[Federal Register Volume 70, Number 32 (Thursday, February 17, 2005)]
[Proposed Rules]
[Pages 8050-8054]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 05-3045]


-----------------------------------------------------------------------

NATIONAL CRIME PREVENTION AND PRIVACY COMPACT COUNCIL

28 CFR Part 907

[NCPPC 108]


Compact Council Procedures for Compliant Conduct and Responsible 
Use of the Interstate Identification Index (III) System for Noncriminal 
Justice Purposes

AGENCY: National Crime Prevention and Privacy Compact Council.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Compact Council, established pursuant to the National 
Crime Prevention and Privacy Compact (Compact), is publishing a rule 
proposing to establish a procedure for ensuring compliant conduct and 
responsible use of the Interstate Identification Index (III) System for 
noncriminal justice purposes as authorized by Article VI of the 
Compact.

DATES: Comments must be received on or before March 21, 2005.

ADDRESSES: Send all written comments concerning this proposed rule to 
the Compact Council Office, 1000 Custer Hollow Road, Module C3, 
Clarksburg, WV 26306; Attention: Todd C. Commodore. Comments may also 
be submitted by fax at (304) 625-5388. To ensure proper handling, 
please reference ``Compliant Conduct and Responsible Use of the 
Interstate Identification Index (III) for Noncriminal Justice 
Purposes'' on your correspondence. You may view an electronic version 
of this proposed rule at http://www.regulations.gov. You may also 
comment via electronic mail at [email protected] or by using the http://www.regulations.gov comment form for this regulation. When submitting 
comments electronically you must include NCPPC Docket No. 108 in the 
subject box.

FOR FURTHER INFORMATION CONTACT: Ms. Donna M. Uzzell, Compact Council 
Chairman, Florida Department of Law Enforcement, 2331 Philips Road, 
Tallahassee, Florida 32308-5333, telephone number (850) 410-7100.

SUPPLEMENTARY INFORMATION: The National Crime Prevention and Privacy 
Compact, 42 U.S.C. 14616, establishes uniform rules, procedures, and 
standards for the interstate and federal-state exchange of criminal 
history records for noncriminal justice purposes. The Compact was 
signed into law on October 9, 1998, (Pub. L. 105-251) and became 
effective on April 28, 1999, when ratified by the second state. The 
Compact provides for the expeditious provision of Federal and State 
criminal history records to governmental and nongovernmental agencies 
that use such records for noncriminal justice purposes authorized by 
pertinent Federal and State law, while simultaneously enhancing the 
accuracy of the records and safeguarding the information contained 
therein from unauthorized disclosure or use.
    To carry out its responsibilities under the Compact, the Compact 
Council is authorized under Article III and Article VI to establish III 
System rules, procedures, and standards concerning record dissemination 
and use, response times, data quality, system security, accuracy, 
privacy protection and other aspects of III System operation for 
noncriminal justice purposes. Access to records is conditional upon the 
submission of the subject's fingerprints or other approved forms of 
positive identification with the record check request as set forth in 
Article V of the Compact. Further, any record obtained under the 
Compact may be used only for the official purposes for which the record 
was requested.
    Article III(a) of the Compact requires the Director of the FBI to 
appoint a Compact Officer (herein referred to as the FBI Compact 
Officer) to administer the Compact within the Department of Justice 
(DOJ) and among Federal agencies and other agencies and organizations 
that submit search requests to the FBI and to ensure that Compact 
provisions and Compact Council rules, procedures, and standards are 
complied with by DOJ and other Federal agencies and other agencies and 
organizations. Article III(b) requires each Party State to appoint a 
Compact Officer (herein referred to as the State Compact Officer) who 
shall administer the Compact within the state, ensure that Compact 
provisions and Compact Council rules, procedures, and standards are 
complied with, and regulate the in-state use of records received by 
means of the III System from the FBI or from other Party States.

Background

    Pursuant to Articles VI and XI respectively, the Compact Council 
has the authority to promulgate rules and procedures governing the use 
of the III system for noncriminal justice purposes and has the initial 
authority to make determinations with respect to any dispute regarding 
interpretation of the Compact, any rule or standard established by the 
Compact Council pursuant to Article VI of the Compact, and any dispute 
or controversy between any parties to the Compact. Based upon its 
authority under the Compact, the Compact Council may impose appropriate 
sanctions against agencies that do not operate in accordance with the 
Compact and rules and procedures promulgated by the Compact Council.
    The Compact Council is establishing this rule to protect and 
enhance the accuracy and privacy of III System records, to ensure that 
only authorized access to records is permitted, and to ensure that 
records are used and disseminated only for particular authorized 
noncriminal justice

[[Page 8051]]

purposes. The procedures established by the rule will be used in 
determining compliant conduct and responsible use of III System records 
and in addressing any violations that may be detected.
    This rule acts as public notice that unauthorized access to the III 
System for noncriminal justice purposes or misuse of records obtained 
by means of the System for such purposes may result in the imposition 
of sanctions by the Compact Council, which may include the suspension 
of noncriminal justice access to the III System should the violation be 
found egregious or constitute a serious risk to the integrity of the 
System.
    The Compact requires the FBI Director to appoint an FBI Compact 
Officer to ensure that federal agencies comply with rules, procedures, 
and standards established by the Compact Council but does not directly 
address the FBI's responsibility to ensure state compliance. The Act 
adopting the Compact, however, provides that all United States 
departments and agencies shall enforce the Compact and cooperate with 
one another and with all Party States in enforcing the Compact and 
effectuating its purposes. Pursuant to this direction and authority, 
the FBI Criminal Justice Information Services (CJIS) Division has 
agreed to regularly conduct systematic compliance reviews of state 
repositories and selected agencies for compliance with the Compact and 
Compact Council rules on use of the III System. The Compact Council 
established the audit team and approved the audit methodology that will 
be used to conduct periodic reviews of the FBI and agencies that submit 
record check requests to the FBI under federal authority. (For a copy 
of the FBI Audit Methodology, contact the FBI Compact Council Office). 
The Compact Council and its Sanctions Committee intend to work in 
concert with the CJIS Advisory Policy Board's (APB) Ad Hoc Sanctions 
Subcommittee to examine findings from FBI CJIS Division staff reviews 
and determine the proper arbiter over the sanctions process for each 
finding or instance of violation. The APB will continue to serve in its 
role as an advisor to the FBI, which has exclusive jurisdiction in 
matters regarding the use of the III System for criminal justice 
purposes. This advisory capacity includes recommending sanctions to the 
FBI Director related to violations by criminal justice agencies using 
the III System for criminal justice purposes. If it is determined that 
a sanction should be imposed on a criminal justice agency for misusing 
the III System for a noncriminal justice purpose, the Compact Council 
will request that the Director of the FBI take appropriate action.
    In determining applicable actions or sanctions for noncompliance 
with Compact provisions or Compact Council rules, the Compact Council 
shall take into consideration: (1) Any meritorious, unusual or 
aggravating circumstances which affect the seriousness of the 
violation; (2) circumstances that could not reasonably have been 
foreseen by the FBI, state repository, user agency, or others; and (3) 
the nature and seriousness of the violation, including whether it was 
intentional, technical, inadvertent, committed maliciously, committed 
for gain, or repetitive. A pattern or practice of noncompliance by an 
agency may be grounds for the imposition of sanctions. The Compact 
Council may evaluate relevant documentary evidence available from any 
source.
    If, as a result of a compliance review or on the basis of other 
credible information, the Compact Council determines that an agency is 
not operating in accordance with the Compact and applicable rules, 
procedures, and standards, prompt notice will be given of the nature of 
the noncompliance and the possible consequences of failure to take 
effective corrective action. A concerted effort will be made to 
persuade the offending agency to comply voluntarily. Efforts to secure 
voluntary compliance will be undertaken at the outset in every 
noncompliance situation and will be pursued through each stage of 
corrective action. However, where a noncompliant agency fails to 
provide adequate assurance of compliance or apparently breaches the 
terms of such assurance, the Compact Council will take the appropriate 
actions which could include imposing sanctions or requiring corrective 
action necessary to ensure compliance. The Compact Council will be 
flexible in determining what corrective actions or sanctions are 
appropriate and generally will require the minimal action or impose the 
least severe sanction necessary to ensure compliance and deter 
violations.

Administrative Procedures and Executive Orders

Administrative Procedure Act

    This rule is published by the Compact Council as authorized by the 
National Crime Prevention and Privacy Compact (Compact), an interstate 
and Federal-State compact which was approved and enacted into 
legislation by Congress pursuant to Pub. L. 105-251. The Compact 
Council is composed of 15 members (with 11 State and local governmental 
representatives).
    The Compact Council is not a federal agency as defined in the 
Administrative Procedure Act. Accordingly, rulemaking by the Compact 
Council pursuant to the Compact is not subject to the Act. However, the 
Compact specifically provides that the Compact Council shall prescribe 
rules and procedures for the effective and proper use of the Interstate 
Identification Index (III) System for noncriminal justice purposes, and 
mandates that such rules, procedures, or standards established by the 
Compact Council be published in the Federal Register. See 42 U.S.C. 
14616, Articles II(4), VI(a)(1), and VI(e). This publication complies 
with those requirements.

Executive Order 12866

    The Compact Council is not an executive department or independent 
regulatory agency as defined in 44 U.S.C. 3502; accordingly, Executive 
Order 12866 is not applicable.

Executive Order 13132

    The Compact Council is not an executive department or independent 
regulatory agency as defined in 44 U.S.C. 3502; accordingly, Executive 
Order 13132 is not applicable. Nonetheless, this rule fully complies 
with the intent that the national government should be deferential to 
the States when taking action that affects the policymaking discretion 
of the States.

Executive Order 12988

    The Compact Council is not an executive agency or independent 
establishment as defined in 5 U.S.C. 105; accordingly, Executive Order 
12988 is not applicable.

Unfunded Mandates Reform Act

    Approximately 75 percent of the Compact Council members are 
representatives of state and local governments; accordingly, rules 
prescribed by the Compact Council are not Federal mandates. No actions 
are deemed necessary under the provisions of the Unfunded Mandates 
Reform Act of 1995.

Small Business Regulatory Enforcement Fairness Act of 1996

    The Small Business Regulatory Enforcement Fairness Act (title 5, 
U.S.C. 801-804) is not applicable to the Compact Council's rule because 
the Compact Council is not a ``Federal agency'' as defined by 5 U.S.C. 
804(1). Likewise, the reporting requirement of the Congressional Review 
Act (subtitle E

[[Page 8052]]

of the Small Business Regulatory Enforcement Fairness Act) does not 
apply. See 5 U.S.C. 804.

List of Subjects in 28 CFR Part 907

    Privacy, Accounting, Auditing.

    For the reasons set forth above, the National Crime Prevention and 
Privacy Compact Council proposes to reserve parts 903, 904, and 905 and 
add part 907 to chapter IX of title 28 Code of Federal Regulations to 
read as follows:

PART 907--COMPACT COUNCIL PROCEDURES FOR COMPLIANT CONDUCT AND 
RESPONSIBLE USE OF THE INTERSTATE IDENTIFICATION INDEX (III) SYSTEM 
FOR NONCRIMINAL JUSTICE PURPOSES

Sec.
907.1 Purpose and authority.
907.2 Applicability.
907.3 Assessing compliance.
907.4 Methodology for resolving noncompliance.
907.5 Sanction adjudication.

    Authority: 42 U.S.C. 14616.


Sec.  907.1  Purpose and authority.

    The purpose of this part 907 is to establish policies and 
procedures to ensure that use of the III System for noncriminal justice 
purposes complies with the National Crime Prevention and Privacy 
Compact (Compact) and with rules, standards, and procedures established 
by the Compact Council regarding application and response procedures, 
record dissemination and use, response times, data quality, system 
security, accuracy, privacy protection, and other aspects of III System 
operation for noncriminal justice purposes. The rule is established 
pursuant to Article VI of the Compact, which authorizes the Compact 
Council to promulgate rules, procedures, and standards governing the 
use of the III System for noncriminal justice purposes. The rule 
requires responsible authorized access to the System and use of records 
obtained by means of the System. It provides a comprehensive procedure 
for a coordinated compliance effort among the Compact Council, the FBI, 
and local, state and federal government agencies, and encourages the 
cooperation of all affected parties.


Sec.  907.2  Applicability.

    This rule applies to access to the III System for noncriminal 
justice purposes as covered by the Compact, See 42 U.S.C. 14614 and 
14616, and the use of information obtained by means of the System for 
such purposes. The rule establishes procedures for ensuring that the 
FBI and the criminal history record repositories of Compact Party 
States carry out their responsibilities under the Compact, as set out 
in the National Fingerprint File (NFF) Qualification Requirements, and 
that federal, state and local agencies that use the III System for 
noncriminal justice purposes comply with the Compact and with 
applicable Compact Council rules.


Sec.  907.3  Assessing compliance.

    (a) The FBI CJIS Division staff shall regularly conduct systematic 
compliance reviews of state repositories. These reviews may include, as 
necessary, reviews of III System user agencies, including governmental 
and nongovernmental noncriminal justice entities that submit 
fingerprints to the state repositories and criminal justice and 
noncriminal justice entities with direct access to the III System. 
These reviews may include, as necessary, the governmental and 
nongovernmental noncriminal justice agencies authorized to submit 
fingerprints directly to the FBI. The reviews may consist of systematic 
analyses and evaluations, including on-site investigations, and shall 
be as comprehensive as necessary to adequately ensure compliance with 
the Compact and Compact Council rules. Violations may also be reported 
or detected independently of a review.
    (b) The FBI CJIS Division staff or the audit team established to 
review the FBI shall prepare a draft report describing the nature and 
results of each review and setting out all findings of compliance and 
noncompliance, including any reasons for noncompliance and the 
circumstances surrounding the noncompliance. If the agency under review 
is the FBI or another federal agency, the draft report shall be 
forwarded to the FBI Compact Officer. If the agency under review is a 
state agency in a Party State, the draft report shall be forwarded to 
the State Compact Officer. If the agency under review is a state agency 
in a Nonparty State, the draft report shall be forwarded to the chief 
administrator of the state repository.
    (c) The Compact Officer of the FBI or a Party State or the chief 
administrator of the state repository in a Nonparty State shall be 
afforded the opportunity to forward comments and supporting materials 
to the FBI CJIS Division staff or to the audit team.
    (d) The FBI CJIS Division staff or the audit team shall review any 
comments and materials received and shall incorporate applicable 
revisions into a final report. The final report shall be provided to 
the Compact Officer of the FBI or a Party State or the chief 
administrator of the state repository in a Nonparty State to whom the 
draft report was sent. If the agency under review is a state agency, a 
copy of the report shall be provided to the FBI Compact Officer. If the 
agency under review is being reviewed for the first time, the letter 
transmitting the report shall provide that sanctions will not be 
imposed regarding any deficiencies set out in the report. The letter 
shall also advise, however, that the deficiencies must be remedied and 
failure to do so before the agency is reviewed again will result in the 
initiation of remedial action pursuant to Sec.  907.4.


Sec.  907.4  Methodology for resolving noncompliance.

    (a) Subsequent to each compliance review that is not a first-time 
agency review, the final report shall be forwarded to the Compact 
Council Sanctions Committee (Sanctions Committee). The Sanctions 
Committee shall review the report and if it concludes that no 
violations occurred or no violations occurred that are serious enough 
to require further action, it shall so advise the Compact Council 
Chairman. The Compact Council Chairman shall send a letter to this 
effect to the FBI or Party State Compact Officer or the chief 
administrator of the state repository in a Nonparty State which has 
executed a Memorandum of Understanding. For all remaining states, the 
FBI Director or Designee shall send the letter to the chief 
administrator of the state repository. If the agency under review is a 
state agency, a copy of the letter shall be provided to the FBI Compact 
Officer.
    (b) Should the Sanctions Committee conclude that a violation has 
occurred that is serious enough to require redress, the Sanctions 
Committee shall recommend to the Compact Council a course of action 
necessary to bring the offending agency into compliance and require the 
offending agency to provide assurances that subsequent violations will 
not occur. In making its recommendation, the Sanctions Committee shall 
consider the minimal action necessary to ensure compliance or shall 
explain why corrective action is not required. This may include, but 
not be limited to, requiring a plan of action by the offending agency 
to achieve compliance, with benchmarks and performance measures, and/or 
requiring the agency to seek technical assistance to identify sources 
of the problem and proposed resolutions. If the Compact Council 
approves the Sanctions Committee's recommendations, the following 
progressive actions shall be initiated:
    (1) The Compact Council Chairman shall send a letter to the Compact

[[Page 8053]]

Officer of the FBI or Party State or the chief administrator of the 
state repository in a Nonparty State which has executed a Memorandum of 
Understanding. For all remaining states, the FBI Director or Designee 
shall send the letter to the chief administrator of the state 
repository. The letter shall identify the violations and set out the 
actions necessary to come into compliance. The letter shall provide 
that if compliance is not achieved and assurances provided that 
minimize the probability that subsequent violations will occur, and 
non-compliance is not excused, the Compact Council may authorize the 
FBI to refuse to process requests for criminal history record checks 
for noncriminal justice purposes from the offending agency and, if the 
offending agency is a criminal justice agency, may request the Director 
of the FBI to take appropriate action against the offending agency 
consistent with the recommendations of the Compact Council. The letter 
shall direct the Compact Officer of the FBI or Party State or the chief 
administrator of the state repository in a Nonparty State to submit a 
written response within 30 calendar days from the date of the letter, 
unless a more expeditious response is required. If the offending agency 
is a state agency, a copy of the letter shall be provided to the FBI 
Compact Officer. Written responses from the FBI, Party States, and 
Nonparty States that have executed a Memorandum of Understanding shall 
be sent to the Compact Council Chairman. The written response for all 
remaining states shall be sent to the FBI Director or Designee. The 
offending agency's response letter shall go to the Compact Officer of 
the FBI or Party State or the chief administrator of the state 
repository in a Nonparty State and shall outline the course of action 
it will undertake to correct the deficiencies and provide assurances 
that subsequent violations will not recur. Response letters that are 
received by the FBI Director or Designee shall be made available to the 
Compact Council Chairman. The Compact Council Chairman shall refer the 
response to the Sanctions Committee for appropriate action.
    (2) If the Sanctions Committee deems the response letter under 
paragraph (b)(1) of this section to be insufficient, or if no response 
is received within the allotted time, the Sanctions Committee shall 
report its finding to the Compact Council. If the Compact Council 
agrees with the Sanctions Committee's finding, it shall direct the 
Compact Council Chairman to send a letter to the Director of the FBI 
(if the offending agency is the FBI or another federal agency) or to 
the head of the state agency in which the state repository resides (if 
the offending agency is a state agency), requesting assistance in 
correcting the deficiencies. The letter shall provide that the 
offending agency is being placed on probationary status. A copy of the 
letter shall be sent to the Compact Officer of the FBI or Party State 
or the chief administrator of the state repository in a Nonparty State. 
If the offending agency is a state agency, a copy of the letter shall 
be provided to the FBI Compact Officer. The offending agency's written 
response to the letter shall be required within 20 calendar days from 
the date of the letter unless the Compact Council requires a more 
expeditious response. The Compact Council Chairman shall refer the 
response letter to the Sanctions Committee for appropriate action.
    (3) If the Sanctions Committee deems the response letter under 
paragraph (b)(2) of this section to be insufficient, or if no response 
is received within the allotted time, the Sanctions Committee shall 
report its finding to the Compact Council. If the Compact Council 
agrees with the Sanctions Committee's finding, it shall direct the 
Compact Council Chairman to send a letter to the U.S. Attorney General 
(if the offending agency is the FBI or another federal agency) or to 
the elected/appointed state official who has oversight of the 
department in which the state repository resides (if the offending 
agency is a state agency), requesting assistance in correcting the 
deficiencies. If the state official is not the Governor, a copy of the 
letter shall be sent to the Governor. A copy of the letter shall also 
be sent to the FBI Compact Officer and (if the offending agency is a 
state agency) to the State Compact Officer or the chief administrator 
of the state repository in a Nonparty State. The letter shall provide 
that a written response is required within 20 calendar days of the date 
of the letter, and that if a sufficient response is not received within 
that time, sanctions may be imposed that could result in suspension of 
the offending agency's access to the III System for noncriminal justice 
purposes. The Compact Council Chairman shall refer the response letter 
to the Sanctions Committee for appropriate action.
    (4) If no response letter is received under paragraph (b)(3) of 
this section within the allotted time, or if the Sanctions Committee 
deems the response to be insufficient, the Sanctions Committee shall 
report its finding to the Compact Council. If the Compact Council 
agrees with the Sanctions Committee's finding, the Compact Council 
Chairman shall direct the FBI Compact Officer to take appropriate 
action to suspend noncriminal justice access to the III System by the 
offending agency. If the offending agency is a criminal justice agency, 
the Compact Council Chairman shall request the Director of the FBI to 
take appropriate action to suspend noncriminal justice access to the 
III System by the offending agency.
    (5) Reinstatement of full service by the FBI shall occur after the 
Compact Officer of the FBI or a Party State or the chief administrator 
of the state repository in a Nonparty State provides to the Compact 
Council Chairman and the Sanctions Committee satisfactory documentation 
that the deficiencies have been corrected or a process has been 
initiated and approved by the Sanctions Committee and the Compact 
Council Chairman to correct the deficiencies. If the Sanctions 
Committee approves the documentation in consultation with the Compact 
Council Chairman, the Compact Council Chairman shall request the FBI 
Compact Officer to take appropriate action to reinstate full service. 
Letters to this effect shall be sent to all persons who have previously 
received letters relating to the deficiencies and resulting suspension 
of service. The decision to reinstate full service shall be considered 
for ratification by the Compact Council at its next regularly scheduled 
meeting.
    (c) For good cause, the Compact Council Chairman shall be 
authorized to extend the number of days allowed for the response 
letters required by paragraphs (b) (1) through (3) of this section.


Sec.  907.5  Sanction adjudication.

    A Compact Officer of the FBI or a Party State or the chief 
administrator of the state repository in a Nonparty State may dispute a 
sanction under this Part by asking the Compact Council Chairman for an 
opportunity to address the Compact Council.
    Unresolved disputes based on the Compact Council's issuance of 
sanctions under this Part may be referred to the Compact Council 
Dispute Adjudication Committee when pertaining to disputes described 
under ARTICLE XI(a) of the Compact.
    Nothing prohibits the Compact Council from requesting the FBI to 
exercise immediate and necessary action to preserve the integrity of 
the III System pursuant to Article XI(b) of the Compact.


[[Page 8054]]


    Dated: January 28, 2005.
Donna M. Uzzell,
Compact Council Chairman.
[FR Doc. 05-3045 Filed 2-16-05; 8:45 am]
BILLING CODE 4410-02-P