Access to Criminal History Records by Non-Governmental

Entities Performing Authorized Criminal Justice Functions

Non-govem m ental entities perform ing authorized criminal justice functions under contract with government law enforcement agencies may be granted access to criminal history records m aintained under 

the authority o f 28 U.S.C. § 534, subject to effective controls to guard against unauthorized use 

and to ensure effective oversight by the Department o f Justice.

Because Department o f Justice regulations im plem enting 28 U S C. § 534 do not affirm atively authorize 

dissemination o f criminal history records to non-govemmental entities under contract to assist law 

enforcement agencies, those regulations should be amended to provide such authorization before 

access is granted to those entities.

June 12, 1998

M e m o r a n d u m O p in io n f o r t h e D e p u t y D ir e c t o r

F e d e r a l B u r e a u o f In v e s t i g a t i o n

This responds to your request for our legal opinion concerning the circumstances 

in which non-govemmental entities performing criminal justice functions under 

contract with government law enforcement agencies may be granted access to 

criminal history records information (“ CHRI” ) subject to the provisions of 28 

U.S.C. §534 (1994).' We conclude that the Attorney General, or her delegee,2 

may permit such access in appropriate circumstances under § 534. Should the 

Attorney General decide to do so, we believe that the governing regulation, 28 

C.F.R. pt. 20 (1997), should be amended in accordance with the rulemaking 

requirements of the Administrative Procedure Act (“ APA” ), see 5 U.S.C. §553 

(1994), for the reasons discussed below.* Finally, any proposal to permit contractor access to CHRI must incorporate effective controls to guard against 

unauthorized use or release of CHRI by the contractors and to insure that the 

Department can maintain effective oversight.

I.

Section 534 directs the Attorney General to “ acquire, collect, classify, and preserve identification, criminal identification, crime, and other records” and to 

“ exchange such records and information with, and for the official use of, authorized officials of the Federal Government, the States, cities, and penal and other

* Editor’s Note. The Department’s regulations have since been amended to authorize the category of controlled 

access discussed in this opinion See 28 C.F.R § 20 33(a)(7) (2000).

1 Memorandum for Dawn Johnsen, Acting Assistant Attorney General, Office of Legal Counsel, from Robert M 

Bryant, Deputy Director, FBI, Re Access to and Dissemination o f Information from the Department o f Justice (DOJ)

Criminal History Record Information (CHRI) System (Oct. 3, 1997) (“ FBI Memo” )

2 The Attorney General has delegated her CHRI exchange responsibilities to the Federal Bureau of Investigation 

(“ FBI” ). See 28 C.F R. §§0 85(b), 20 31(b) (1997).

119
Opinions o f the Office o f Legal Counsel in Volume 22

institutions.” 3 28 U.S.C. § 534(a)(1), (4). The statute thus requires the Attorney 

General to collect, maintain, and exchange criminal identification records with 

federal, state, and local criminal justice agencies. Although the statute does not 

expressly preclude such agencies from sharing these records with third parties, 

it provides that “ [t]he exchange of records and information authorized by subsection (a)(4) of this section is subject to cancellation if dissemination is made 

outside the receiving departments or related agencies.” Id. § 534(b). This office 

has previously construed the phrase “ related agencies” to include only those 

agencies expressly authorized under § 534(a) to receive CHRI directly from the 

Department. See Memorandum to Files, from Mary C. Lawton, Deputy Assistant 

Attorney General, Office of Legal Counsel, Re: Railroad Police Access to FBI

Criminal Identification Records at 5 (June 22, 1978) (“ Lawton Memo” ).

As we read the statute, it does not on its face forbid the government agencies 

that are authorized to receive CHRI from sharing it with private contractors 

assisting them in the performance o f their duties. However, § 534(b) provides an 

enforcement mechanism that enables the Attorney General to oversee the use of 

CHRI by recipients. This statutory provision, which vests authority in the Attorney 

General to cancel CHRI exchange arrangements, contemplates that she may invoke 

that authority in order to guard against the improper use or redissemination of 

the CHRI that the FBI provides. Accordingly, as further discussed below, the 

statute would permit the Attorney General to authorize the disclosure of CHRI 

to private contractors performing criminal justice functions for government agencies that are authorized to receive CHRI, but any such authorization would have 

to impose controls on the recipients and their contractors to preserve the Attorney 

General’s statutory oversight authority.

Rather than expressly prohibiting categories of CHRI disclosures, § 534(a)(4) 

merely limits mandatory CHRI exchanges to those that are for the “ official use” 

of the designated “ authorized officials.” The text of §534 does not address 

whether a private contractor acting under the direction, or on behalf, of such 

“ authorized officials” could be said to be engaged in, enabling, or facilitating 

the “ official use” of the CHRI by those officials.

On the other hand, § 534(b) pointedly discourages the “ dissemination” of covered records outside “ the receiving departments or related agencies,” by providing 

that such dissemination “ subjects]” the noncompliant agency or department to 

possible cancellation of its exchange privileges under the statute. 28 U.S.C. 

§ 534(b). Moreover, it is clear that this provision was intended “ to protect the 

privacy of rap-sheet subjects,” Department o f Justice v. Reporters Comm, for

3 The reference to “ other institutions” does not generally provide for disclosure to non-govemmental entities. 

See Memorandum for John Mintz, Legal Counsel, Federal Bureau of Investigation, from Robert Shanks, Deputy 

Assistant Attorney General, Office of Legal Counsel, Re- Proposed Access to NC1C Files by National Center fo r

Missing and Exploited Children at 2 (July 31, 1984) (“ NCMEC Memo” ) Rather, only certain “ railroad police 

departments” and “ police departments of private colleges or universities” are identified as entities “ include[d]” 

within the meaning of that term 28 U S C § 534(d)

120
Freedom o f the Press, 489 U.S. 749, 765 (1989), and should be applied in a 

manner consistent with this purpose.4 Finally, as this office has previously 

observed, the only enforcement mechanism expressly authorized by § 534 is the 

Department’s authority to cancel the direct recipient’s authority to receive the 

information, and the statute should be construed to preserve this oversight 

authority. See Memorandum for Joseph H. Davis, Assistant Director, Legal 

Counsel Division, Federal Bureau of Investigation, from William P. Barr, Assistant Attorney General, Office of Legal Counsel, Re: Proposal by Federally Chartered or Insured Financial Institutions to Disseminate FBI Criminal History

Record Information to CARCO Group, Inc. at 6-7 (Sept. 1, 1989) ( “ CARCO 

Memo” ); Lawton Memo at 5. To the extent those recipients are permitted to disclose CHRI to their contractors, however, the Department’s sole recourse under 

current regulations would be to rely on “ the relationship between the local agency 

and the third party” to prevent abuses. Lawton Memo at 5. Thus, at least in 

the absence of effective controls over possible redissemination by the contractors, 

the Department’s ability to limit the use of CHRI by recipients might be impaired 

if recipients were permitted to pass CHRI on to those contractors.

None of these considerations, however, compel a construction of the statute 

that precludes authorized criminal justice agencies from sharing CHRI with nongovemmental contractors performing law enforcement functions where the 

arrangements are subject to appropriate controls. First, in providing that the 

exchange of CHRI is “ subject to cancellation” if disseminated beyond the 

receiving agency or related agencies, Congress has delegated considerable discretion to the Attorney General to determine whether cancellation is appropriate in 

a given context. The statute does not require the Department to “ terminate 

exchange relationships with users authorized under section 534(a)(1) if those users 

disseminate FBI criminal history records to unauthorized third parties.” CARCO 

Memo at 6 n.12. This discretion would seem to carry with it the authority to 

determine that a particular class of disclosures— i.e., those made to contractors 

for law enforcement purposes and subject to appropriate controls— is consistent 

with the statutory purpose of facilitating law enforcement and not inconsistent 

with its purpose of protecting relevant privacy interests.

In addition, a strong argument can be made that disclosures of the sort contemplated would not constitute “ dissemination” of the information, within the 

ordinary meaning of that word. Indeed, the dictionary defines “ dissemination” 

to mean “ to spread or send out freely or widely as though sowing or strewing

4 Although at one tim e this privacy interest was thought to raise potentially significant constitutional limitations 

on the use of CHRI, thus requiring a narrow construction of the statute, see Menard v Mitchell, 328 F Supp. 

718 (D D C. 1971), rev’d sub nom Menard v Saxbe, 498 F.2d 1017 (D.D.C. 1974), Lawton Memo at 4—5, subsequent 

developments in the law have made clear that the limitation is not constitutionally derived See United States Secret

Service Use o f National Crime Information Center, 6 Op. O .L C 313, 322 (1982). As a result, it is not necessary 

to construe the statute narrowly in order to avoid a significant constitutional problem. Cf. Edward J DeBartolo

Corp. v. Florida Gulf Coast Bldg & Constr. Trades Council, 485 U S 568, 575 (1988); NLRB v Catholic Bishop

o f Chicago, 440 U.S 490,500(1979)

Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal

Justice Functions

121
Opinions o f the Office o f Legal Counsel in Volume 22

seed: make widespread.” Webster’s Third International Dictionary 656 (1986). 

Sharing information with contractors who are assisting in law enforcement and 

who are subject to carefully drawn controls would not appear to fall within this 

definition. Moreover, although the meaning of the phrase “ dissemination” may 

well vary based on context,5 it is clear that, at a minimum, the Attorney General 

could exercise her regulatory authority to define the term in a manner that would 

permit disclosures to contractors who are assisting law enforcement and who are 

subject to appropriate controls. See Chevron U.S.A. Inc. v. Natural Resources

Defense Council, Inc., 467 U.S. 837 (1984). Such an interpretation would be consistent with both the language and purpose of the statute.

Although opinions issued by this office have at times taken a restrictive view 

of §534, see, e.g., Lawton Memo, we have not interpreted the term “ dissemination” to encompass all disclosures of CHRI to non-govemmental personnel.6 

Some of these opinions, however, have indicated that CHRI disclosures to nongovemmental entities may be made only when the entity “ is the only agency, 

public or private, performing a criminal justice function under public auspices.” 

See Lawton Memo at n.5. In our view, these opinions overstate the statutory 

limitation on permissible disclosures made by authorized criminal justice agencies 

in this context. We believe that the proper interpretation is expressed in subsequent 

OLC opinions, which more aptly state that the receiving private entity must be 

one that ‘ ‘perform[s] quasi-govemmental functions under strict governmental control.” CARCO Memo at 4-5; Memorandum for Joseph H. Davis, Assistant 

Director, Legal Counsel, Federal Bureau of Investigation, from Douglas W. 

Kmiec, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Creation

of a Public Registry o f Law Enforcement Officers Killed in the Line o f Duty at

2 (July 1, 1988).

Finally, to the extent the Department must retain the ability adequately to control 

the use of CHRI, and to cancel the privileges of those who make or permit 

improper disclosures, we note that regulatory measures may be developed that 

would serve this purpose, while still allowing contractors to access relevant 

information.

Accordingly, we believe that disclosure of CHRI to authorized criminal justice 

contractors would not be forbidden by the provisions of §534 itself. If carefully 

controlled, moreover, such disclosures would also be compatible with the statutory 

purpose of facilitating law enforcement while protecting the privacy interests 

affected.

5 Compare Zimmerman v Owens, 561 N W 2d 475 (Mich Ct App 1997) (holding that placement of a confidential 

child protective service report in public court file did not constitute a dissemination) with Essential Information,

Inc. v. United Slates Information Agency, 134 F.3d 1165, 1168 (D C Cir 1998) (rejecting argument that the term 

“ dissemination” connoted a much broader dispersal of materials than mere “ disclosure” under the particular statute 

in question, but acknowledging that “ the terms may be so distinguishable under some circumstances” )

6 See, e.g , NCMEC Memo at 3 (authorizing CHRI disclosure to private non-govemmental entity, such as the 

National Center for Missing and Exploited Children, under limited circumstances and “ subject to substantial governmental controls” ).

122
Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal

Justice Functions

i i.

In addition to §534 itself, however, it is necessary to consider the currently 

existing regulations that implement the statute. See 28 C.F.R. pt. 20 (1997) (governing “ Criminal Justice Information Systems” ) (“ Part 20” or “ CJIS Regulations” ). Subpart C of part 20 applies to the CHRI systems maintained by the 

Department of Justice, other federal agencies, and by state and local criminal justice agencies insofar as they use the services of federal CHRI systems. See 28

C.F.R. §20.30. The regulations provide that CHRI contained in systems maintained by the Department of Justice “ will be made available” :

(1) To criminal justice agencies for criminal justice purposes; and

(2) To Federal agencies authorized to receive it pursuant to Federal 

statute or Executive order.

(3) Pursuant to Public Law 92-544 (86 Stat. 1115) for use in 

connection with licensing or local/state employment or for other 

uses only if such dissemination is authorized by Federal or state 

statutes and approved by the Attorney General of the United States.

(4) For issuance of press releases and publicity designed to effect 

the apprehension of wanted persons in connection with serious or 

significant offenses.

Id. § 20.33(a). The regulations further provide, consistent with § 534(b), that an 

agency’s right to receive CHRI “ is subject to cancellation if dissemination is made 

outside the receiving departments or related agencies.” Id. § 20.33(b).

Nothing in the subpart C regulations authorizes the dissemination of CHRI to 

private entities acting on behalf of government criminal justice agencies. Closest 

is the authorization to disclose CHRI to “ criminal justice agencies for criminal 

justice purposes,” id. § 20.33(a)(1), but those agencies are expressly defined to 

include only “ courts” and certain “ government agencies [and] any subunit 

thereof,” id. § 20.3(c). They do not include non-govemmental agencies, even 

when under contract to perform criminal justice functions. Particularly when read 

in light of the regulatory purpose of protecting “ individual privacy,” id. §20.1, 

it appears that section 20.33(a) was intended as an exhaustive list of the categories 

of authorized exchange for the covered records, and this office has previously

123
Opinions of the Office o f Legal Counsel in Volume 22

construed the provision in this manner.7 Thus, section 20.33(a) does not affirmatively authorize dissemination of CHRI to non-govemmental entities under contract to assist federal, state or local law enforcement agencies.

A more difficult question is whether such disclosure of CHRI to private contractors, where subject to strict controls over the handling and use of the CHRI, would 

constitute a “ dissemination” for purposes of the regulation. Although one might 

plausibly argue that it would not, see supra n.5 and accompanying text, for a 

number of reasons we believe that such disclosures should not be authorized without first amending the regulations. Although we cannot say with certainty that 

such an action is legally required, the risks of not doing so are substantial.

At the outset, we note that it is more difficult to construe the regulation’s use 

of the word “ dissemination” in a manner that would allow contractor access than 

to do so with regard to the statute’s use of the same word. In particular, subpart 

B of the regulations, which sets forth the rules governing certain state and local 

(as opposed to federal) criminal history record information systems, expressly 

authorizes disclosure to “ individuals and agencies pursuant to a specific agreement with a criminal justice agency to provide services required for the administration of criminal justice.” 28 C.F.R. § 20.21(b)(3). Because no similar provision 

appears in subpart C, which governs here, one might reasonably infer that such 

disclosures are not currently permitted under that provision.

Further, as noted in your memorandum of October 3, 1997, earlier opinions 

of this office have taken a restrictive view of the Department’s authority to release 

CHRI to recipients not specifically identified in §534,8 and the Department 

historically has not permitted third-party access to CHRI. The courts have 

indicated that when an agency changes its interpretation of a regulation so fundamentally that it is equivalent to an amendment of the regulation, the change 

must be accomplished through notice-and-comment rulemaking. See Shalala v.

Guernsey Memorial Hosp., 514 U.S. 87 (1995); Paralyzed Veterans o f America

v. D.C. Arena L.P., 117 F.3d 579, 586 (D.C. Cir. 1997), cert denied, 523 U.S. 

1003 (1998).

Finally, by proceeding by notice-and-comment rulemaking, the Department will 

insure that its interpretation of § 534 receives the full weight of Chevron deference. 

Although the question is unsettled, a court might well provide less deference to 

an “ interpretative” rule, which is not subject to formal rulemaking, than to a 

“ legislative” rule, which is subject to the notice-and-comment process.9 Compare

Martin v. Occupational Safety & Health Review Comm'n, 499 U.S. 144, 157 

(1991) (interpretative rules “ not entitled to the same deference as norms that

1 See Federal Bureau o f Investigations—Disclosure o f Criminal Record—Admission to the Bar, 3 Op. O L.C. 55 

(1979), see also Vtz v. Cullmane, 520 F2d 467, 477 n 20 (D C Cir 1975) (“ regulations set apparently stringent 

standards as to the maximum extent of dissemination” )

8See FBI Memo at 4 n.3 (citing, e.g., Lawton Memo and CARCO Memo)

9 In our view, the availability of Chevron deference should turn on whether Congress intended for deference to 

apply, and not on whether a rule is “ interpretative” or “ legislative ” We cannot say with any certainty, however, 

that a reviewing court would adopt this same view

124
derive from the exercise of the Secretary’s delegated lawmaking powers” ) (dicta) 

with Elizabeth Blackwell Health Ctr. fo r Women v. Knoll, 61 F.3d 170, 182 (3d 

Cir. 1995) (Chevron deference is appropriate “ even though the Secretary’s 

interpretation is not contained in a ‘legislative rule’ ” ), cert, denied, 516 U.S. 

1093 (1996). Receiving full Chevron deference, moreover, may prove important 

to sustaining the Department’s position in potential litigation.

In light of all these considerations, we believe that to proceed without first 

amending the regulations in accordance with the APA would invite significant 

legal challenge.

III.

If a decision is made to amend the regulations to authorize provision of CHRI 

to criminal justice contractors, it is essential that this goal be achieved in a manner 

that will subject contractor access to effective controls against unauthorized use 

or further dissemination. As the Supreme Court has observed, Congress intended 

that §534 be applied in a manner that is protective of “ the privacy of rap-sheet 

subjects.” Reporters Comm, fo r Freedom o f the Press, 489 U.S. at 749, 765. 

Moreover, § 534(b) provides for Department of Justice oversight of the dissemination of CHRI by giving the Attorney General the authority to cancel the exchange 

of CHRI if an unauthorized dissemination is made. The Department’s responsibility to protect the privacy of CHRI will require, in our view, that it have at 

its disposal the means of controlling the use of this information.

The precise form of such controls will depend upon a variety of factors. As 

a starting point, however, the Department might consider whether the provisions 

governing CHRI access agreements between states and criminal justice contractors 

set forth in subpart B of the CJIS Regulations would provide an appropriate model. 

The subpart B regulations require that such agreements shall “ limit the use of 

data to purposes for which given, insure the security and confidentiality of the 

data consistent with these regulations, and provide sanctions for violations 

thereof.” 28 C.F.R. § 20.21(b)(3). We would, of course, be happy to consider 

whether any particular proposal satisfies statutory requirements.

Finally, we note that authorizing the provision of federal criminal history records 

to the entities in question would require compliance with the Privacy Act. See

5 U.S.C. §552a (1994 & Supp. II 1996). The criminal history records maintained 

by the FBI and provided through the NCIC are part of a system of records that 

is subject to the Privacy Act. Accordingly, covered agencies may not disclose 

such records to other agencies or institutions unless the subject of the records 

consents or one of the statute’s exemptions apply. Id. § 552a(b).'°

l0In defining covered “ agencies.’' see 5 U.SC. § 552a(a)( 1). the Privacy Act adopts by cross-reference the 

Freedom of Information Act’s definition of “ agency,” which “ includes any executive department, military department, Government corporation. Government controlled corporation, or other establishment in the executive branch

Continued

Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal

Justice Functions

125
Opinions o f the Office o f Legal Counsel in Volume 22

Here, the criminal justice or law enforcement uses for which the information 

would be provided would likely qualify for the issuance of a “ routine use” exception to the Privacy Act’s prohibitions against unconsented disclosures. See 5

U.S.C. §552a(b)(3). A “ routine use” means, with respect to the disclosure of 

a record, “ the use of such record for a purpose which is compatible with the 

purpose for which it was collected.” Id. §552a(a)(7). We think that the uses of 

CHRI indicated in the examples you have submitted would generally be compatible with the law enforcement and related purposes for which it was collected 

by the FBI and other agencies. We have not undertaken, however, to determine 

whether these particular uses would qualify under any of the existing published 

routine uses applicable to the relevant systems of records. See, e.g., Privacy Act 

of 1974; Modified Systems of Records Notice (Fingerprint Identification Records 

System), 61 Fed. Reg. 6385 (1996); Privacy Act of 1974; Modified System of 

Records Notice (NCIC), 60 Fed. Reg. 19,774 (1995). Before actually authorizing 

the disclosure of CHRI to private criminal justice contractors, the Justice Department should issue any new routine use notifications necessary to cover the particular disclosures in question.

RANDOLPH D. MOSS 

Deputy Assistant Attorney General

Office o f Legal Counsel

of the Government (including the Executive Office of the President), or any independent regulatory agency ” 5 

U .SC §552(0(1) (Supp II 1996)

126