(a) General rule.--Intelligence information, investigative information and treatment information shall not be collected in the central repository. This prohibition shall not preclude the collection in the central repository of names, words, numbers, phrases or other similar index keys to serve as indices to investigative reports.
(b) Collection of protected information.--
(1) Intelligence information may be placed in an automated or electronic criminal justice system only if the following apply:
(i) The criminal justice agency has reasonable suspicion of criminal activity.
(ii) Access to the intelligence information contained in the automated or electronic criminal justice system is restricted to the authorized employees of the criminal justice agency and cannot be accessed by any other individuals inside or outside of the agency.
(iii) The intelligence information is related to criminal activity that would give rise to prosecution for a State offense graded a misdemeanor or felony, or for a Federal offense for which the penalty is imprisonment for more than one year. Intelligence information shall be categorized based upon subject matter.
(iv) The intelligence information is not collected in violation of State law.
(2) Intelligence information may not be collected or maintained in an automated or electronic criminal justice system concerning participation in a political, religious or social organization, or in the organization or support of any nonviolent demonstration, assembly, protest, rally or similar form of public speech, unless there is a reasonable suspicion that the participation by the subject of the information is related to criminal activity or prison rule violation.
(3) Investigative information and treatment information contained in files of any criminal justice agency may be placed within an automated or electronic criminal justice information system, provided that access to the investigative information and treatment information contained in the automated or electronic criminal justice information system is restricted to authorized employees of that agency and cannot be accessed by individuals outside of the agency.
(c) Dissemination of protected information.--
(1) Intelligence information may be placed within an automated or electronic criminal justice information system and disseminated only if the following apply:
(i) The information is reliable as determined by an authorized intelligence officer.
(ii) The department, agency or individual requesting the information is a criminal justice agency which has policies and procedures adopted by the Office of Attorney General in consultation with the Pennsylvania State Police which are consistent with this act and include:
(A) Designation of an intelligence officer or officers by the head of the criminal justice agency or his designee.
(B) Adoption of administrative, technical and physical safeguards, including audit trails, to insure against unauthorized access and against intentional or unintentional damages.
(C) Labeling information to indicate levels of sensitivity and levels of confidence in the information.
(iii) The information is requested in connection with the duties of the criminal justice agency requesting the information, and the request for information is based upon a name, fingerprints, modus operandi, genetic typing, voice print or other identifying characteristic.
(2) If an intelligence officer of a disseminating agency is notified that intelligence information which has been previously disseminated to another criminal justice agency is materially misleading, obsolete or otherwise unreliable, the information shall be corrected and the recipient agency notified of the change within a reasonable period of time.
(3) Criminal justice agencies shall establish retention schedules for intelligence information. Intelligence information shall be purged under the following conditions:
(i) The data is no longer relevant or necessary to the goals and objectives of the criminal justice agency.
(ii) The data has become obsolete, making it unreliable for present purposes and the utility of updating the data would be worthless.
(iii) The data cannot be utilized for strategic or tactical intelligence studies.
(4) Investigative and treatment information shall not be disseminated to any department, agency or individual unless the department, agency or individual requesting the information is a criminal justice agency which requests the information in connection with its duties, and the request is based upon a name, fingerprints, modus operandi, genetic typing, voice print or other identifying characteristic.
(5) Each municipal police department accessing automated information shall file a copy of its procedures with the Pennsylvania State Police for approval. Such plan shall be reviewed within 60 days.
(6) Each district attorney accessing automated information shall file a copy of its procedures with the Office of Attorney General for approval. Such plan shall be reviewed within 60 days.
(d) Secondary dissemination prohibited.--A criminal justice agency which possesses information protected by this section, but which is not the source of the information, shall not disseminate or disclose the information to another criminal justice agency but shall refer the requesting agency to the agency which was the source of the information. This prohibition shall not apply if the agency receiving the information is investigating or prosecuting a criminal incident in conjunction with the agency possessing the information. Agencies receiving information protected by this section assume the same level of responsibility for the security of such information as the agency which was the source of the information.
(e) Notations of the record.--Criminal justice agencies maintaining intelligence information, investigative information or treatment information must enter, as a permanent part of an individual's information file, a listing of all persons and agencies to whom they have disseminated that particular information, the date of the dissemination and the purpose for which the information was disseminated. This listing shall be maintained separate from the record itself.
(f) Security requirements.--Every criminal justice agency collecting, storing or disseminating intelligence information, investigative information or treatment information shall insure the confidentiality and security of such information by providing that, wherever such information is maintained, a criminal justice agency must:
(1) institute procedures to reasonably protect any repository from theft, fire, sabotage, flood, wind or other natural or manmade disasters;
(2) select, supervise and train all personnel authorized to have access to intelligence information, investigative information or treatment information;
(3) insure that, where computerized data processing is employed, the equipment utilized for maintaining intelligence information, investigative information or treatment information is dedicated solely to purposes related to the administration of criminal justice or, if the equipment is not used solely for the administration of criminal justice, the criminal justice agency is accorded equal management participation in computer operations used to maintain the intelligence information, investigative information or treatment information.
(f.1) Child abuse investigations.--
(1) Notwithstanding any other provision of this chapter and pursuant to the confidentiality provisions under 23 Pa.C.S. Ch. 63 (relating to child protective services), a criminal justice agency may disseminate information relating to an allegation or instance of child abuse to a county agency or the Department of Human Services for the purpose of investigating the allegation or instance of abuse or to a children's advocacy center for the purpose of providing services to investigating agencies, as those terms are defined in 23 Pa.C.S. § 6303 (relating to definitions), or to a multidisciplinary review team, multidisciplinary investigative team or child fatality or near fatality review team for the purposes specified in 23 Pa.C.S. § 6365 (relating to services for prevention, investigation and treatment of child abuse).
(2) A person who is in receipt of confidential information under this subsection and disseminates the information to a person not specifically authorized to receive the information commits a violation of this section.
(g) Penalties.--Any person, including any agency or organization, who violates the provisions of this section shall be subject to the administrative penalties provided in section 9181 (relating to general administrative sanctions) and the civil penalties provided in section 9183 (relating to civil actions) in addition to any other civil or criminal penalty provided by law.