California Code of Regulations › Title 11 - Law › Division 1 - Attorney General › Chapter 12 - California Restraining and Protective Order System › Article 3 - Access and Use › Section 966 - Procedures for Requesting CARPOS De-Identified Individual-Level Data or Identified Individual-Level Data

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) A Bona Fide
				  Researcher shall electronically submit a completed Data Request Standard Application
				  to the Department's Research Services by following the data request process on the
				  Attorney General's website.
(b) To
				  complete the Data Request Standard Application a Bona Fide Researcher shall provide
				  all of the following information on the Data Request Standard Application form:
(1) Designation as a new request or a modified
				  request. If the request is to modify an existing request, include the project number
				  assigned to the existing request.
(2)
				  Date of request.
(3) Name and position
				  title of the Bona Fide Researcher.
(4)
				  Bona Fide Researcher's address, city, state, and postal code which is connected to
				  the Nonprofit Bona Fide Research Institution with which the Bona Fide Researcher is
				  Affiliated.
(5) Bona Fide Researcher's
				  phone number and email address which is connected to the Nonprofit Bona Fide
				  Research Institution with which the Bona Fide Researcher is Affiliated.
(6) Name of the Nonprofit Bona Fide Research
				  Institution with which the Bona Fide Researcher is Affiliated.
(7) Name, phone number, and email address of the
				  Nonprofit Bona Fide Research Institution's information security officer or
				  Information Technology (IT) manager.
(8)
				  Project title.
(9) Date of anticipated
				  completion of the project or the report.
(10) List of information for each Team Member that
				  includes all of the following:
(A) Name of the
				  Team Member.
(B) The physical location
				  from which the Team Member will access CARPOS De-Identified Individual-Level Data or
				  Identified Individual-Level Data.
(C)
				  Whether the Team Member is part of the data analysis team.
(D) Whether the Team Member is part of the IT
				  team.
(11) Signature of the
				  Bona Fide Researcher, and date of signature of the Bona Fide Researcher.
(12) Completed Data Request Standard Application
				  checklist that includes all of the following:
(A)
				  Project outline that describes all of the following:
(i) The purposes and objectives of the project or
				  report.
(ii) Specifically, how the
				  requested data, especially Identified Individual-Level Data and PII, is required and
				  will be used to support the project's Peer Review purposes, Research Purposes,
				  Statistical Purposes, and/or the Study of the Prevention of Violence.
(iii) The expected benefits of the
				  project.
(iv) If applicable, (1) the
				  funding source of the project or report, including whether the funding source is a
				  public or private grant, (2) the grant period, and (3) the grant expiration
				  date.
(v) Proposed project design and
				  methodology, including, (1) where the data analysis will be conducted, and (2) a
				  detailed description of how the requested CARPOS De-Identified Individual-Level Data
				  or Identified Individual-Level Data will be used and analyzed.
(vi) Information pertaining to the applicant's
				  project approval process, including review and approval by an institutional review
				  board.
(B) Curriculum vitae of
				  the Bona Fide Researcher.
(C) Signature
				  of the Bona Fide Researcher, and the date of signature of the Bona Fide Researcher,
				  acknowledging the restrictions on use or disclosure of CARPOS De-Identified
				  Individual-Level Data or Identified Individual-Level Data, as specified in section
				  964.
(D) A signed document, which includes the
				  following provisions:
(i) The name, signature, and
				  date of signature, of the Nonprofit Bona Fide Research Institution's information
				  security officer or IT manager.
(ii) A
				  certification that security controls are in place to meet the requirements of the
				  United States Department of Justice, Criminal Justice Information Services (CJIS)
				  Security Policy, Version 5.9, dated June 1, 2020, United States Department of
				  Justice, CJIS Requirements Companion Document to the FBI CJIS Security Policy
				  Version 5.9, dated June 1, 2020, and the FBI CJIS Appendix A Cloud Control Catalog,
				  which are hereby incorporated by reference.
(iii) A certification that if data storage will be
				  in a data server maintained by a cloud provider, the data storage must have
				  undergone either (a) a Systems and Organization (SOC) 2 audit or (b) a Federal Risk
				  and Authorization Management Program (FedRAMP) certification.
(E) Any relevant research materials, including,
				  but not limited to proposals, endorsements, and questionnaires.
(F) A copy of the approval by an institutional
				  review board or human subjects committee (including the documentation submitted as
				  part of the approval process and the application number and expiration date),
				  demonstrating that the institutional review board or human subjects committee
				  considered relevant federal and state laws governing human
				  research.