
intelligence records (information indicating that a specific individual
may commit a specific criminal act). Upon occasion, other types of
personal assistance data may be communicated through Interpol to
facilitate humanitarian efforts.2 As we discuss below, we do not believe
that state or federal law would prohibit the USNCB from continuing to
exchange those categories of information through Interpol, provided
the USNCB complies with all disclosure, accounting, and publication
requirements imposed by the applicable federal statutes.
A. Restrictions Imposed by State Laws
A significant portion of information communicated by the USNCB
through Interpol comes from cooperating state and local law enforce­
1Rules governing the processing o f police information within Interpol, including treatment of data
in an automated data processing system, have recently been discussed by the General Assembly. In
our memorandum o f October 17, 1981, we commented on the acceptability of those rules under
United States law. W e understand that because many countries did not have an adequate opportunity
to review those rules before the General Assembly meeting, a committee has been established to
consider the draft further, and that the rules, as modified, will be resubmitted to the General Assembly
next year.
2 For example, information relating to adoptions of Peruvian babies is communicated between
Peruvian authorities and the adopting parents only through Interpol channels.
375
ment agencies, either directly through the NLETS system or indirectly
through other federal law enforcement systems such as the Treasury
Enforcement Communications Systems (TECS).3 Most, if not all, states
have laws restricting secondary dissemination of particular types of
information, ranging from omnibus privacy legislation modeled on the
federal Privacy Act, to specific limitations on disclosure of tax, welfare,
criminal history, or other personal information.4 The first question you
have posed is whether the USNCB must or should comply with state
laws that restrict the disclosure of personal history information, either
(1) on the principle that the records submitted by a state remain the
property of the state and therefore subject to state statutory restrictions;
or (2) on a principle of voluntary compliance based on federal/state
comity.
Many federal law enforcement agencies, including the FBI and the
USNCB, recognize that the primary responsibility lies with state and
local law enforcement agencies for determining what information can
or should be disclosed to federal agencies. Neither the FBI nor the
USNCB requires state and local agencies to disclose any information,
or particular types of information. Disclosure is on a voluntary, cooper­
ative basis. In some instances, if the state or local agency undertakes to
exchange information, it becomes subject to federal restrictions on
maintenance and disclosure of that information, but those restrictions
do not affect the state’s authority to decide, in the first instance,
whether it will transmit particular types of information to the federal
agency and whether such transmittal would comply with state law.5
Both the FBI and the USNCB routinely honor requests by state and
local law enforcement agencies for return, deletion, or modification of
*The USNCB has direct access to T E C S, which includes data bases of a number of Treasury and
other federal agencies, including the U.S. Customs Service, the Bureau of Alcohol, Tobacco and
Firearm s, the Internal Revenue Service, and, to a limited extent, the United States Coast Guard and
the D epartm ent o f State Through T E C S , the USNCB also has access to the FBI's criminal record
information files.
4A lthough we have not undertaken an exhaustive survey of state laws that regulate the disclosure
of persona] information, several state statutes we have reviewed apply only to disclosure of informa­
tion by state agencies and officials, and therefore would not restrict disclosure by federal agencies or
officials. F o r example, the Minnesota statute referred to in your request, which prohibits disclosure to
“ the private international organization known as Interpol,” applies only to state agencies and political
subdivisions. Minn. Stat. Ann. § 15.1643 (West Supp. 1980) See also Ark. Stat. Ann. §§ 16-801 to 810
(1979) (omnibus privacy act applicable to “an agency o f the State Government or any local govern­
ment or other political subdivision o f the State”); Conn. Gen Stat Ann §§4-190 to 197 (West Supp.
1980) (restrictions on transfer of “personal data” by any “state board, commission, department, o r
officer” ); but see Me. Rev. Stat. Ann. tit. 16, §§611-22 (West Supp. 1979-80) (limiting use of criminal
justice information by “criminal justice agencies,” including “federal, state . . or local government
agenc[ies]”).
5 F o r example, the regulations governing disclosure o f criminal justice information by state agencies
that receive Law Enforcement Assistance Administration funding under the Omnibus Crime Control
and Safe Streets A ct of 1968, as amended, 42 U.S.C. §§ 3701-3797 (Supp. IV 1980), provide that,
“ Subsection (b) [limiting dissemination of criminal justice information by states] does not mandate
dissemination o f criminal history record information to any agency or individual. States and local
governm ents will determine the purposes for which dissemination o f criminal history record informa­
tion is authorized by state law, executive order, local ordinance, court rule, decision or order.” 28
C.F.R. § 20.21(c)(3), interpreting 42 U.S.C. § 3789g(b).
376
records previously forwarded to the federal agency. Thus, the FBI and
USNCB recognize that states have a legitimate interest in and consider­
able control over what criminal justice information will be exchanged.
We believe that this recognition of the states’ interest in criminal
justice information communicated to federal agencies is only a matter
of comity between state and federal law enforcement agencies. While
federal agencies may choose to honor states’ requests or statutory
restrictions in the exchange of information, they are not bound by state
laws that restrict secondary dissemination of criminal justice informa­
tion. Under the Supremacy Clause of the Constitution, Art. VI, cl. 2, it
is settled that the states cannot subject instrumentalities of the federal
government to state regulation or control, in the absence of a clear
congressional mandate to make federal authority subject to state regula­
tion.6 In particular, courts have held that state statutes restricting dis­
closure of certain types of information must give way where they are
inconsistent with an Act of Congress or the Constitution, as, for exam­
ple, where a federal grand jury subpoenas records otherwise protected
by state statute.7 Where the agency is not subject to state statutes or
regulations restricting the disclosure of information, a fortiori its officers
and employees are not subject to prosecution for violation of those
regulations, if they are acting in furtherance of their responsibilities
under federal law.8
Here, the relevant statutes that affect the ability of federal agencies to
collect and disseminate data contain no “clear congressional mandate”
that the federal agencies and their employees are subject to the restric­
tions contained in the various state statutes on use of criminal justice
information except as a matter of comity. See, e.g., 28 U.S.C. § 534(authorizing the Attorney General to “acquire, collect, classify and
preserve identification, criminal identification, crime and other records”
and to “exchange these records with and for the official use of author­
ized officials of the Federal Government, the States, cities and penal
and other institutions”); Omnibus Crime Control and Safe Streets Act
of 1968, supra ; 22 U.S.C. § 263a (authorizing the Attorney General to
“accept and maintain membership . . . in Interpol”).
You suggest in your request that language in Tarlton v. Saxbe, 507
F.2d 1116 (D.C. Cir. 1974) and Department of Justice regulations
6See Mayo v. United Stares, 319 U.S. 441, 447-48 (1943); Kern-Limenck, Inc. v. Scurlock, 347 U.S.
110, 122 (1954).
1 In re Grand Jury Subpoena, May 1978, at Baltimore. 596 F.2d 630, 632 (4th Cir. 1979); In re Special
April 1977 Grand Jury, 581 F.2d 589, 592 (7th Cir.) cert, denied sub. nom. Scott v. United States 439,
U.S. 1046 (1978); see In re Grand Jury Subpoena fo r N. Y. State Income Tax Records, 468 F. Supp. 575,
577 (N .D N Y 1979); see also United States v. Thorne, 467 F. Supp. 938, 940 (D. Conn. 1979).
sSee In re Neagle, 135 U.S. 1, 62 (1890); Ohio v. Thomas. 173 U.S. 276, 282 (1899), Massachusetts v.
Hills. 437 F. Supp 351, 353 (D. Mass. 1977) (Secretary of HUD not subject to criminal prosecution
for alleged violations o f Massachusetts Sanitary Code in buildings owned by department); Memoran­
dum for the Attorney General from Mary C. Lawton, Deputy Assistant Attorney General, Office o f
Legal Counsel (Nov. 30, 1976); see generally United States v. Georgia Public Service Comm'n, 371 U.S.
285, 292-93 (1963).
377
governing the disclosure of criminal history information under the
Omnibus Crime Control and Safe Streets Act, supra, might embody a
concept of “data ownership” whereby information contributed by a
state to a federal agency would remain the property of, and therefore
under the control of, the contributing state. We do not believe that
such a concept is inherent in either the Tarlton decision or the pertinent
regulations. In Tarlton, an action for expungement of FBI arrest
records, the Court of Appeals for the District of Columbia Circuit
suggested that 28 U.S.C. § 534, supra, may require the FBI to make
“reasonable efforts” to maintain “constitutionally accurate criminal
files.” It bolstered that suggestion by reference to § 524(b) of the Omni­
bus Crime Control and Safe Streets Act, which requires state officials
subject to the Act to make efforts to assure the accuracy and complete­
ness of criminal history record information submitted to the FBI. The
court noted in a footnote that:
Congress surely cannot be presumed to undercut its
action in [28 U.S.C.] § 534 by intending that the FBI be
authorized to receive and disseminate without reasonable
precautions the sort of incomplete, unchallengable infor­
mation from state or local officials which those officials
themselves are forbidden to disseminate.
507 F.2d at 1125 n.28. The court’s reference to “the sort of . . .
information from state or local officials which the officials themselves
are forbidden to disseminate,” involves only the obligations imposed on
state officials under the Omnibus Act, and not those obligations im­
posed under state laws. This language therefore does not suggest that
the FBI (or any other federal agency) is bound by state laws restricting
the disclosure of criminal history information. Likewise, 28 C.F.R.
§ 20.21(c), quoted at n.5 supra, recognizes only that a state is not
required to disclose information if disclosure would contravene its own
law, regulations, or orders. That subsection does not suggest that the
FBI is bound by such state laws.
Moreover, the concept of “data ownership” would imply that the
receiving agency does not have control over data that it did not
develop itself, and therefore that the receiving agency is not bound by
federal laws or regulations governing use and disclosure of that infor­
mation, such as the Privacy Act or the Freedom of Information Act
(FOIA). There is no suggestion, however, in either the Privacy Act or
FOIA that records collected by a federal agency are exempt from the
requirements of those statutes if they are contributed by a state agency.9
9 T he Privacy A ct applies broadly to any “system o f records” maintained, collected, used, or
disseminated by a federal agency. “R ecord" is defined in terms o f the nature o f the information (Le.,
information about an individual) and not the source o f the information. 5 U.S.C. § 552a(aX4). The
definition of “system o f records'* is intended to exclude only groupings of records over which the
Continued
378
Finally, because federal agencies collect information from thousands of
sources, including an estimated 20,000 state and local law enforcement
agencies, it would clearly be impracticable to require the federal agen­
cies to abide by the varying and inconsistent restrictions imposed by
individual state laws. Where state regulation will frustrate the purpose
and operation of a duly authorized federal program, the state statute
must give way. See Public Utilities Commission o f California v. United
States, 355 U.S. 534, 540-44 (1958); Mayo v. United States, 319 U.S. at
445; C ity o f Los Angeles v. United States, 355 F. Supp. 461, 465 (C.D.
Calif. 1972).
Thus, we conclude that federal agencies such as the USNCB or the
FBI may, as a matter of comity, comply with state restrictions on the
use of data or state requests with respect to disclosure of data, at least
so long as those restrictions are not themselves inconsistent with federal
law, but are not obligated to abide by the laws of the various states in
the handling of data submitted by the states. In addition, federal agen­
cies are not required to comply with restrictions on disclosure of data
imposed by the domestic laws of foreign countries, but may choose to
honor those restrictions as a matter of international comity.10
B. Restrictions Imposed by Federal Law
While the USNCB need not comply with limitations imposed by
state law except as a matter of comity, there are federal statutes and
agency has no “control” —i.e., if it does not have access to the records; the ability to include, exclude,
or modify information included in the grouping; or the responsibility to ensure the physical safety and
integrity o f the records—and records which, although in the physical possession of agency employees
and used by them in performing official functions, are not “agency" records, such as uncirculated
personal notes, papers, and records retained or discarded at the author's discretion and over which the
agency exercises no control or dominion. See Office of Management and Budget Privacy Act
Guidelines. 40 Fed. Reg. 28,949, 28,952, (July 9, 1975) (OMB Guidelines). The FOIA applies generally
to “records” o f an agency, except as specifically exempted by the statute. 5 U S.C. § 552(a)(3)(b). With
the exception of the exemption in FO IA for “trade secrets and commercial or financial information
obtained from a person and privileged or confidential,” we are unaware of any statutory or regulatory
provision or administrative or judicial interpretations suggesting that the Privacy Act and FO IA do
not apply to records maintained by agencies on the sole ground that the records were obtained from a
source outside the agency.
10 For example, the federal agency could agree, by contract or otherwise, to restrict dissemination
of state-supplied data and to honor states* requests for modification or return of information, so long as
that agreement is not inconsistent with the agency's obligations under federal statutes As we discuss
infra, however, such agreement would not in any sense exempt information contributed by the states
from the Privacy Act, FO IA, or other federal disclosure statutes, once that information has been
incorporated in the records of the federal agency. An index system, either at the federal or interna­
tional level, would clearly have advantages in enabling the responsible central authority to honor
restrictions requested by the states or foreign governments, because the central authority would not
retain or disclose the information itself, but would only refer the requesting entity to the state or
country that has relevant information. It would be the responsibility of that state or government to
determine if disclosure is consisent with its laws, regulations, and policies. Even with a centralized
data base, however, it may be possible to accommodate differing state or national disclosure require­
ments by allowing the source of the information unilaterally to restrict or qualify subsequent uses of
information disclosed to the authority. The Interpol draft rules, for example (see n. 1 supra), contemplate
that an NCB may classify information as intended only for the use o f the General Secretariat (Art. 6, %
3) o r only for the use o f the country to which the information is communicated (Art. 12, 3). As a
technical matter, codes or safeguards would have to be built into the F.I.R. project to accommodate
such limitations.
379
regulations that restrict the types of data that can be collected and
disseminated by the USNCB and the circumstances under which infor­
mation can be disclosed outside the agency. In particular, we consider
here: (1) 22 U.S.C. §263a (Supp. IV 1980), the legislation authorizing
United States participation in Interpol; (2) the Privacy Act; and (3)
other federal restrictions on the exchange of criminal history informa­
tion.
1. 22 U.S.C. § 263a
The statutory authority for participation by the United States in
Interpol is 22 U.S.C. § 263a, which authorizes the Attorney General “to
accept and maintain, on behalf of the United States, membership in the
International Criminal Police Organization, and to designate any de­
partments and agencies which may participate in the United States
representation with that organization.” Participation by the United
States in Interpol is accomplished through the USNCB, which is part
of the Department of Justice.11 No statutory or regulatory authority
expressly authorizes the USNCB to exchange criminal justice or hu­
manitarian information through Interpol.12 Such authority can be in­
ferred, however, from the broad mandate in § 263a authorizing partici­
pation in the organization, and congressional approval of payment of
dues to Interpol. See, e.g., Fleming v. Mohawk Co., 331 U.S. Ill, 116
(1947).13
We believe that the USNCB has broad authority to coordinate and
communicate criminal investigative requests and humanitarian requests
with the United States law enforcement agencies, the Interpol Secretar­
iat, and other NCBs, consistent with the purposes of Interpol. The
Interpol constitution describes the purposes of Interpol as follows:
11T he A ttorney G eneral has approved a departmental reorganization that will make the USNCB a
separate office within the Department o f Justice. See memorandum from William French Smith,
A ttorney G eneral, to Rudolph W. Giuliani, Associate Attorney General (Oct. 14, 1981).
12As part o f the departmental reorganization (see n.10 supra), the Attorney General has also
proposed an amendment to the D epartm ent o f Justice’s organizational regulations, which will specify
the functions to be handled by th e USNCB. Those functions include the authonty to “transmit
information o f a criminal justice, humanitarian, or other law enforcement related nature between
N ational Central Bureaus of IN TER PO L member countries, and law enforcement agencies within the
United States and abroad; and respond to requests by law enforcement agencies and other legitimate
requests by appropriate organizations, institutions and individuals, when in agreement with the
IN T E R P O L Constitution."
13 Prior to 1978, § 263a included a ceiling on the amount o f dues the United States could contribute
to Interpol. Between 1957 and 1978, Congress raised that ceiling several times. See, e.g., Pub. L. No.
85-768, 72 Stat. 921; Pub. L. No. 90-159, 81 S ta t 517; Pub. L. No. 92-380, § 1, 86 Stat. 531; Pub. L.
No. 93—468, § 1, 88 Stat. 1422. In reports accompanying bills to increase the dues ceiling, Congress
described in some detail the information-gathering functions o f Interpol, and acknowledged that the
United States* participation in Interpol is of substantial value for efforts to combat crime on an
international scale. See, e.g., S. Rep. N o. 2403, 85th Cong., 2d Sess., reprinted in 1958 U.S. Code Cong.
& A d. N ew s 3957; S. Rep. No. 1199, 93rd Cong., 2d Sess., reprinted in 1974 U.S. Code Cong. & Ad.
N ew s 5906. In 1978, Congress amended § 263a to provide that dues and expenses for the membership
o f th e U nited States in Interpol “shall be paid out o f sums authorized and appropriated for the
D epartm ent o f Justice.” Pub. L No. 95-624, § 21(a), 92 Stat. 3466.
380
a) To ensure and promote the widest possible
mutual assistance between all criminal police au­
thorities within the limits of the laws existing in
the different countries and in the spirit of the
“Universal Declaration of Human Rights.”
b) To establish and develop all institutions likely to
contribute effectively to the prevention and sup­
pression of ordinary law crimes.
Art. I. This specification of purpose is quite broad, and can be read to
encompass the types of criminal justice and humanitarian information
now collected and exchanged by the USNCB.14
2. Privacy Act, 5 U.S.C. § 552a
The USNCB must comply with the requirements of the Privacy Act
with respect to any personal information maintained on United States
citizens or permanent residents.15 The Privacy Act limits the collection
and dissemination of “personally identifiable” information by federal
agencies generally to “such information . . . as is relevant and neces­
sary to accomplish a purpose of the agency required to be accom­
plished by statute or by executive order of the President.” 5 U.S.C.
§ 552a(e)(l). The Act specifically prohibits the maintenance of any
records “describing how any individual exercises rights guaranteed by
the First Amendment.” 5 U.S.C. § 552(e)(7). Criminal history informa­
tion and certain law enforcement records, however, may be exempted
from the requirements of subsections (e)(1) and (e)(7). 5 U.S.C.
§ 552a(j)(2). Pursuant to that authority, law enforcement records main­
tained by the USNCB in its Criminal Investigative Records System
have been exempted from those requirements. The exemption from
subsection (e)(1) means only, however, that the USNCB need not
14 The authonty of Interpol to investigate crimes is generally limited to “ ordinary law crimes.'*
Article III of the Interpol constitution expressly forbids the organization “to undertake any interven­
tion or activities of a political, military, religious or racial character.’’ We understand that because of
this express limitation in the Interpol constitution, the USNCB will not provide through Interpol
information related to incidents o f a “ political, military, religious or racial” character In addition, the
draft rules on processing of police information recently considered by the Interpol General Assembly
(see n.l supra) would restrict the disclosure of information by the General Secretariat and the NCBs,
although the rules do not restrict the prerogative of individual NCBs to determine w hat types of
information can or should be disclosed under their own laws and policies. Under those rules, “police
information’’ may be disclosed only for the following purposes*
. . . to prevent ordinary law crimes, to bring the persons responsible to justice, to find
the victims of such crimes, to find missing persons and to identify dead bodies . . .
Items of police information other than names of persons may be processed for research
and publication purposes. Any police information that has been published may also be
processed for general reference purposes.
Art. 3, HH 3, 4. Items o f police information may be further disseminated by the receiving N CB only to
“official institutions concerned with the enforcement of the criminal law in its country.” A rt. 12, fl(4)-
19 T he Privacy A ct does not apply to information maintained on foreign nationals unless they have
permanent resident status in the United States Thus, information that the USNCB maintains on
foreign nationals and nonresident aliens is not subject to the disclosure, accounting, and access
requirements of the Act.
381
screen all information received from state, local, or foreign sources to
determine if the information is relevant and necessary to the USNCB’s
statutory purpose. As we discuss below, the USNCB is required to
make reasonable efforts prior to dissemination of any information sub­
ject to the Privacy Act to assure that the records disseminated are
“relevant” to the USNCB’s purposes. See 5 U.S.C. § 552a(e)(6). More­
over, independent of the requirements of the Privacy Act, the USNCB
is without statutory authority to collect or disseminate information that
is unrelated to the purposes of Interpol. See discussion in previous
section.
Other than the limitations imposed by subsections (e)(1) and (e)(7),
which may be of limited practical significance because of the exemption
of law enforcement records, the Privacy Act does not limit the types of
personal information that may be maintained and disseminated by a
federal agency. The Privacy Act does, however, limit the circumstances
under which such information may be disclosed. No personal informa­
tion subject to the Act may be disclosed without the consent of the
individual concerned unless one of eleven statutory exceptions is met. 5
U.S.C. § 552a(b). For law enforcement purposes, the most significant
exception allowed is for a “routine use” of the agency, i.e., a use which
is “compatible with the purpose for which [the record] is collected.” 5
U.S.C. § 552a(a)(5), (b)(3).
The legislative history of the Privacy Act does not provide much
guidance as to the outer limits of the “routine use” exception. Congress
chose not to define or prescribe a list of permissible “routine uses.”
Instead it provided a check on the scope of the exception by requiring
publication of the nature of all “routine uses” in the Federal Register.
Rep. Moorhead noted in House debate on the bill that:
It would be an impossible legislative task to attempt to
set forth all of the appropriate uses of Federal records
about an identifiable individual. It is not the purpose of
the bill to restrict such ordinary uses of the information.
Rather than attempting to specify each proper use of such
records, the bill gives each Federal agency the authority
to set forth the “routine” purposes for which the records
are to be used under the guidance contained in the com­
mittee’s reports.
In this sense “routine use” does not encompass merely
the common and ordinary uses to which records are put,
but also includes all of the proper and necessary uses even
if any such use occurs infrequently . . . .
Mr. Chairman, the bill obviously is not intended to
prohibit . . . necessary exchanges of information, pro­
vided its rulemaking procedures are followed. It is in­
382
tended to prohibit gratuitous, ad hoc, disseminations for
private or otherwise irregular purposes. . . .
See 120 Cong. Rec. 36,967 (1974) (remarks of Rep. Moorhead); see also
OMB Guidelines, 40 Fed. Reg. at 28,952. We are unaware of any
judicial decisions that define the outer limits of the “routine use”
exception. In the absence of definitive legislative history or court rul­
ings to the contrary, we believe that the “routine use” exception affords
considerable latitude to a federal agency to disclose information in
furtherance of the purposes of that agency.
The USNCB, as well as other federal law enforcement agencies, have
interpreted the “routine use” exception to authorize disclosure of crimi­
nal history, investigative, and intelligence records for a wide variety of
law enforcement and humanitarian purposes. See 45 Fed. Reg. 75,902-
03 (Nov. 17, 1980) (disclosure of routine uses of Interpol Criminal
Investigative Records System). The USNCB has made the disclosures
required by the Privacy Act. See 45 Fed. Reg. 16,473 (March 12, 1981);
45 Fed. Reg. 75,903 (Nov. 17, 1980). We have reviewed the routine
uses listed by the USNCB, and believe they are consistent with the
scope of the Privacy Act “routine use” exemption. If the F.I.R. project
is implemented, however, the USNCB should consider at that point
whether additional disclosures are necessary to describe the relationship
between the F.I.R. system and the USNCB’s system of records, and the
exchange of information that will be made through the F.I.R. system.
The requirements of the Privacy Act may also affect how the F.I.R.
system should be structured. For example, under subsections (c)(1) and
(2), 5 U.S.C. § 552a(c)(l) and (2), the USNCB is required to keep an
accurate accounting of the date, nature, and purpose of each disclosure
of information subject to the Act, and the name and address of the
person or agency to whom the disclosure is made. If disclosures are
made directly through the F.I.R. system, the system must provide a
mechanism for the USNCB to keep the required accounting. In addi­
tion, the USNCB must be able to ensure the “security and confidential­
ity” of records in its system by “appropriate administrative, technical
and physical safeguards.” 5 U.S.C. 552a § (e)(10). The system should
allow the USNCB to screen incoming requests from other NCBs or
from the General Secretariat and to verify that the disclosure of re­
quested information would be consistent with the “routine uses” author­
ized for that information and with the Interpol constitution.16 As we
discuss below, the USNCB must also be able to screen outgoing infor­
mation.
l6The USNCB currently screens all requests from other NCBs for criminal history information to
determine that: (1) a crime has been committed in the country requesting the information, and the
crime would be considered a violation of U.S. law; (2) there is a link between the crime and the
individual about whom the information is requested; and (3) the type o f crime is not one encompassed
by Article III of the Interpol constitution.
383
C. Crim inal History Record Exchange Restrictions
When the USNCB obtains information from the FBI’s Computerized
Criminal History File or Identification Division systems, it is restricted
in the use of that information by regulations promulgated under the
Omnibus Crime Control and Safe Streets Act of 1968, supra. See 28
C.F.R. Part 20, Subpart C .17 Subsection 20.33 provides that data from
those systems will be made available by the FBI to, inter alia, “criminal
justice agencies for criminal justice purposes” and to “federal agencies
authorized to receive it pursuant to Federal statute or Executive
Order.” 28 C.F.R. § 20.33(a)(1) and (2). That exchange, however, is
“subject to cancellation if dissemination [of the information] is made
outside the receiving departments or related agencies.” Id. § 20.33(b).
We believe that disclosure of information from the FBI’s NCIC or
Identification Division files to Interpol and other NCBs is authorized
by this provision, on the ground that the disclosure is to a “related
agency.” We note in that regard that the purpose of the FBI’s exchange
of information with the USNCB is to facilitate similar exchanges with
constituents of Interpol, and that the FBI would be authorized under
these regulations to disclose such information directly to “criminal
justice agencies” in foreign countries, such as NCBs or the Interpol
General Secretariat. Under § 20.33(b), however, if the USNCB discloses
information obtained from the FBI’s CCH or Identification Division
files to foreign agencies not affiliated with Interpol or to private busi­
nesses, financial organizations, or individuals, its privilege of access to
those files would be subject to cancellation.
III. The USNCB’s Obligation to Verify Records
A separate question arising under the Privacy Act is the extent to
which the USNCB must verify data disclosed to other NCBs, the
Interpol General Secretariat, and state and local law enforcement agen­
cies in the United States. Under the Privacy Act, prior to dissemination
of any record about a United States citizen or permanent resident alien
to anyone other than another federal agency, the USNCB is required to
make “reasonable efforts to assure that such records are accurate,
complete, timely, and relevant for agency purposes.” 5 U.S.C.
§ 552a(e)(6).18
17 This subpart applies to “federal, state and local criminal justice agencies to the extent that they
utilize the services o f Department o f Justice criminal history record information systems.” 28 C.F.R.
§ 20.30. “D epartm ent o f Justice criminal history record information system*1 is defined to include only
the Identification Division and Com puterized Criminal History File Systems operated by the FBI. 28
C .F.R . § 20.3(j).
,8T he Privacy A ct authorizes exemption of law enforcement files such as the USNCB’s Criminal
Investigative System from most o f the requirements o f §552a(e) relating to the quality of records
collected and maintained by the agency. See 5 U.S.C. § 552a(j)(2) No exemption is authorized,
how ever, from the requirements imposed by § 552a(e)(6). Id.
384
This provision does not require the USNCB to guarantee the accu­
racy, completeness, timeliness, and relevance of records disclosed, but
only to make efforts that are reasonable given the administrative re­
sources of the agency, the risk that erroneous information will be
disseminated, and the possible consequences to an individual if errone­
ous information is disclosed. See OMB. Guidelines, 40 Fed. Reg. at
28,953; Smiertka v. United States Dep't o f Treasury, 447 F. Supp. 221,
225-26 & n.35 (D.D.C. 1978). Courts have noted in varying contexts
that reasonable efforts may include, at a minimum, modification or
deletion of information if the source of that information informs the
agency that the information is incorrect or incomplete;19 a request for
additional factual information from the source if an individual submits
evidence challenging the accurracy of information contained in the
agency’s files; 20 or modification or deletion of records if the agency’s
independent investigation and evaluation overwhelmingly shows that
the information is incorrect or unfounded.21 The OMB Guidelines sug­
gest that, because the disclosing agency is often not in a position to
evaluate “acceptable tolerances of error for the purposes of the recipi­
ent of the information,” it may be appropriate for the agency “to advise
recipients that the information disclosed was accurate as of a specific
date . . . or of other known limits on its accuracy e.g., its source.” 40
Fed. Reg. 28,949, 28,965 (July 9, 1975).
Since implementation of the F.I.R. project may substantially increase
the volume of requests and disclosures handled by the USNCB, it will
be particularly important to establish workable procedures and guide­
lines to implement the USNCB’s obligation under § 552a(e)(6). We
cannot outline here what “reasonable efforts” would be for the
USNCB, as that would require a detailed knowledge of how informa­
tion is collected, stored, retrieved, and disclosed.22 We note, however,
that the F.I.R. system must provide an adequate opportunity for the
USNCB to screen all data prior to their dissemination outside the
federal government and to supplement information disclosed, as appro­
priate, with caveats about its source, timeliness, or reliability.
IV. International Initiatives
You have asked us specifically to address the potential impact on
federal law enforcement systems of the OECD’s Guidelines Governing
the Protection of Privacy and Transborder Flows of Personal Data
" S e e Menard v Saxbe, 498 F.2d 1017, 1027-28 (D.C Cir. 1974).
“ See id.; Tarlton v. Saxbe, 507 F.2d 1116, 1129 (D.C. Cir. 1974).
21See Murphy v. National Security Agency, C.A. No. 79-1833 (D .D C . Sept. 29, 1981), memorandum
op. at 9; R.R. v. Dep't o f Army, 482 F. Supp. 770, .773 (D.D.C. 1980).
22 This analysis would be more appropriate, for example, for the Interpol Policy Guidelines
Working Group, which will be responsible for reviewing and updating policies applicable to the
USNCB’s day-to-day operations.
385
(OECD Guidelines) 23 and the Council of Europe’s Convention for the
Protection of Individuals with Regard to the Automatic Processing of
Personal Data (Council of Europe Convention),24 and any international
conflict of laws issues associated with United States participation in
Interpol and the Interpol F.I.R. project. Both the OECD Guidelines
and the Council of Europe Convention attempt to balance the need for
protection of personal privacy arising out of increasing flows of per­
sonal information across national borders, and the political and eco­
nomic necessity of maintaining transborder flows of data with minimal
restrictions. The OECD adopted the approach of voluntary guidelines,
based on certain “basic principles” of national application intended to
provide minimum privacy protection,25 and of international application,
intended to encourage the free flow of data.26 Member countries are
encouraged to establish, through legislation, self-regulation, or volun­
tary efforts, legal, administrative, and other procedures or institutions
for the protection of privacy, and to cooperate with other member
countries to facilitate international exchanges of information. See Parts
4, 5. We understand that the United States participated in drafting the
OECD Guidelines, and has undertaken to abide by the principles
therein.
The Council of Europe Convention requires each Party 27 to “take
the necessary measures in its domestic law to give effect to the basic
principles for data protection” set out in the Convention. Chap. II, f 1.
Those principles resemble in content the principles outlined in the
OECD Guidelines, with the addition of a specific provision that per­
sonal data that would reveal “racial origin, political opinions or reli­
gious or other beliefs, as well as personal data concerning health or
sexual life” or “personal data relating to criminal convictions” may not
be processed automatically “unless domestic law provides appropriate
safeguards.” Art. 6. Parties are obligated to provide mutual assistance
“ T he O E C D is an intergovernmental organization dedicated to problems o f economic develop- '
ment, whose members include the 19 democratic countries of Europe, the United States, Japan,
Australia, New Zealand, and Yugoslavia (special associate status).
24T he Council o f E urope is an intergovernmental organization o f 21 European countries. Its
members are pledged to cooperate at intergovernmental and interparliamentary levels to promote
greater E uropean unity. See Hondius, Data Law in Europe, 16 Stan. J. o f Int’l L. 87, 91 (1980). The
U nited States is not a member of the Council o f Europe.
25T hese principles encompass limits to collection o f personal data; accuracy, completeness, rel­
evance, and timeliness o f data; specification o f uses o f data and limitation to those uses; security
safeguards; openness in the establishment of systems and method of access to data; individual participa­
tion and access; and accountability. Part 2.
26 Member countries are to take into consideration the implications for other member countries of
dom estic processing and re-export of personal data; to take reasonable and appropriate steps to ensure
that transborder flows of personal d ata are uninterrupted and secure; to refrain from restricting
transborder flows o f personal data except where necessary; and to avoid developing laws, policies, and
practices in the name o f the protection of privacy and individual liberties, which would create
obstacles to transborder flows of personal data that would exceed requirements for such protection.
Part 3.
27 N o member o f the Council of E urope has yet ratified the Convention. The Convention will not
becom e effective until ratified by five members. Art. 22. Non-member states may be invited to accede
to the Convention following its entry into force. A rt 23.
386
to notify other parties of steps taken to implement the Convention, and
to assist persons resident abroad to exercise rights conferred under the
domestic laws that give effect to the principles set out in the Conven­
tion. Arts. 13, 14.
We note first that neither the OECD Guidelines nor the Council of
Europe Convention imposes any binding obligations on the United
States or on federal law enforcement agencies. The OECD Guidelines
are voluntary. Parts 4 and 5 of the Guidelines discuss various methods
for implementing the letter and spirit of the principles set forth through
appropriate domestic legislation and policies and international coopera­
tion, but do not impose any obligation upon parties other than mutual
cooperation. The Council of Europe may, after the entry into force of
the Convention, invite non-members to accede to the Convention. We
are unaware whether the United States will be invited to accede, and
whether the United States would accept that invitation. Since accession
would obligate the United States to pass domestic legislation consider­
ably broader in scope than that now in effect (see infra), it seems
unlikely that the United States would accede to the Convention if
invited, and we assume here that the United States will not accede to
the Convention. Thus, the impact on federal law enforcement agencies
will not stem from obligations imposed on the United States under
either the OECD Guidelines or the Council of Europe Convention, but
rather will most likely result from actions taken by other nations to
implement the letter or spririt of those agreements.
In particular, both the OECD Guidelines and the Council of Europe
Convention recognize the principle that a nation may restrict data
flows to another nation if that nation does not afford the same protec­
tion to that data as is afforded by the originating state, or if the export
of that data would circumvent the domestic privacy legislation of the
originating country.28 In that regard, the privacy protection contem­
plated by the OECD Guidelines and the Council of Europe Convention
is broader than that afforded by the Privacy Act. The Guidelines and
the Convention apply to all exchanges of information, private and
public.29 The Privacy Act, by contrast, leaves untouched information-
gathering and disclosure by state and local governments and by private
businesses or individuals.30 Thus, even if the Privacy Act embodies
most of the substantive requirements outlined in the OECD Guidelines
and the Council of Europe Convention,31 the coverage afforded by the
28See, e.g., O ECD Guidelines, Part 3, fl 17; Council of Europe Convention Arts. 3, 6, 12 (U 3(a)).
29T he Council of Europe Convention, however, applies only to information transmitted through
automatic data processing. Arts. 1, 2, 3.
30 There are federal statutes that restrict the use and disclosure of information by state and local
governments and private parties, but only in limited sectors. See, e.g., Fair Credit Reporting Act, IS
U.S.C. § 1681; Right to Financial Privacy Act of 1978, Pub. L. No. 95-630, 92 Stat. 3697 (codified at
scattered sections in 31 U.S.C.).
51The “basic principles'* o f data protection listed in Part 2 of the OECD Guidelines parallel in most
respects the underlying principles of the Privacy Act. See n. 25 supra.
387
Privacy Act is narrower than that of those agreements. The practical
result of this may be that nations adhering to one or both of those
agreements may refuse to disclose information to federal law enforce­
ment agencies within the United States, such as the USNCB, because
the United States does not provide protection for personal data that is
equivalent to that provided by the originating country.32 Under the
OECD Guidelines, United States agencies could similarly refuse to
disclose data if the requesting country could not adequately protect the
security or use of that information.
O f course, even without the express recognition of this principle
contained in the OECD Guidelines and the Council of Europe Conven­
tion, individual NCBs are free to restrict data flows for any reason,
including the lack of privacy legislation in the receiving country. The
express recognition of that prerogative in the OECD Guidelines and
the Council of Europe Convention has highlighted the problem of
protecting transborder data flows while ensuring personal privacy,
however, and we cannot predict what the practical impact will be on
federal law enforcement. This is clearly an area in which mutual co­
operation and voluntary compliance with privacy protection guidelines
could alleviate future problems.
It would be premature for us at this point to comment other than
generally on the possible international conflicts of law issues raised by
U.S. participation in Interpol and in the F.I.R. system. We note first
that Interpol, as an organization, occupies a somewhat anomalous posi­
tion under our law, as it was not established by treaty or protocol, and
is not generally accorded status as an international organization.33
While our participation is authorized by statute, the Interpol constitu­
tion has never been expressly approved by Congress or the Executive
Branch and does not have treaty status. Consequently, the Interpol
constitution and resolutions and rules adopted by the Interpol General
Assembly do not have the force of law in the United States and do not
confer any rights on United States citizens or residents that are enforce­
able in our courts. See U.S. Const., Art. VI, cl. 2; see generally,
Mannington Mills, Inc. v. Congoleum Corp., 595 F.2d 1287, 1298 (3d Cir.
1979); B ell v. Clark, 427 F.2d 200 (4th Cir. 1971). Where there is a
32 Federal, state, and local governments and private parties are not, of course, precluded from
voluntarily supplementing the protections required by applicable domestic legislation, in an effort to
avoid this potential problem.
33 T he Interpol constitution was adopted by the Interpol General Assembly in June, 1956. Ratifica­
tion o f the constitution does not require formal approval by member countries. All countries repre­
sented at Interpol are dee hied to be Interpol members unless they subsequently declare through
appropriate governmental authority th at they cannot accept the constitution. The United States has
never submitted any such nonacceptance declaration. The Interpol constitution has not been expressly
approved by the Executive Branch o r Congress. See Report o f the Comptroller General o f the United
States, “ United States Participation in IN TERPO L, T he International Criminal Police Organization”
(Dec. 27, 1976) at 9, 25. Interpol is not listed as an “international organization” for purposes of
immunity under the International Organizations Immunities Act, 22 U.S C. § 288
388
conflict between the USNCB’s obligations under the Interpol constitu­
tion or rules and its obligations under U.S. law, the latter will prevail.
Somewhat more difficult questions are presented under the domestic
laws of the various countries that participate in Interpol. Particularly as
the exchange of information among NCBs increases with implementa­
tion of the F.I.R. project, individuals of one country who are damaged
by disclosures of information through Interpol may seek redress based
on a variety of legal theories, such as defamation or invasion of pri­
vacy.34 In the simplest situation, where an NCB in country A discloses
information to an NCB in country B, and a person aggrieved by that
disclosure sues in one of those countries, a conflict of law question
would be presented as between the jurisdiction or substantive law of
country A and country B which could probably be handled under
existing principles of conflicts of law. See Restatement o f the Foreign
Relations Law o f the United States (2d) § 40. Exchanges of information
through the Interpol General Secretariat are more difficult because
they would raise the possibility that the jurisdiction and law of yet
another country (France) may be invoked. If the F.I.R. project is
implemented, the conflicts problems could become yet more compli­
cated, because information could be switched through a number of
countries, either by design or for technical reasons, on its way between
country A and country B.35 The OECD Guidelines and Council of
34 For example, in recent years at least two suits involving disclosures by the USNCB or by the
Interpol General Secretariat have been filed in United States courts, both seeking recovery for alleged
defamation by an official o f the USNCB or by the General Secretariat in connection with requests
forwarded through Interpol to detain or arrest an individual. See Steinberg v. InternationaI Criminal
Police Organization, 672 F.2d 927 (D.C Cir. 1981); Sami v. United States, 617 F.2d 755 (D.C. Cir.
1979). In both decisions, the court discussed only jurisdictional questions arising under United States
law, and did not address possible conflicts of law questions. In Sam i v. United States, the court held
that the Interpol General Secretariat was not “doing business” in the District o f Columbia for
purposes of exercise o f the D.C. long-arm statute, D.C. Code §§ 13-334. T he claim in that case arose
out of communications made by an official of the USNCB to the German NCB through Interpol
channels, requesting arrest of plaintiff, a citizen of Afghanistan, on the basis of an outstanding Florida
warrant. By contrast, in Steinberg v. International Criminal Police Organization, the same court held
that there was m personam jurisdiction over Interpol under the same statute, where the claim involved
Interpol's transmission o f a publication (a “ Blue Notice” requesting arrest) into the District of
Columbia. The court distinguished its result from that reached m Sam i on the basis that the Steinberg
case involved “an invocation of specific, not general, adjudicatory authority.” Slip op. at 5. The court
noted that it did not intend by its holding to foreclose any other defense, “jurisdictional or otherwise,”
that Interpol or its Secretary General might raise. Id. at 12, n.13.
35 A recent article has hypothesized the following situation to illustrate the problem. The health
records of a Swiss national are collected by his employer in Switzerland, and transmitted to corporate
headquarters in Amsterdam where they are processed,, stored, and aggregated with health records of
other nationals working in other countries. The aggregated data are then sent on via international
facilities to a United States-owned data processing service in the United States. While they are being
held in that facility, however, the main computer breaks down and an automatic switch sends the data
through international telecommunications facilities on to a secondary processing facility in Hong
Kong. The data are processed there and returned to the primary facility in the United States. A copy
o f the processed data is sent to storage at the primary site and the data are returned to Amsterdam.
The employer then sends it along to the employer’s insurance carrier, an Italian firm whose primary
data processing facilities are stored in Spain The insurance carrier again processes the data, stores
them in M adnd on magnetic tape, and issues the apprppriate group health policy to the employer. See
Fishman, Introduction to Transborder Data Flows, 16 Stan Int’l L.J. 1, 21 (1980). While this example is
drawn from the private processing of data, it is not difficult to imagine equally convoluted trails for
exchanges of criminal history information through F.I.R.
389
Europe Convention recognize that existing conflicts of laws principles
may not be adequate to deal with exchanges of information through
automated data processing in the future. The OECD’s Expert Group,
which drafted the guidelines, specifically rejected any detailed rules on
conflicts of law questions, following extensive debate. See Explanatory
Memorandum (Appendix), 1J22. The final Guidelines provide only that
“Member countries should work towards the development of princi­
ples, domestic and international, to govern the applicable law in the
case of transborder flows of personal data.” OECD Guidelines Part 5,
^|22. The Council of Europe Convention does not address the possible
conflicts of laws questions, other than to require Parties to render
“mutual assistance” in implementation of the Convention, including any
assistance necessary to facilitate the exercise of rights under a Party’s
domestic privacy legislation by “any person resident abroad.” Art. 14.
It is thus clear that before the F.I.R. project is implemented, the
members of Interpol will have to grapple with potential conflicts of
laws problems. Since the resolution of those problems has implications
beyond those arising out o f Interpol’s activities, it may not be possible
for the members of Interpol to reach a definitive consensus. It may be
possible, however, to avoid or mitigate some of the problems that may
arise from technical operation of the system (see n.36 supra) in the way
the system is structured. In the absence of concrete plans for the
system, it is difficult for us to speculate on what the problems or
possible solutions may be. We will, of course, be willing to work with
you and other federal agencies to develop applicable principles and
proposals, and to implement guidelines for operation of the F.I.R.
system, if the project is approved.
L a r r y L . S im m s
Deputy Assistant Attorney General
Office o f Legal Counsel
390