[Federal Register Volume 61, Number 139 (Thursday, July 18, 1996)]
[Notices]
[Pages 37495-37498]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 96-18328]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF JUSTICE

[AAG/A Order No. 119-96]


Privacy Act of 1974; New System of Records

    Pursuant to the provisions of the Privacy Act (5 U.S.C. 552a) and 
Office of Management and Budget Circular No. A-130, notice is hereby 
given that the Department of Justice proposes to establish a new system 
of records to be maintained by the Federal Bureau of Investigation.
    The National DNA Index System (NDIS) (JUSTICE/FBI-017) is a new 
system of records for which no public notice consistent with the 
provisions of 5 U.S.C. 552a(e) (4) and (11) has been published in the 
Federal Register.
    In order to comply with 5 U.S.C. 552a(e) (4) and (11), the public 
must be given a 30-day period in which to comment on new routine use 
disclosures; and the Office of Management and Budget (OMB), which has 
oversight responsibility under the Act, requires a 40-day period in 
which to review the system before it is implemented. Therefore, the 
public, the OMB, and the Congress are invited to submit written 
comments to Patricia E. Neely, Program Analyst, Information Management 
and Security Staff, Information Resources Management, Department of 
Justice, Washington, DC 20530 (Room 850, WCTR Building). Comments from 
the public must be received by August 19, 1996. No further notice will 
appear in the Federal Register unless comments are received and 
publication pursuant thereto is deemed appropriate. A proposed rule to 
exempt the system is also being published in the ``Proposed Rules'' 
Section of today's Federal Register.
    In accordance with Privacy Act requirements, the Department of 
Justice has provided a report on the proposed system of records to OMB 
and the Congress.

    Dated: July 8, 1996.
Stephen R. Colgate,
Assistant Attorney General for Administration.
JUSTICE/FBI-017
System name:
    National DNA Index System (NDIS).
System location:
    Federal Bureau of Investigation: FBI Laboratory, U.S. Department of 
Justice, J. Edgar Hoover Building, 935 Pennsylvania Ave., NW., 
Washington, DC 20535-0001.
Categories of individuals covered by the system:
    Individuals in this system include persons designated by criminal 
justice agencies as belonging to one or more of the following groups:
    A. Convicted offenders: Persons who have been convicted of crimes 
in Federal, State, and/or local courts where the applicable law permits 
establishment of a DNA record for the convicted person.
    B. Missing persons and their close biological relatives: Persons 
reported missing or whose whereabouts are unknown and sought and their 
close biological relatives, such as parents, siblings, and children.
    C. Victims: Persons, living or dead, who have been victims of 
crimes where the perpetrator of the crime may have

[[Page 37496]]

carried DNA of the victim away from the crime scene.
    D. DNA personnel: Personnel in Federal, State, and/or local 
criminal justice agencies who perform duties related to or are 
responsible for DNA records.
Categories of records in the system:
    The following definitions are used in this notice:
    A. A DNA sample is a body tissue or fluid sample usually a blood 
and/or buccal sample, that can be subjected to DNA analysis.
    B. A DNA profile consists of a set of DNA identification 
characteristics, i.e., the particular chemical form at the various DNA 
locations (loci), which permit the DNA of one person to be 
distinguishable from that of another person.
    C. A target DNA profile is a DNA profile submitted by a criminal 
justice agency for the purpose of identifying DNA profiles maintained 
by NDIS which match the target DNA profile.
    D. A target DNA profile search is a search of appropriate NDIS DNA 
records for those records with DNA profiles that may match the target 
DNA profile.
    E. Personally identifiable information is information such as 
names, dates of birth, or social security numbers which are normally 
used to identify individuals. Personally identifiable information, as 
used in this notice, does not include information derived from the 
examination of a DNA sample.
    F. A DNA record includes the DNA profile as well as data required 
to manage and operate NDIS, i.e., the NDIS Agency identifier which 
serves to identify the submitting agency; the NDIS Specimen 
Identification Number; information related to the reliability and 
maintainability of the DNA profiles; and names of the participating 
laboratories and DNA personnel associated with DNA profile analyses.
    Records in this system do not include DNA samples but do include 
DNA profiles of persons described under ``Categories of Individuals 
Covered by the System'' in paragraph A-C. DNA records are input by 
criminal justice agencies for use by the NDIS. NDIS includes the names 
of DNA personnel associated with DNA profile analyses, the date after 
which DNA records from a given DNA analyst can be accepted, and, when 
applicable, the date after which associated DNA records are not 
accepted. NDIS does not contain case-related or other personally 
identifying information about the person from whom the DNA sample was 
collected.
    DNA records are maintained as follows:
    1. The Convicted Offender Index, consisting of DNA records from 
convicted offenders;
    2. The Missing Persons Index, consisting of DNA records from 
missing persons;
    3. The Close Biological Relatives Index, consisting of DNA records 
from close biological relatives of missing persons;
    4. The Unidentified Persons Index, consisting of DNA records from 
recovered living persons (e.g., children who can't and others who can't 
or refuse to identify themselves), and recovered dead persons 
(including their body parts and tissues), whose identities are not 
known;
    5. The Victims Index, consisting of DNA records from victims, 
living or dead, from whom DNA may have been carried away by 
perpetrators;
    6. The Forensic Index, consisting of DNA records from persons whose 
identities are not known with certainty and who left DNA at the scene 
of a crime or whose DNA was carried away from it; and
    7. The Population File, consisting of DNA profiles intended to 
represent various population segments found in the United States. The 
Population File consists of DNA records from individuals whose 
identities may be: (a) Known to; (b) not known, but determinable under 
some circumstances by; or (c) not known and not determinable by the 
criminal justice agency submitting the DNA records to NDIS.
Authority for maintenance of the system:
    The Violent Crime Control and Law Enforcement Act of 1994, Pub. L. 
No. 103-322, 108 Stat. 1796.
Purpose(s):
    The purpose of this system and the DNA records maintained in the 
system is to provide a national storage medium for DNA records input by 
criminal justice agencies. These records can be searched in order to 
identify DNA associations with a DNA record obtained during an 
investigation of a crime or a missing person. The system is also 
maintained for statistical, identification research, and protocol 
development and quality control purposes.
    In addition to DNA records, records about DNA personnel are 
maintained in the system. The purposes of these DNA personnel records 
are to control the acceptance of DNA records by NDIS and to facilitate 
criminal justice agency contracts required to resolve potential DNA 
matches.
Routine uses of records maintained in the system, including categories 
of users and the purposes of such uses:
    1. Direct disclosures of NDIS records are made to the Federal, 
State, and local criminal justice agencies who participate in NDIS. As 
a result of an NDIS search by a criminal justice agency, the NDIS 
system analyzes the target DNA profile entered by the search agency and 
may identify a potential match. Where NDIS identifies a potential 
match, the matching DNA's records will be disclosed to the criminal 
justice agencies associated with the match.
    2. The Federal statute which authorizes NDIS also provides that the 
FBI and other criminal justice agencies participating in NDIS may make 
secondary or indirect disclosures of DNA records:
    (A) To criminal justice agencies for law enforcement identification 
purposes;
    (B) In judicial proceedings, if otherwise admissible pursuant to 
applicable statutes or rules;
    (C) For criminal defense purposes, to a defendant, who shall have 
access to samples and analyses performed in connection with the case in 
which defendant is charged; or
    (D) If personally identifiable information is removed, for a 
population statistics database, for identification research and 
protocol development purposes, or for quality control purposes.

    Note: Personal information such as names are not found in NDIS. 
However, operational identifiers such as the Specimen No., Criminal 
Justice Agency Identifier, and DNA Personnel identifier, are 
contained in NDIS. Although unlikely, the identity of an individual 
could, under some circumstances, be ascertained with the disclosure 
of such numbers for purposes stated in (D) above. This is only 
possible when access to a criminal justice agency's records is 
provided to the holder of the operational identifiers. Therefore, to 
ensure that such associations are not made, these operational 
numbers will be removed before disclosure for these purposes.

    3. A record may be disclosed from this system of records to the 
National Archives and Records Administration and the General Services 
Administration in records management inspections conducted under the 
authority of 44 U.S.C. 2904 and 2906, to the extent that legislation 
governing the records permits.

[[Page 37497]]

Policies and practices for storing, retrieving, accessing, retaining, 
and disposing of records in the system:
Storage:
    Information maintained in NDIS is stored electronically for use in 
a computer environment.
Retrievability:
    The primary method for retrieving information from NDIS is the 
target DNA profile search described in the routine use disclosure 
provisions of this notice.
    The NDIS Custodian may retrieve records based on: the DNA profile, 
the NDIS Agency identifier, the NDIS Specimen Identification Number, 
and/or DNA personnel identifier. Criminal justice agencies with direct 
access to NDIS may retrieve their records by the NDIS Agency 
identifier, NDIS Specimen Identification Number, or DNA personnel 
identifier but only to inspect, modify, or delete their own DNA 
records.
    Since NDIS records contained in NDIS do not include personal 
identifiers of the individuals from whom the DNA samples were 
collected, retrieval by personal identifiers of these record subjects 
is not possible.
Safeguards:
    All records in NDIS are protected from unauthorized access through 
appropriate administrative, physical, and technical safeguards. These 
safeguards include restricting access to those with a need-to-know to 
perform their official duties, using locks and alarm devices, and 
encrypting data communications.
    No personally identifiable information about individuals who 
provided DNA samples is maintained in NDIS. Therefore, names and 
personally identifiable information of NDIS DNA records cannot be 
disclosed directly from NDIS. (NDIS does, however, maintain the names 
of NDA personnel.)
    NDIS will disclose to a criminal justice agency the DNA records of 
another criminal justice agency only when there is a potential DNA 
match. Any additional disclosures of personally identifiable 
information or other case-related data are made directly by the 
criminal justice agencies from their own files and records, not from 
NDIS.
    Although ostensibly devoid of personally identifiable information, 
DNA records in NDIS contain an NDIS Specimen Identification Number, 
NDIS Agency identifier, and a DNA personnel identifier for law 
enforcement and/or general operational purposes. Since it is possible, 
in some circumstances, to use those numbers together with the 
appropriate agency's own records to identify the individuals 
represented by the DNA records, additional precautions are taken.
    The precautions involve removal of the Specimen Identification 
Numbers, NDIS Agency identifiers, and DNA personnel identifiers, prior 
to disclosure pursuant to the 2(D) routine use. (See the ``Routine Uses 
of Records Maintained in the System'' section of this notice.) Thus, 
NDIS will periodically generate DNA profile data sets, consisting of 
anonymous DNA profiles, for population statistics databases, for 
identification research and protocol development purposes, or for 
quality control purposes.
    Criminal justice agencies are prohibited from submitting a DNA 
record for inclusion in the NDIS Population File for investigative 
purposes. The only target DNA profile searches conducted against the 
Population File are those necessary to eliminate duplicate DNA profiles 
representing the same individual.
    Finally, criminal justice agencies with direct access to NDIS must 
agree to adhere to national quality assurance standards for DNA 
testing, undergo semi-annual external proficiency testing, and restrict 
access to DNA samples and data. The NDIS will not accept DNA analyses 
from those agencies and/or DNA personnel who fail to comply with these 
standards and restrictions; and the NDIS Custodian is authorized to 
restrict access to and delete any DNA records previously entered into 
the system.
Retention and Disposal:
    DNA records generated by criminal justice agencies, together with 
the personal identifying information of DNA personnel, shall be 
retained in NDIS as long as they are substantiated by internal records 
of the submitting agency and are permitted either by consent, by 
judicial/criminal justice authority, or by Federal, State, or local 
law. Records may be deleted by the originating criminal justice agency 
or by other Federal, State, or local authorities who are responsible 
for deleting any records that are no longer permitted or appropriate 
for retention in NDIS. DNA records submitted to NDIS and then found to 
be inaccurate shall either be modified to achieve accuracy or deleted 
from NDIS by the submitting agency.
    Agencies granted access to NDIS are required to establish and 
maintain a system of controls to ensure that continued use of their DNA 
records in NDIS is lawfully permitted. Such a system of controls shall 
ensure that DNA records in NDIS which are authorized by the consent of 
individuals, for example, are retained in NDIS only for the duration 
and within the scope of the consent.
    The NDIS Custodian has the authority to determine that certain DNA 
records in NDIS should be deleted or, alternatively, suspended from use 
for a period of time determined appropriate by the NDIS Custodian. The 
criminal justice agencies whose records are affected by a determination 
to delete or suspend records in NDIS shall be notified of this 
determination and the nature of the deletion or suspension. The NDIS 
Custodian may subsequently decide to either restore or delete the 
suspended records, and shall notify the affected agency of this 
subsequent determination.
    The DNA personnel identifier for a single individual is deleted 
from NDIS only after all DNA records associated with that individual 
are deleted.
System manager(s) and address:
    Director, Federal Bureau of Investigation, c/o National DNA Index 
System Custodian, FBI Laboratory, U.S. Department of Justice, J. Edgar 
Hoover Building, 935 Pennsylvania Avenue, NW., Washington, DC 20535-
0001.
Notification procedure:
    None. This system of records has been exempted from subsections (d) 
and (e)(4)(G) pursuant to subsection (j)(2) of the Privacy Act, and 
thus is exempt from the notification provision.
Records access procedure:
    This system of records has been exempted from subsection (d) and 
(e)(4)(H) pursuant to subsection (j)(2) of the Privacy Act, and thus is 
exempt from its access provisions. NDIS does not retain information 
that would allow the NDIS Custodian, independent of the agency which 
originated the DNA record, to personally identify the record by name or 
other personal identifier. However, subject to applicable Federal, 
State, and local law and procedures, the following alternative 
procedures are available by which an individual may request access to 
records in NDIS.
    1. Subjects of DNA Records:
    a. Convicted Offender Records: The individual may contact the 
Federal, State or local authority (the authorized agency) which 
ultimately received the collected DNA sample to obtain instructions on 
how to access his/her record. The authorized agency has the DNA record, 
if one exists, including information as to whether the DNA record has 
been submitted to NDIS. Only the authorized agency would have 
information sufficiently specific to

[[Page 37498]]

permit retrieval of the record from its files by name or other 
personally identifiable information. The authorized agency may also 
retrieve the DNA record, if any, that was submitted to NDIS, once 
locally specified requirements are met.
    In addition, where a convicted offender is relocated voluntarily or 
involuntarily to a criminal justice agency (i.e., penal institution or 
parole and probation authorities) for custodial or supervisory purposes 
in another State or jurisdiction, the DNA record may be created by the 
new host criminal justice agency or other State (or Federal) authority 
from a DNA sample collected from the Convicted Offender at the new host 
criminal justice agency or other State (or Federal) authority. In such 
circumstances, the individual may contact such agency or authority for 
access instructions.
    b. Close Biological Relatives of Missing Persons and Victims; 
Living Victims; and Missing Persons Who Have Been Located: These 
individuals must contact the criminal justice agency (Federal, State, 
or local) which collected and processed the DNA sample to generate the 
DNA record. The criminal justice agency can then advise the individual 
about procedures for access to the DNA record. Such agency may also 
retrieve the DNA record, if any, that was submitted to NDIS, once 
locally specified requirements are met.
    2. Records of DNA Personnel: These individuals may write to the 
Federal, State, or local criminal justice agency by which they are or 
were employed.
    3. FBI generated records: The subject of an FBI-generated DNA 
record may address a Freedom of Information/Privacy Act (FOIA/PA) 
request to the Director, FBI, at the address given at the end of this 
paragraph. DNA personnel employed by the FBI may also address their 
requests to the system manager; however, all the information in NDIS 
concerning DNA personnel is also contained in the FBI's Central Records 
System (CRS), which may contain additional information. To request 
access to the CRS, DNA personnel may address an FOIA/PA request to the 
Director, FBI, U.S. Department of Justice, J. Edgar Hoover Building, 
935 Pennsylvania Ave., NW., Washington, DC 20535-0001.
Contesting records procedure:
    This system of records has been exempted from subsections (d) and 
(e)(4)(H) pursuant to subsection (j)(2) of the Privacy Act, and is thus 
exempt from its amendment and correction provisions. However, subject 
to applicable Federal, State, and local laws and procedures, the 
following alternative procedures are available by which an individual 
may contest his/her records:
    1. All Subjects of DNA Records: The requester must follow the same 
procedures for contesting records as those outlined under ``Record 
Access Procedures.'' In addition, the requester should be aware of the 
following:
    a. DNA records submitted to NDIS and contested on the basis of 
inaccurate information must be resolved with the criminal justice 
agency that submitted the DNA record NDIS. If a contested DNA record is 
found to be inaccurate by the criminal justice agency submitting the 
DNA record, such agency shall correct the inaccurate DNA record by 
either amending or deleting the record.
    b. DNA records submitted to NDIS and contested on the basis of the 
authority to retain the DNA record must be resolved with the criminal 
justice agency that submitted the contested DNA record. If such agency 
determines that the contested DNA records should not be included in 
NDIS, such agency must delete the contested DNA record.
    2. Records of All DNA Personnel: DNA personnel must follow the same 
procedures for contesting records as those outlined under ``Record 
Access Procedures.''
record source categories:
    DNA records in NDIS are received from Federal, State, and local 
criminal justice agencies. These DNA records may be derived from DNA 
samples obtained by Federal, State, and local and criminal justice 
agencies or their agents (public or private).
Systems exempted from certain provisions of the Act:
    The Attorney General has exempted this system of records from 
subsection (c) (3) and (4); (d); (e) (1), (2), and (3); (e)(4) (G) and 
(H); (e) (5) and (8); and (g) of the Privacy Act pursuant to 5 U.S.C. 
552a(j)(2). Rules are being promulgated in accordance with the 
requirements of 5 U.S.C. 553 (b), (c), and (e); and are being published 
in the Federal Register.
[FR Doc. 96-18328 Filed 7-17-96; 8:45 am]
BILLING CODE 4410-02-M