## Access to Criminal History Records by Non-Governmental

Entities Performing Authorized Criminal Justice Functions

Non-govem m ental entities perform ing authorized criminal justice functions under contract with government law enforcement agencies may be granted access to criminal history records m aintained under the authority o f 28 U.S.C. § 534, subject to effective controls to guard against unauthorized use and to ensure effective oversight by the Department o f Justice.

Because Department o f Justice regulations im plem enting 28 U S C. § 534 do not affirm atively authorize dissemination o f criminal history records to non-govemmental entities under contract to assist law enforcement agencies, those regulations should be amended to provide such authorization before access is granted to those entities.

June 12, 1998

M e m o r a n d u m O p in io n f o r t h e D e p u t y D ir e c t o r

F e d e r a l B u r e a u o f I n v e s t i g a t i o n

This responds to your request for our legal opinion concerning the circumstances in which non-govemmental entities performing criminal justice functions under contract with government law enforcement agencies may be granted access to criminal history records information (“ CHRI” ) subject to the provisions of 28 U.S.C. §534 (1994).' We conclude that the Attorney General, or her delegee,2 may permit such access in appropriate circumstances under § 534. Should the Attorney General decide to do so, we believe that the governing regulation, 28 C.F.R. pt. 20 (1997), should be amended in accordance with the rulemaking requirements of the Administrative Procedure Act (“ APA” ), see 5 U.S.C. §553(1994), for the reasons discussed below.* Finally, any proposal to permit contractor access to CHRI must incorporate effective controls to guard against unauthorized use or release of CHRI by the contractors and to insure that the Department can maintain effective oversight.

I.

Section 534 directs the Attorney General to “ acquire, collect, classify, and preserve identification, criminal identification, crime, and other records” and to“ exchange such records and information with, and for the official use of, authorized officials of the Federal Government, the States, cities, and penal and other

* Editor’s Note. The Department’s regulations have since been amended to authorize the category of controlled access discussed in this opinion See 28 C.F.R § 20 33(a)(7) (2000). 1 Memorandum for Dawn Johnsen, Acting Assistant Attorney General, Office of Legal Counsel, from Robert M Bryant, Deputy Director, FBI, Re Access to and Dissemination o f Information from the Department o f Justice (DOJ) Criminal History Record Information (CHRI) System (Oct. 3, 1997) (“ FBI Memo” ) 2 The Attorney General has delegated her CHRI exchange responsibilities to the Federal Bureau of Investigation (“ FBI” ). See 28 C.F R. §§0 85(b), 20 31(b) (1997).

119Opinions o f the Office o f Legal Counsel in Volume 22

institutions.” 3 28 U.S.C. § 534(a)(1), (4). The statute thus requires the Attorney General to collect, maintain, and exchange criminal identification records with federal, state, and local criminal justice agencies. Although the statute does not expressly preclude such agencies from sharing these records with third parties,it provides that “ [t]he exchange of records and information authorized by subsection (a)(4) of this section is subject to cancellation if dissemination is made outside the receiving departments or related agencies.” Id. § 534(b). This office has previously construed the phrase “ related agencies” to include only those agencies expressly authorized under § 534(a) to receive CHRI directly from the Department. See Memorandum to Files, from Mary C. Lawton, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Railroad Police Access to FBI Criminal Identification Records at 5 (June 22, 1978) (“ Lawton Memo” ). As we read the statute, it does not on its face forbid the government agencies that are authorized to receive CHRI from sharing it with private contractors assisting them in the performance o f their duties. However, § 534(b) provides an enforcement mechanism that enables the Attorney General to oversee the use of CHRI by recipients. This statutory provision, which vests authority in the Attorney General to cancel CHRI exchange arrangements, contemplates that she may invoke that authority in order to guard against the improper use or redissemination of the CHRI that the FBI provides. Accordingly, as further discussed below, the statute would permit the Attorney General to authorize the disclosure of CHRIto private contractors performing criminal justice functions for government agencies that are authorized to receive CHRI, but any such authorization would have to impose controls on the recipients and their contractors to preserve the Attorney General’s statutory oversight authority. Rather than expressly prohibiting categories of CHRI disclosures, § 534(a)(4) merely limits mandatory CHRI exchanges to those that are for the “ official use” of the designated “ authorized officials.” The text of §534 does not address whether a private contractor acting under the direction, or on behalf, of such “ authorized officials” could be said to be engaged in, enabling, or facilitating the “ official use” of the CHRI by those officials.On the other hand, § 534(b) pointedly discourages the “ dissemination” of covered records outside “ the receiving departments or related agencies,” by providing that such dissemination “ subjects]” the noncompliant agency or department to possible cancellation of its exchange privileges under the statute. 28 U.S.C. § 534(b). Moreover, it is clear that this provision was intended “ to protect the privacy of rap-sheet subjects,” Department o f Justice v. Reporters Comm, for

3 The reference to “ other institutions” does not generally provide for disclosure to non-govemmental entities.
See Memorandum for John Mintz, Legal Counsel, Federal Bureau of Investigation, from Robert Shanks, Deputy Assistant Attorney General, Office of Legal Counsel, Re- Proposed Access to NC1C Files by National Center fo r Missing and Exploited Children at 2 (July 31, 1984) (“ NCMEC Memo” ) Rather, only certain “ railroad police departments” and “ police departments of private colleges or universities” are identified as entities “ include[d]” within the meaning of that term 28 U S C § 534(d)

120Freedom o f the Press, 489 U.S. 749, 765 (1989), and should be applied in a

manner consistent with this purpose.4 Finally, as this office has previously observed, the only enforcement mechanism expressly authorized by § 534 is the Department’s authority to cancel the direct recipient’s authority to receive the information, and the statute should be construed to preserve this oversight authority. See Memorandum for Joseph H. Davis, Assistant Director, LegalCounsel Division, Federal Bureau of Investigation, from William P. Barr, Assistant Attorney General, Office of Legal Counsel, Re: Proposal by Federally Chartered or Insured Financial Institutions to Disseminate FBI Criminal History Record Information to CARCO Group, Inc. at 6-7 (Sept. 1, 1989) ( “ CARCOMemo” ); Lawton Memo at 5. To the extent those recipients are permitted to disclose CHRI to their contractors, however, the Department’s sole recourse under current regulations would be to rely on “ the relationship between the local agency and the third party” to prevent abuses. Lawton Memo at 5. Thus, at least in the absence of effective controls over possible redissemination by the contractors, the Department’s ability to limit the use of CHRI by recipients might be impaired if recipients were permitted to pass CHRI on to those contractors. None of these considerations, however, compel a construction of the statutethat precludes authorized criminal justice agencies from sharing CHRI with nongovemmental contractors performing law enforcement functions where the arrangements are subject to appropriate controls. First, in providing that the exchange of CHRI is “ subject to cancellation” if disseminated beyond thereceiving agency or related agencies, Congress has delegated considerable discretion to the Attorney General to determine whether cancellation is appropriate in a given context. The statute does not require the Department to “ terminate exchange relationships with users authorized under section 534(a)(1) if those users disseminate FBI criminal history records to unauthorized third parties.” CARCO Memo at 6 n.12. This discretion would seem to carry with it the authority to determine that a particular class of disclosures— i.e., those made to contractors for law enforcement purposes and subject to appropriate controls— is consistent with the statutory purpose of facilitating law enforcement and not inconsistent with its purpose of protecting relevant privacy interests.In addition, a strong argument can be made that disclosures of the sort contemplated would not constitute “ dissemination” of the information, within the ordinary meaning of that word. Indeed, the dictionary defines “ dissemination” to mean “ to spread or send out freely or widely as though sowing or strewing

4 Although at one tim e this privacy interest was thought to raise potentially significant constitutional limitations

on the use of CHRI, thus requiring a narrow construction of the statute, see Menard v Mitchell, 328 F Supp. 718 (D D C. 1971), rev’d sub nom Menard v Saxbe , 498 F.2d 1017 (D.D.C. 1974), Lawton Memo at 4—5, subsequent developments in the law have made clear that the limitation is not constitutionally derived See United States Secret Service Use o f National Crime Information Center, 6 Op. O .L C 313, 322 (1982). As a result, it is not necessary to construe the statute narrowly in order to avoid a significant constitutional problem. Cf. Edward J DeBartolo Corp. v. Florida Gulf Coast Bldg & Constr. Trades Council, 485 U S 568, 575 (1988); NLRB v Catholic Bishop o f Chicago, 440 U.S 490,500(1979) Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal

Justice Functions

121Opinions o f the Office o f Legal Counsel in Volume 22

seed: make widespread.” Webster’s Third International Dictionary 656 (1986). Sharing information with contractors who are assisting in law enforcement and who are subject to carefully drawn controls would not appear to fall within this definition. Moreover, although the meaning of the phrase “ dissemination” may well vary based on context,5 it is clear that, at a minimum, the Attorney General could exercise her regulatory authority to define the term in a manner that would permit disclosures to contractors who are assisting law enforcement and who are subject to appropriate controls. See Chevron U.S.A. Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984). Such an interpretation would be consistent with both the language and purpose of the statute. Although opinions issued by this office have at times taken a restrictive view of §534, see, e.g., Lawton Memo, we have not interpreted the term “ dissemination” to encompass all disclosures of CHRI to non-govemmental personnel.6Some of these opinions, however, have indicated that CHRI disclosures to nongovemmental entities may be made only when the entity “ is the only agency, public or private, performing a criminal justice function under public auspices.”

See Lawton Memo at n.5. In our view, these opinions overstate the statutory limitation on permissible disclosures made by authorized criminal justice agencies in this context. We believe that the proper interpretation is expressed in subsequent OLC opinions, which more aptly state that the receiving private entity must beone that ‘ ‘perform[s] quasi-govemmental functions under strict governmental control.” CARCO Memo at 4-5; Memorandum for Joseph H. Davis, Assistant Director, Legal Counsel, Federal Bureau of Investigation, from Douglas W. Kmiec, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Creation of a Public Registry o f Law Enforcement Officers Killed in the Line o f Duty at 2 (July 1, 1988). Finally, to the extent the Department must retain the ability adequately to control the use of CHRI, and to cancel the privileges of those who make or permit improper disclosures, we note that regulatory measures may be developed that would serve this purpose, while still allowing contractors to access relevant
information. Accordingly, we believe that disclosure of CHRI to authorized criminal justice contractors would not be forbidden by the provisions of §534 itself. If carefully controlled, moreover, such disclosures would also be compatible with the statutory purpose of facilitating law enforcement while protecting the privacy interests
affected.

5 Compare Zimmerman v Owens, 561 N W 2d 475 (Mich Ct App 1997) (holding that placement of a confidential child protective service report in public court file did not constitute a dissemination) with Essential Information, Inc. v. United Slates Information Agency , 134 F.3d 1165, 1168 (D C Cir 1998) (rejecting argument that the term “ dissemination” connoted a much broader dispersal of materials than mere “ disclosure” under the particular statute in question, but acknowledging that “ the terms may be so distinguishable under some circumstances” ) 6 See, e.g , NCMEC Memo at 3 (authorizing CHRI disclosure to private non-govemmental entity, such as theNational Center for Missing and Exploited Children, under limited circumstances and “ subject to substantial governmental controls” ).

122Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal

Justice Functions



### i i



# .

In addition to §534 itself, however, it is necessary to consider the currently existing regulations that implement the statute. See 28 C.F.R. pt. 20 (1997) (governing “ Criminal Justice Information Systems” ) (“ Part 20” or “ CJIS Regulations” ). Subpart C of part 20 applies to the CHRI systems maintained by theDepartment of Justice, other federal agencies, and by state and local criminal justice agencies insofar as they use the services of federal CHRI systems. See 28C.F.R. §20.30. The regulations provide that CHRI contained in systems maintained by the Department of Justice “ will be made available” :

(1) To criminal justice agencies for criminal justice purposes; and

(2) To Federal agencies authorized to receive it pursuant to Federal
statute or Executive order.

(3) Pursuant to Public Law 92-544 (86 Stat. 1115) for use in connection with licensing or local/state employment or for other uses only if such dissemination is authorized by Federal or state statutes and approved by the Attorney General of the United States.

(4) For issuance of press releases and publicity designed to effect the apprehension of wanted persons in connection with serious or significant offenses.

Id. § 20.33(a). The regulations further provide, consistent with § 534(b), that an agency’s right to receive CHRI “ is subject to cancellation if dissemination is made outside the receiving departments or related agencies.” Id. § 20.33(b).
Nothing in the subpart C regulations authorizes the dissemination of CHRI to private entities acting on behalf of government criminal justice agencies. Closest is the authorization to disclose CHRI to “ criminal justice agencies for criminal justice purposes,” id. § 20.33(a)(1), but those agencies are expressly defined to include only “ courts” and certain “ government agencies [and] any subunit thereof,” id. § 20.3(c). They do not include non-govemmental agencies, even when under contract to perform criminal justice functions. Particularly when read in light of the regulatory purpose of protecting “ individual privacy,” id. §20.1, it appears that section 20.33(a) was intended as an exhaustive list of the categories of authorized exchange for the covered records, and this office has previously

123Opinions of the Office o f Legal Counsel in Volume 22

construed the provision in this manner.7 Thus, section 20.33(a) does not affirmatively authorize dissemination of CHRI to non-govemmental entities under contract to assist federal, state or local law enforcement agencies.A more difficult question is whether such disclosure of CHRI to private contractors, where subject to strict controls over the handling and use of the CHRI, would constitute a “ dissemination” for purposes of the regulation. Although one might plausibly argue that it would not, see supra n.5 and accompanying text, for a
number of reasons we believe that such disclosures should not be authorized without first amending the regulations. Although we cannot say with certainty that such an action is legally required, the risks of not doing so are substantial. At the outset, we note that it is more difficult to construe the regulation’s use
of the word “ dissemination” in a manner that would allow contractor access than to do so with regard to the statute’s use of the same word. In particular, subpart B of the regulations, which sets forth the rules governing certain state and local (as opposed to federal) criminal history record information systems, expresslyauthorizes disclosure to “ individuals and agencies pursuant to a specific agreement with a criminal justice agency to provide services required for the administration of criminal justice.” 28 C.F.R. § 20.21(b)(3). Because no similar provision appears in subpart C, which governs here, one might reasonably infer that such disclosures are not currently permitted under that provision. Further, as noted in your memorandum of October 3, 1997, earlier opinions of this office have taken a restrictive view of the Department’s authority to release CHRI to recipients not specifically identified in §534,8 and the Department historically has not permitted third-party access to CHRI. The courts haveindicated that when an agency changes its interpretation of a regulation so fundamentally that it is equivalent to an amendment of the regulation, the change must be accomplished through notice-and-comment rulemaking. See Shalala v. Guernsey Memorial Hosp., 514 U.S. 87 (1995); Paralyzed Veterans o f America

v. D.C. Arena L.P., 117 F.3d 579, 586 (D.C. Cir. 1997), cert denied, 523 U.S. 1003 (1998). Finally, by proceeding by notice-and-comment rulemaking, the Department will insure that its interpretation of § 534 receives the full weight of Chevron deference. Although the question is unsettled, a court might well provide less deference to an “ interpretative” rule, which is not subject to formal rulemaking, than to a “ legislative” rule, which is subject to the notice-and-comment process.9 Compare Martin v. Occupational Safety & Health Review Comm'n, 499 U.S. 144, 157 (1991) (interpretative rules “ not entitled to the same deference as norms that

1 See Federal Bureau o f Investigations—Disclosure o f Criminal Record—Admission to the Bar, 3 Op. O L.C. 55 (1979), see also Vtz v. Cullmane , 520 F2d 467, 477 n 20 (D C Cir 1975) (“ regulations set apparently stringent standards as to the maximum extent of dissemination” )

8See FBI Memo at 4 n.3 (citing, e.g., Lawton Memo and CARCO Memo) 9 In our view, the availability of Chevron deference should turn on whether Congress intended for deference to apply, and not on whether a rule is “ interpretative” or “ legislative ” We cannot say with any certainty, however, that a reviewing court would adopt this same view

124derive from the exercise of the Secretary’s delegated lawmaking powers” ) (dicta)

with Elizabeth Blackwell Health Ctr. fo r Women v. Knoll, 61 F.3d 170, 182 (3d Cir. 1995) ( Chevron deference is appropriate “ even though the Secretary’s interpretation is not contained in a ‘legislative rule’ ” ), cert, denied, 516 U.S. 1093 (1996). Receiving full Chevron deference, moreover, may prove important to sustaining the Department’s position in potential litigation. In light of all these considerations, we believe that to proceed without first amending the regulations in accordance with the APA would invite significant legal challenge.



### III.

If a decision is made to amend the regulations to authorize provision of CHRI to criminal justice contractors, it is essential that this goal be achieved in a manner that will subject contractor access to effective controls against unauthorized use or further dissemination. As the Supreme Court has observed, Congress intended that §534 be applied in a manner that is protective of “ the privacy of rap-sheet subjects.” Reporters Comm, fo r Freedom o f the Press, 489 U.S. at 749, 765.Moreover, § 534(b) provides for Department of Justice oversight of the dissemination of CHRI by giving the Attorney General the authority to cancel the exchangeof CHRI if an unauthorized dissemination is made. The Department’s responsibility to protect the privacy of CHRI will require, in our view, that it have at its disposal the means of controlling the use of this information. The precise form of such controls will depend upon a variety of factors. As a starting point, however, the Department might consider whether the provisions governing CHRI access agreements between states and criminal justice contractors set forth in subpart B of the CJIS Regulations would provide an appropriate model. The subpart B regulations require that such agreements shall “ limit the use of data to purposes for which given, insure the security and confidentiality of the data consistent with these regulations, and provide sanctions for violations thereof.” 28 C.F.R. § 20.21(b)(3). We would, of course, be happy to consider whether any particular proposal satisfies statutory requirements. Finally, we note that authorizing the provision of federal criminal history records to the entities in question would require compliance with the Privacy Act. See 5 U.S.C. §552a (1994 & Supp. II 1996). The criminal history records maintained by the FBI and provided through the NCIC are part of a system of records that is subject to the Privacy Act. Accordingly, covered agencies may not disclose such records to other agencies or institutions unless the subject of the records consents or one of the statute’s exemptions apply. Id. § 552a(b).'°

l0In defining covered “ agencies.’' see 5 U.SC. § 552a(a)( 1). the Privacy Act adopts by cross-reference theFreedom of Information Act’s definition of “ agency,” which “ includes any executive department, military department, Government corporation. Government controlled corporation, or other establishment in the executive branch
Continued Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal

Justice Functions

125Opinions o f the Office o f Legal Counsel in Volume 22

Here, the criminal justice or law enforcement uses for which the informationwould be provided would likely qualify for the issuance of a “ routine use” exception to the Privacy Act’s prohibitions against unconsented disclosures. See 5 U.S.C. §552a(b)(3). A “ routine use” means, with respect to the disclosure of a record, “ the use of such record for a purpose which is compatible with the purpose for which it was collected.” Id. §552a(a)(7). We think that the uses ofCHRI indicated in the examples you have submitted would generally be compatible with the law enforcement and related purposes for which it was collected by the FBI and other agencies. We have not undertaken, however, to determine whether these particular uses would qualify under any of the existing published routine uses applicable to the relevant systems of records. See, e.g., Privacy Act of 1974; Modified Systems of Records Notice (Fingerprint Identification Records System), 61 Fed. Reg. 6385 (1996); Privacy Act of 1974; Modified System of Records Notice (NCIC), 60 Fed. Reg. 19,774 (1995). Before actually authorizingthe disclosure of CHRI to private criminal justice contractors, the Justice Department should issue any new routine use notifications necessary to cover the particular disclosures in question.

RANDOLPH D. MOSS Deputy Assistant Attorney General Office o f Legal Counsel

of the Government (including the Executive Office of the President), or any independent regulatory agency ” 5 U .SC §552(0(1) (Supp II 1996)

126