Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal Justice Functions

• Court: Department of Justice Office of Legal Counsel
• Decided: June 12, 1998
• Status: Published

Opinion

Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal Justice Functions

N on-govem m ental entities perform ing authorized crim inal ju stice functions under contract w ith govern­ m ent law enforcem ent agencies may be granted access to crim inal history records m aintained under the authority o f 28 U.S.C. § 534, subject to effective controls to guard against unauthorized use and to ensure effective oversight by the D epartm ent o f Justice.

B ecause D epartm ent o f Justice regulations im plem enting 28 U S C. § 534 do not affirm atively authorize dissem ination o f crim inal history records to non-govem m ental entities under contract to assist law enforcem ent agencies, those regulations should be am ended to provide such authorization before access is granted to those entities.

June 12, 1998

M e m o r a n d u m O p in io n f o r t h e D e p u t y D ir e c t o r F e d e r a l B u r e a u o f In v e s t i g a t i o n

This responds to your request for our legal opinion concerning the circumstances in which non-govemmental entities performing criminal justice functions under contract with government law enforcement agencies may be granted access to criminal history records information ( “ CHRI” ) subject to the provisions of 28 U.S.C. §534 (1994).' We conclude that the Attorney General, or her delegee,2 may permit such access in appropriate circumstances under § 534. Should the Attorney General decide to do so, we believe that the governing regulation, 28 C.F.R. pt. 20 (1997), should be amended in accordance with the rulemaking requirements of the Administrative Procedure Act (“ APA” ), see 5 U.S.C. §553 (1994), for the reasons discussed below.* Finally, any proposal to permit con­ tractor access to CHRI must incorporate effective controls to guard against unauthorized use or release of CHRI by the contractors and to insure that the Department can maintain effective oversight.

I.

Section 534 directs the Attorney General to “ acquire, collect, classify, and pre­ serve identification, criminal identification, crime, and other records” and to “ exchange such records and information with, and for the official use of, author­ ized officials of the Federal Government, the States, cities, and penal and other

* Editor’s Note. The Department’s regulations have since been amended to authorize the category o f controlled access discussed in this opinion See 28 C.F.R § 20 33(a)(7) (2000). 1Memorandum for Dawn Johnsen, Acting Assistant Attorney General, Office o f Legal Counsel, from Robert M Bryant, Deputy Director, FBI, Re Access to and Dissemination o f Information from the Department o f Justice (DOJ) Criminal History Record Information (CHRI) System (Oct. 3, 1997) ( “ FBI M emo” ) 2 The Attorney General has delegated her CHRI exchange responsibilities to the Federal Bureau of Investigation ( “ FBI” ). See 28 C.F R. § § 0 85(b), 20 31(b) (1997).

119 Opinions o f the Office o f Legal Counsel in Volume 22

institutions.” 3 28 U.S.C. § 534(a)(1), (4). The statute thus requires the Attorney General to collect, maintain, and exchange criminal identification records with federal, state, and local criminal justice agencies. Although the statute does not expressly preclude such agencies from sharing these records with third parties, it provides that “ [t]he exchange o f records and information authorized by sub­ section (a)(4) of this section is subject to cancellation if dissemination is made outside the receiving departments o r related agencies.” Id. § 534(b). This office has previously construed the phrase “ related agencies” to include only those agencies expressly authorized under § 534(a) to receive CHRI directly from the Department. See Memorandum to Files, from Mary C. Lawton, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Railroad Police Access to FBI Criminal Identification Records at 5 (June 22, 1978) (“ Lawton M emo” ). As we read the statute, it does not on its face forbid the government agencies that are authorized to receive CHRI from sharing it with private contractors assisting them in the performance o f their duties. However, § 534(b) provides an enforcement mechanism that enables the Attorney General to oversee the use of CHRI by recipients. This statutory provision, which vests authority in the Attorney General to cancel CHRI exchange arrangements, contemplates that she may invoke that authority in order to guard against the improper use or redissemination of the CHRI that the FBI provides. Accordingly, as further discussed below, the statute would permit the Attorney General to authorize the disclosure of CHRI to private contractors performing criminal justice functions for government agen­ cies that are authorized to receive CHRI, but any such authorization would have to impose controls on the recipients and their contractors to preserve the Attorney General’s statutory oversight authority. Rather than expressly prohibiting categories of CHRI disclosures, § 534(a)(4) merely limits mandatory CHRI exchanges to those that are for the “ official use” of the designated “ authorized officials.” The text of §534 does not address whether a private contractor acting under the direction, or on behalf, of such “ authorized officials” could be said to be engaged in, enabling, or facilitating the “ official use” of the CHRI by those officials. On the other hand, § 534(b) pointedly discourages the “ dissemination” of cov­ ered records outside “ the receiving departments or related agencies,” by providing that such dissemination “ subjects]” the noncompliant agency or department to possible cancellation of its exchange privileges under the statute. 28 U.S.C. § 534(b). Moreover, it is clear that this provision was intended “ to protect the privacy of rap-sheet subjects,” Departm ent o f Justice v. Reporters Comm, fo r

3 The reference to “ other institutions” does n o t generally provide for disclosure to non-govemmental entities. See M emorandum for John Mintz, Legal Counsel, Federal Bureau o f Investigation, from Robert Shanks, Deputy Assistant A ttorney General, Office o f Legal Counsel, Re- Proposed Access to NC1C Files by National Center fo r Missing and Exploited Children at 2 (July 31, 1984) ( “ NCMEC M emo” ) Rather, only certain “ railroad police departm ents” and “ police departments of private colleges or universities” are identified as entities “ include[d]” within the meaning o f that term 28 U S C § 534(d)

120 Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal Justice Functions

Freedom o f the Press, 489 U.S. 749, 765 (1989), and should be applied in a manner consistent with this purpose.4 Finally, as this office has previously observed, the only enforcement mechanism expressly authorized by § 534 is the Department’s authority to cancel the direct recipient’s authority to receive the information, and the statute should be construed to preserve this oversight authority. See Memorandum for Joseph H. Davis, Assistant Director, Legal Counsel Division, Federal Bureau of Investigation, from William P. Barr, Assist­ ant Attorney General, Office of Legal Counsel, Re: Proposal by Federally Char­ tered o r Insured Financial Institutions to Disseminate FBI Criminal History Record Information to CARCO Group, Inc. at 6-7 (Sept. 1, 1989) ( “ CARCO Memo” ); Lawton Memo at 5. To the extent those recipients are permitted to dis­ close CHRI to their contractors, however, the Department’s sole recourse under current regulations would be to rely on “ the relationship between the local agency and the third party” to prevent abuses. Lawton Memo at 5. Thus, at least in the absence of effective controls over possible redissemination by the contractors, the Department’s ability to limit the use of CHRI by recipients might be impaired if recipients were permitted to pass CHRI on to those contractors. None of these considerations, however, compel a construction of the statute that precludes authorized criminal justice agencies from sharing CHRI with non- govemmental contractors performing law enforcement functions where the arrangements are subject to appropriate controls. First, in providing that the exchange of CHRI is “ subject to cancellation” if disseminated beyond the receiving agency or related agencies, Congress has delegated considerable discre­ tion to the Attorney General to determine whether cancellation is appropriate in a given context. The statute does not require the Department to “ terminate exchange relationships with users authorized under section 534(a)(1) if those users disseminate FBI criminal history records to unauthorized third parties.” CARCO Memo at 6 n.12. This discretion would seem to carry with it the authority to determine that a particular class of disclosures— i.e., those made to contractors for law enforcement purposes and subject to appropriate controls— is consistent with the statutory purpose of facilitating law enforcement and not inconsistent with its purpose of protecting relevant privacy interests. In addition, a strong argument can be made that disclosures of the sort con­ templated would not constitute “ dissemination” of the information, within the ordinary meaning of that word. Indeed, the dictionary defines “ dissemination” to mean “ to spread or send out freely or widely as though sowing or strewing

4 Although at one tim e this privacy interest was thought to raise potentially significant constitutional limitations on the use of CHRI, thus requiring a narrow construction o f the statute, see Menard v Mitchell, 328 F Supp. 718 (D D C. 1971), rev’d sub nom Menard v Saxbe, 498 F.2d 1017 (D.D.C. 1974), Lawton Memo at 4—5, subsequent developments in the law have made clear that the limitation is not constitutionally derived See United States Secret Service Use o f National Crime Information Center, 6 Op. O .L C 313, 322 (1982). As a result, it is not necessary to construe the statute narrowly in order to avoid a significant constitutional problem. Cf. Edward J DeBartolo Corp. v. Florida G ulf Coast Bldg & Constr. Trades Council, 485 U S 568, 575 (1988); NLRB v Catholic Bishop o f Chicago, 440 U.S 490,5 0 0 (1 9 7 9 )

121 Opinions o f the Office o f Legal Counsel in Volume 22

seed: make widespread.” Webster’s Third International Dictionary 656 (1986). Sharing information with contractors who are assisting in law enforcement and who are subject to carefully drawn controls would not appear to fall within this definition. Moreover, although the meaning of the phrase “ dissemination” may well vary based on context,5 it is clear that, at a minimum, the Attorney General could exercise her regulatory authority to define the term in a manner that would permit disclosures to contractors who are assisting law enforcement and who are subject to appropriate controls. See Chevron U.S.A. Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984). Such an interpretation would be con­ sistent with both the language and purpose of the statute. Although opinions issued by this office have at times taken a restrictive view of §534, see, e.g., Lawton Memo, we have not interpreted the term “ dissemina­ tion” to encompass all disclosures of CHRI to non-govemmental personnel.6 Some of these opinions, however, have indicated that CHRI disclosures to non- govemmental entities may be made only when the entity “ is the only agency, public or private, performing a criminal justice function under public auspices.” See Lawton Memo at n.5. In our view, these opinions overstate the statutory limitation on permissible disclosures made by authorized criminal justice agencies in this context. We believe that the proper interpretation is expressed in subsequent OLC opinions, which more aptly state that the receiving private entity must be one that ‘‘perform[s] quasi-govemmental functions under strict governmental con­ trol.” CARCO Memo at 4-5; Memorandum for Joseph H. Davis, Assistant Director, Legal Counsel, Federal Bureau of Investigation, from Douglas W. Kmiec, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Creation o f a Public Registry o f Law Enforcement Officers Killed in the Line o f Duty at 2 (July 1, 1988). Finally, to the extent the Department must retain the ability adequately to control the use of CHRI, and to cancel the privileges of those who make or permit improper disclosures, we note that regulatory measures may be developed that would serve this purpose, while still allowing contractors to access relevant information. Accordingly, we believe that disclosure of CHRI to authorized criminal justice contractors would not be forbidden by the provisions of §534 itself. If carefully controlled, moreover, such disclosures would also be compatible with the statutory purpose o f facilitating law enforcement while protecting the privacy interests affected.

5 Compare Zimmerman v Owens, 561 N W 2d 475 (Mich Ct App 1997) (holding that placement of a confidential child protective service report in public court file did not constitute a dissemination) with Essential Information, Inc. v. U nited Slates Information Agency, 134 F.3d 1165, 1168 (D C Cir 1998) (rejecting argument that the term “ dissem ination” connoted a much broader dispersal of materials than mere “ disclosure” under the particular statute in question, but acknowledging that “ the terms may be so distinguishable under some circumstances” ) 6 See, e.g , N CM EC M emo at 3 (authorizing C H RI disclosure to private non-govemmental entity, such as the National Center for M issing and Exploited Children, under limited circumstances and “ subject to substantial govern­ mental controls” ).

122 Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal Justice Functions

ii . In addition to §534 itself, however, it is necessary to consider the currently existing regulations that implement the statute. See 28 C.F.R. pt. 20 (1997) (gov­ erning “ Criminal Justice Information Systems” ) (“ Part 20” or “ CJIS Regula­ tions” ). Subpart C of part 20 applies to the CHRI systems maintained by the Department of Justice, other federal agencies, and by state and local criminal ju s­ tice agencies insofar as they use the services of federal CHRI systems. See 28 C.F.R. §20.30. The regulations provide that CHRI contained in systems main­ tained by the Department of Justice “ will be made available” :

(1) To criminal justice agencies for criminal justice purposes; and

(2) To Federal agencies authorized to receive it pursuant to Federal statute or Executive order.

(3) Pursuant to Public Law 92-544 (86 Stat. 1115) for use in connection with licensing or local/state employment or for other uses only if such dissemination is authorized by Federal or state statutes and approved by the Attorney General of the United States.

(4) For issuance of press releases and publicity designed to effect the apprehension of wanted persons in connection with serious or significant offenses.

Id. § 20.33(a). The regulations further provide, consistent with § 534(b), that an agency’s right to receive CHRI “ is subject to cancellation if dissemination is made outside the receiving departments or related agencies.” Id. § 20.33(b). Nothing in the subpart C regulations authorizes the dissemination of CHRI to private entities acting on behalf of government criminal justice agencies. Closest is the authorization to disclose CHRI to “ criminal justice agencies for criminal justice purposes,” id. § 20.33(a)(1), but those agencies are expressly defined to include only “ courts” and certain “ government agencies [and] any subunit thereof,” id. § 20.3(c). They do not include non-govemmental agencies, even when under contract to perform criminal justice functions. Particularly when read in light of the regulatory purpose of protecting “ individual privacy,” id. §20.1, it appears that section 20.33(a) was intended as an exhaustive list of the categories of authorized exchange for the covered records, and this office has previously

123 Opinions o f the Office o f Legal Counsel in Volume 22

construed the provision in this manner.7 Thus, section 20.33(a) does not affirma­ tively authorize dissemination of CHRI to non-govemmental entities under con­ tract to assist federal, state or local law enforcement agencies. A more difficult question is whether such disclosure of CHRI to private contrac­ tors, where subject to strict controls over the handling and use of the CHRI, would constitute a “ dissemination” for purposes of the regulation. Although one might plausibly argue that it would not, see supra n.5 and accompanying text, for a number of reasons we believe that such disclosures should not be authorized with­ out first amending the regulations. Although we cannot say with certainty that such an action is legally required, the risks of not doing so are substantial. At the outset, we note that it is more difficult to construe the regulation’s use of the word “ dissemination” in a manner that would allow contractor access than to do so with regard to the statute’s use of the same word. In particular, subpart B o f the regulations, which sets forth the rules governing certain state and local (as opposed to federal) criminal history record information systems, expressly authorizes disclosure to “ individuals and agencies pursuant to a specific agree­ ment with a criminal justice agency to provide services required for the adminis­ tration of criminal justice.” 28 C.F.R. § 20.21(b)(3). Because no similar provision appears in subpart C, which governs here, one might reasonably infer that such disclosures are not currently permitted under that provision. Further, as noted in your memorandum of October 3, 1997, earlier opinions of this office have taken a restrictive view of the Department’s authority to release CHRI to recipients not specifically identified in §534,8 and the Department historically has not permitted third-party access to CHRI. The courts have indicated that when an agency changes its interpretation of a regulation so fun­ damentally that it is equivalent to an amendment of the regulation, the change must be accomplished through notice-and-comment rulemaking. See Shalala v. Guernsey M em orial Hosp., 514 U.S. 87 (1995); Paralyzed Veterans o f America v. D.C. Arena L.P., 117 F.3d 579, 586 (D.C. Cir. 1997), cert denied, 523 U.S. 1003 (1998). Finally, by proceeding by notice-and-comment rulemaking, the Department will insure that its interpretation of § 534 receives the full weight of Chevron deference. Although the question is unsettled, a court might well provide less deference to an “ interpretative” rule, which is not subject to formal rulemaking, than to a “ legislative” rule, which is subject to the notice-and-comment process.9 Compare Martin v. Occupational Safety & Health Review Comm'n, 499 U.S. 144, 157 (1991) (interpretative rules “ not entitled to the same deference as norms that

1 See Federal Bureau o f Investigations—Disclosure o f Criminal Record—Admission to the Bar, 3 Op. O L.C. 55 (1979), see also Vtz v. Cullm ane, 520 F 2d 467, 477 n 20 (D C C ir 1975) ( “ regulations set apparently stringent standards as to the maximum extent o f dissemination” ) 8See FBI M emo at 4 n.3 (citing, e.g., Lawton M emo and CARCO Memo) 9 In our view, the availability o f Chevron deference should turn on whether Congress intended for deference to apply, and not on w hether a rule is “ interpretative” or “ legislative ” We cannot say with any certainty, however, that a reviewing court would adopt this same view

124 Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal Justice Functions

derive from the exercise of the Secretary’s delegated lawmaking powers” ) (dicta) with Elizabeth Blackwell Health Ctr. fo r Women v. Knoll, 61 F.3d 170, 182 (3d Cir. 1995) ( Chevron deference is appropriate “ even though the Secretary’s interpretation is not contained in a ‘legislative rule’ ” ), cert, denied, 516 U.S. 1093 (1996). Receiving full Chevron deference, moreover, may prove important to sustaining the Department’s position in potential litigation. In light of all these considerations, we believe that to proceed without first amending the regulations in accordance with the APA would invite significant legal challenge.

III.

If a decision is made to amend the regulations to authorize provision of CHRI to criminal justice contractors, it is essential that this goal be achieved in a manner that will subject contractor access to effective controls against unauthorized use or further dissemination. As the Supreme Court has observed, Congress intended that §534 be applied in a manner that is protective of “ the privacy of rap-sheet subjects.” Reporters Comm, fo r Freedom o f the Press, 489 U.S. at 749, 765. Moreover, § 534(b) provides for Department of Justice oversight of the dissemina­ tion of CHRI by giving the Attorney General the authority to cancel the exchange of CHRI if an unauthorized dissemination is made. The Department’s responsi­ bility to protect the privacy of CHRI will require, in our view, that it have at its disposal the means of controlling the use of this information. The precise form of such controls will depend upon a variety of factors. As a starting point, however, the Department might consider whether the provisions governing CHRI access agreements between states and criminal justice contractors set forth in subpart B of the CJIS Regulations would provide an appropriate model. The subpart B regulations require that such agreements shall “ limit the use of data to purposes for which given, insure the security and confidentiality of the data consistent with these regulations, and provide sanctions for violations thereof.” 28 C.F.R. § 20.21(b)(3). We would, of course, be happy to consider whether any particular proposal satisfies statutory requirements. Finally, we note that authorizing the provision of federal criminal history records to the entities in question would require compliance with the Privacy Act. See 5 U.S.C. §552a (1994 & Supp. II 1996). The criminal history records maintained by the FBI and provided through the NCIC are part of a system of records that is subject to the Privacy Act. Accordingly, covered agencies may not disclose such records to other agencies or institutions unless the subject of the records consents or one of the statute’s exemptions apply. Id. § 552a(b).'° l0 In defining covered “ agencies.’' see 5 U .SC. § 552a(a)( 1). the Privacy Act adopts by cross-reference the Freedom of Information Act’s definition o f “ agency,” which “ includes any executive department, military depart­ ment, Government corporation. Government controlled corporation, or other establishment in the executive branch Continued

125 Opinions o f the Office o f Legal Counsel in Volume 22

Here, the criminal justice or law enforcement uses for which the information would be provided would likely qualify for the issuance o f a “ routine use” excep­ tion to the Privacy Act’s prohibitions against unconsented disclosures. See 5 U.S.C. §552a(b)(3). A “ routine use” means, with respect to the disclosure of a record, “ the use of such record for a purpose which is compatible with the purpose for which it was collected.” Id. §552a(a)(7). We think that the uses of CHRI indicated in the examples you have submitted would generally be compat­ ible with the law enforcement and related purposes for which it was collected by the FBI and other agencies. We have not undertaken, however, to determine whether these particular uses would qualify under any of the existing published routine uses applicable to the relevant systems o f records. See, e.g., Privacy Act of 1974; Modified Systems of Records Notice (Fingerprint Identification Records System), 61 Fed. Reg. 6385 (1996); Privacy Act of 1974; Modified System of Records Notice (NCIC), 60 Fed. Reg. 19,774 (1995). Before actually authorizing the disclosure of CHRI to private criminal justice contractors, the Justice Depart­ ment should issue any new routine use notifications necessary to cover the par­ ticular disclosures in question.

RANDOLPH D. MOSS Deputy Assistant Attorney General Office o f Legal Counsel

o f the Governm ent (including the Executive O ffice of the President), or any independent regulatory agency ” 5 U .S C §5 5 2 (0 (1 ) (Supp II 1996)