Privacy Act of 1974; New System of Records

DEPARTMENT OF JUSTICE

[AAG/A Order No. 119-96]

Privacy Act of 1974; New System of Records

Pursuant to the provisions of the Privacy Act (5 U.S.C. 552a) and

Office of Management and Budget Circular No. A-130, notice is hereby

given that the Department of Justice proposes to establish a new system

of records to be maintained by the Federal Bureau of Investigation.

The National DNA Index System (NDIS) (JUSTICE/FBI-017) is a new

system of records for which no public notice consistent with the

provisions of 5 U.S.C. 552a(e) (4) and (11) has been published in the

Federal Register.

In order to comply with 5 U.S.C. 552a(e) (4) and (11), the public

must be given a 30-day period in which to comment on new routine use

disclosures; and the Office of Management and Budget (OMB), which has

oversight responsibility under the Act, requires a 40-day period in

which to review the system before it is implemented. Therefore, the

public, the OMB, and the Congress are invited to submit written

comments to Patricia E. Neely, Program Analyst, Information Management

and Security Staff, Information Resources Management, Department of

Justice, Washington, DC 20530 (Room 850, WCTR Building). Comments from

the public must be received by August 19, 1996. No further notice will

appear in the Federal Register unless comments are received and

publication pursuant thereto is deemed appropriate. A proposed rule to

exempt the system is also being published in the ``Proposed Rules''

Section of today's Federal Register.

In accordance with Privacy Act requirements, the Department of

Justice has provided a report on the proposed system of records to OMB

and the Congress.

Dated: July 8, 1996.

Stephen R. Colgate,

Assistant Attorney General for Administration.

JUSTICE/FBI-017

System name:

National DNA Index System (NDIS).

System location:

Federal Bureau of Investigation: FBI Laboratory, U.S. Department of

Justice, J. Edgar Hoover Building, 935 Pennsylvania Ave., NW.,

Washington, DC 20535-0001.

Categories of individuals covered by the system:

Individuals in this system include persons designated by criminal

justice agencies as belonging to one or more of the following groups:

A. Convicted offenders: Persons who have been convicted of crimes

in Federal, State, and/or local courts where the applicable law permits

establishment of a DNA record for the convicted person.

B. Missing persons and their close biological relatives: Persons

reported missing or whose whereabouts are unknown and sought and their

close biological relatives, such as parents, siblings, and children.

C. Victims: Persons, living or dead, who have been victims of

crimes where the perpetrator of the crime may have

[[Page 37496]]

carried DNA of the victim away from the crime scene.

D. DNA personnel: Personnel in Federal, State, and/or local

criminal justice agencies who perform duties related to or are

responsible for DNA records.

Categories of records in the system:

The following definitions are used in this notice:

A. A DNA sample is a body tissue or fluid sample usually a blood

and/or buccal sample, that can be subjected to DNA analysis.

B. A DNA profile consists of a set of DNA identification

characteristics, i.e., the particular chemical form at the various DNA

locations (loci), which permit the DNA of one person to be

distinguishable from that of another person.

C. A target DNA profile is a DNA profile submitted by a criminal

justice agency for the purpose of identifying DNA profiles maintained

by NDIS which match the target DNA profile.

D. A target DNA profile search is a search of appropriate NDIS DNA

records for those records with DNA profiles that may match the target

DNA profile.

E. Personally identifiable information is information such as

names, dates of birth, or social security numbers which are normally

used to identify individuals. Personally identifiable information, as

used in this notice, does not include information derived from the

examination of a DNA sample.

F. A DNA record includes the DNA profile as well as data required

to manage and operate NDIS, i.e., the NDIS Agency identifier which

serves to identify the submitting agency; the NDIS Specimen

Identification Number; information related to the reliability and

maintainability of the DNA profiles; and names of the participating

laboratories and DNA personnel associated with DNA profile analyses.

Records in this system do not include DNA samples but do include

DNA profiles of persons described under ``Categories of Individuals

Covered by the System'' in paragraph A-C. DNA records are input by

criminal justice agencies for use by the NDIS. NDIS includes the names

of DNA personnel associated with DNA profile analyses, the date after

which DNA records from a given DNA analyst can be accepted, and, when

applicable, the date after which associated DNA records are not

accepted. NDIS does not contain case-related or other personally

identifying information about the person from whom the DNA sample was

collected.

DNA records are maintained as follows:

1. The Convicted Offender Index, consisting of DNA records from

convicted offenders;

2. The Missing Persons Index, consisting of DNA records from

missing persons;

3. The Close Biological Relatives Index, consisting of DNA records

from close biological relatives of missing persons;

4. The Unidentified Persons Index, consisting of DNA records from

recovered living persons (e.g., children who can't and others who can't

or refuse to identify themselves), and recovered dead persons

(including their body parts and tissues), whose identities are not

known;

5. The Victims Index, consisting of DNA records from victims,

living or dead, from whom DNA may have been carried away by

perpetrators;

6. The Forensic Index, consisting of DNA records from persons whose

identities are not known with certainty and who left DNA at the scene

of a crime or whose DNA was carried away from it; and

7. The Population File, consisting of DNA profiles intended to

represent various population segments found in the United States. The

Population File consists of DNA records from individuals whose

identities may be: (a) Known to; (b) not known, but determinable under

some circumstances by; or (c) not known and not determinable by the

criminal justice agency submitting the DNA records to NDIS.

Authority for maintenance of the system:

The Violent Crime Control and Law Enforcement Act of 1994, Pub. L.

No. 103-322, 108 Stat. 1796.

Purpose(s):

The purpose of this system and the DNA records maintained in the

system is to provide a national storage medium for DNA records input by

criminal justice agencies. These records can be searched in order to

identify DNA associations with a DNA record obtained during an

investigation of a crime or a missing person. The system is also

maintained for statistical, identification research, and protocol

development and quality control purposes.

In addition to DNA records, records about DNA personnel are

maintained in the system. The purposes of these DNA personnel records

are to control the acceptance of DNA records by NDIS and to facilitate

criminal justice agency contracts required to resolve potential DNA

matches.

Routine uses of records maintained in the system, including categories

of users and the purposes of such uses:

1. Direct disclosures of NDIS records are made to the Federal,

State, and local criminal justice agencies who participate in NDIS. As

a result of an NDIS search by a criminal justice agency, the NDIS

system analyzes the target DNA profile entered by the search agency and

may identify a potential match. Where NDIS identifies a potential

match, the matching DNA's records will be disclosed to the criminal

justice agencies associated with the match.

2. The Federal statute which authorizes NDIS also provides that the

FBI and other criminal justice agencies participating in NDIS may make

secondary or indirect disclosures of DNA records:

(A) To criminal justice agencies for law enforcement identification

purposes;

(B) In judicial proceedings, if otherwise admissible pursuant to

applicable statutes or rules;

(C) For criminal defense purposes, to a defendant, who shall have

access to samples and analyses performed in connection with the case in

which defendant is charged; or

(D) If personally identifiable information is removed, for a

population statistics database, for identification research and

protocol development purposes, or for quality control purposes.

Note: Personal information such as names are not found in NDIS.

However, operational identifiers such as the Specimen No., Criminal

Justice Agency Identifier, and DNA Personnel identifier, are

contained in NDIS. Although unlikely, the identity of an individual

could, under some circumstances, be ascertained with the disclosure

of such numbers for purposes stated in (D) above. This is only

possible when access to a criminal justice agency's records is

provided to the holder of the operational identifiers. Therefore, to

ensure that such associations are not made, these operational

numbers will be removed before disclosure for these purposes.

3. A record may be disclosed from this system of records to the

National Archives and Records Administration and the General Services

Administration in records management inspections conducted under the

authority of 44 U.S.C. 2904 and 2906, to the extent that legislation

governing the records permits.

[[Page 37497]]

Policies and practices for storing, retrieving, accessing, retaining,

and disposing of records in the system:

Storage:

Information maintained in NDIS is stored electronically for use in

a computer environment.

Retrievability:

The primary method for retrieving information from NDIS is the

target DNA profile search described in the routine use disclosure

provisions of this notice.

The NDIS Custodian may retrieve records based on: the DNA profile,

the NDIS Agency identifier, the NDIS Specimen Identification Number,

and/or DNA personnel identifier. Criminal justice agencies with direct

access to NDIS may retrieve their records by the NDIS Agency

identifier, NDIS Specimen Identification Number, or DNA personnel

identifier but only to inspect, modify, or delete their own DNA

records.

Since NDIS records contained in NDIS do not include personal

identifiers of the individuals from whom the DNA samples were

collected, retrieval by personal identifiers of these record subjects

is not possible.

Safeguards:

All records in NDIS are protected from unauthorized access through

appropriate administrative, physical, and technical safeguards. These

safeguards include restricting access to those with a need-to-know to

perform their official duties, using locks and alarm devices, and

encrypting data communications.

No personally identifiable information about individuals who

provided DNA samples is maintained in NDIS. Therefore, names and

personally identifiable information of NDIS DNA records cannot be

disclosed directly from NDIS. (NDIS does, however, maintain the names

of NDA personnel.)

NDIS will disclose to a criminal justice agency the DNA records of

another criminal justice agency only when there is a potential DNA

match. Any additional disclosures of personally identifiable

information or other case-related data are made directly by the

criminal justice agencies from their own files and records, not from

NDIS.

Although ostensibly devoid of personally identifiable information,

DNA records in NDIS contain an NDIS Specimen Identification Number,

NDIS Agency identifier, and a DNA personnel identifier for law

enforcement and/or general operational purposes. Since it is possible,

in some circumstances, to use those numbers together with the

appropriate agency's own records to identify the individuals

represented by the DNA records, additional precautions are taken.

The precautions involve removal of the Specimen Identification

Numbers, NDIS Agency identifiers, and DNA personnel identifiers, prior

to disclosure pursuant to the 2(D) routine use. (See the ``Routine Uses

of Records Maintained in the System'' section of this notice.) Thus,

NDIS will periodically generate DNA profile data sets, consisting of

anonymous DNA profiles, for population statistics databases, for

identification research and protocol development purposes, or for

quality control purposes.

Criminal justice agencies are prohibited from submitting a DNA

record for inclusion in the NDIS Population File for investigative

purposes. The only target DNA profile searches conducted against the

Population File are those necessary to eliminate duplicate DNA profiles

representing the same individual.

Finally, criminal justice agencies with direct access to NDIS must

agree to adhere to national quality assurance standards for DNA

testing, undergo semi-annual external proficiency testing, and restrict

access to DNA samples and data. The NDIS will not accept DNA analyses

from those agencies and/or DNA personnel who fail to comply with these

standards and restrictions; and the NDIS Custodian is authorized to

restrict access to and delete any DNA records previously entered into

the system.

Retention and Disposal:

DNA records generated by criminal justice agencies, together with

the personal identifying information of DNA personnel, shall be

retained in NDIS as long as they are substantiated by internal records

of the submitting agency and are permitted either by consent, by

judicial/criminal justice authority, or by Federal, State, or local

law. Records may be deleted by the originating criminal justice agency

or by other Federal, State, or local authorities who are responsible

for deleting any records that are no longer permitted or appropriate

for retention in NDIS. DNA records submitted to NDIS and then found to

be inaccurate shall either be modified to achieve accuracy or deleted

from NDIS by the submitting agency.

Agencies granted access to NDIS are required to establish and

maintain a system of controls to ensure that continued use of their DNA

records in NDIS is lawfully permitted. Such a system of controls shall

ensure that DNA records in NDIS which are authorized by the consent of

individuals, for example, are retained in NDIS only for the duration

and within the scope of the consent.

The NDIS Custodian has the authority to determine that certain DNA

records in NDIS should be deleted or, alternatively, suspended from use

for a period of time determined appropriate by the NDIS Custodian. The

criminal justice agencies whose records are affected by a determination

to delete or suspend records in NDIS shall be notified of this

determination and the nature of the deletion or suspension. The NDIS

Custodian may subsequently decide to either restore or delete the

suspended records, and shall notify the affected agency of this

subsequent determination.

The DNA personnel identifier for a single individual is deleted

from NDIS only after all DNA records associated with that individual

are deleted.

System manager(s) and address:

Director, Federal Bureau of Investigation, c/o National DNA Index

System Custodian, FBI Laboratory, U.S. Department of Justice, J. Edgar

Hoover Building, 935 Pennsylvania Avenue, NW., Washington, DC 20535-

0001.

Notification procedure:

None. This system of records has been exempted from subsections (d)

and (e)(4)(G) pursuant to subsection (j)(2) of the Privacy Act, and

thus is exempt from the notification provision.

Records access procedure:

This system of records has been exempted from subsection (d) and

(e)(4)(H) pursuant to subsection (j)(2) of the Privacy Act, and thus is

exempt from its access provisions. NDIS does not retain information

that would allow the NDIS Custodian, independent of the agency which

originated the DNA record, to personally identify the record by name or

other personal identifier. However, subject to applicable Federal,

State, and local law and procedures, the following alternative

procedures are available by which an individual may request access to

records in NDIS.

1. Subjects of DNA Records:

a. Convicted Offender Records: The individual may contact the

Federal, State or local authority (the authorized agency) which

ultimately received the collected DNA sample to obtain instructions on

how to access his/her record. The authorized agency has the DNA record,

if one exists, including information as to whether the DNA record has

been submitted to NDIS. Only the authorized agency would have

information sufficiently specific to

[[Page 37498]]

permit retrieval of the record from its files by name or other

personally identifiable information. The authorized agency may also

retrieve the DNA record, if any, that was submitted to NDIS, once

locally specified requirements are met.

In addition, where a convicted offender is relocated voluntarily or

involuntarily to a criminal justice agency (i.e., penal institution or

parole and probation authorities) for custodial or supervisory purposes

in another State or jurisdiction, the DNA record may be created by the

new host criminal justice agency or other State (or Federal) authority

from a DNA sample collected from the Convicted Offender at the new host

criminal justice agency or other State (or Federal) authority. In such

circumstances, the individual may contact such agency or authority for

access instructions.

b. Close Biological Relatives of Missing Persons and Victims;

Living Victims; and Missing Persons Who Have Been Located: These

individuals must contact the criminal justice agency (Federal, State,

or local) which collected and processed the DNA sample to generate the

DNA record. The criminal justice agency can then advise the individual

about procedures for access to the DNA record. Such agency may also

retrieve the DNA record, if any, that was submitted to NDIS, once

locally specified requirements are met.

2. Records of DNA Personnel: These individuals may write to the

Federal, State, or local criminal justice agency by which they are or

were employed.

3. FBI generated records: The subject of an FBI-generated DNA

record may address a Freedom of Information/Privacy Act (FOIA/PA)

request to the Director, FBI, at the address given at the end of this

paragraph. DNA personnel employed by the FBI may also address their

requests to the system manager; however, all the information in NDIS

concerning DNA personnel is also contained in the FBI's Central Records

System (CRS), which may contain additional information. To request

access to the CRS, DNA personnel may address an FOIA/PA request to the

Director, FBI, U.S. Department of Justice, J. Edgar Hoover Building,

935 Pennsylvania Ave., NW., Washington, DC 20535-0001.

Contesting records procedure:

This system of records has been exempted from subsections (d) and

(e)(4)(H) pursuant to subsection (j)(2) of the Privacy Act, and is thus

exempt from its amendment and correction provisions. However, subject

to applicable Federal, State, and local laws and procedures, the

following alternative procedures are available by which an individual

may contest his/her records:

1. All Subjects of DNA Records: The requester must follow the same

procedures for contesting records as those outlined under ``Record

Access Procedures.'' In addition, the requester should be aware of the

following:

a. DNA records submitted to NDIS and contested on the basis of

inaccurate information must be resolved with the criminal justice

agency that submitted the DNA record NDIS. If a contested DNA record is

found to be inaccurate by the criminal justice agency submitting the

DNA record, such agency shall correct the inaccurate DNA record by

either amending or deleting the record.

b. DNA records submitted to NDIS and contested on the basis of the

authority to retain the DNA record must be resolved with the criminal

justice agency that submitted the contested DNA record. If such agency

determines that the contested DNA records should not be included in

NDIS, such agency must delete the contested DNA record.

2. Records of All DNA Personnel: DNA personnel must follow the same

procedures for contesting records as those outlined under ``Record

Access Procedures.''

record source categories:

DNA records in NDIS are received from Federal, State, and local

criminal justice agencies. These DNA records may be derived from DNA

samples obtained by Federal, State, and local and criminal justice

agencies or their agents (public or private).

Systems exempted from certain provisions of the Act:

The Attorney General has exempted this system of records from

subsection (c) (3) and (4); (d); (e) (1), (2), and (3); (e)(4) (G) and

(H); (e) (5) and (8); and (g) of the Privacy Act pursuant to 5 U.S.C.

552a(j)(2). Rules are being promulgated in accordance with the

requirements of 5 U.S.C. 553 (b), (c), and (e); and are being published

in the Federal Register.

[FR Doc. 96-18328 Filed 7-17-96; 8:45 am]

BILLING CODE 4410-02-M