Privacy regulations

F. OJP Privacy Regulations (28 CFR Part 22)
From: http://www.access.gpo.gov/nara/cfr/waisidx_04/28cfr22_04.html
TITLE 28--JUDICIAL ADMINISTRATION
CHAPTER I--DEPARTMENT OF JUSTICE
PART 22_CONFIDENTIALITY OF IDENTIFIABLE RESEARCH AND STATISTICAL
INFORMATION--Table of Contents
Sec.
22.1 Purpose.
22.2 Definitions.
22.20 Applicability.
22.21 Use of identifiable data.
22.22 Revelation of identifiable data.
22.23 Privacy certification.
22.24 Information transfer agreement.
22.25 Final disposition of identifiable materials.
22.26 Requests for transfer of information.
22.27 Notification.
22.28 Use of data identifiable to a private person for judicial,
legislative or administrative purposes.
22.29 Sanctions.
Authority: Secs. 801(a), 812(a), Omnibus Crime Control and Safe
Streets Act of 1968, 42 U.S.C. 3701, et seq., as amended (Pub. L. 90351, as amended by Pub. L. 93-83, Pub. L. 93-415, Pub. L. 94-430, Pub.
L. 94-503, Pub. L. 95-115, Pub. L. 96-157, and Pub. L. 98-473); secs.
262(b), 262(d), Juvenile Justice and Delinquency Prevention Act of 1974, 42 U.S.C. 5601, et seq., as
amended (Pub. L. 93-415, as amended by Pub. L. 94-503, Pub. L. 95-115, Pub. L. 99-509, and Pub. L. 98473); and secs. 1407(a) and 1407(d) of the Victims of Crime Act of 1984, 42 U.S.C. 10601, et seq., Pub.
L. 98-473; Pub. L. 101-410, 104 Stat. 890, as amended by Pub. L. 104-134, 110 Stat. 1321.
Source: 41 FR 54846, Dec. 15, 1976, unless otherwise noted.
22.1 Purpose
The purpose of these regulations is to:
(a) Protect privacy of individuals by requiring that information
identifiable to a private person obtained in a research or statistical
program may only be used and/or revealed for the purpose for which
obtained;
(b) Insure that copies of such information shall not, without the
consent of the person to whom the information pertains, be admitted as
evidence or used for any purpose in any judicial or administrative
proceedings;
OMB Submission

National Juvenile Probation Census Project

Page 36

(c) Increase the credibility and reliability of federally-supported
research and statistical findings by minimizing subject concern over
subsequent uses of identifiable information;
(d) Provide needed guidance to persons engaged in research and
statistical activities by clarifying the purposes for which identifiable information may be used or revealed;
and
(e) Insure appropriate balance between individual privacy and
essential needs of the research community for data to advance the state
of knowledge in the area of criminal justice.
(f) Insure the confidentiality of information provided by crime
victims to crisis intervention counselors working for victim services
programs receiving funds provided under the Crime Control Act, and
Juvenile Justice Act, and the Victims of Crime Act.
[41 FR 54846, Dec. 15, 1976, as amended at 51 FR 6400, Feb. 24, 1986]
Sec. 22.2 Definitions.
(a) Person means any individual, partnership, corporation,
association, public or private organization or governmental entity, or
combination thereof.
(b) Private person means any person defined in Sec. 22.2(a) other
than an agency, or department of Federal, State, or local government, or any component or combination
thereof. Included as a private person is an individual acting in his or her official capacity.
(c) Research or statistical project means any program, project, or
component thereof which is supported in whole or in part with funds
appropriated under the Act and whose purpose is to develop, measure,
evaluate, or otherwise advance the state of knowledge in a particular area. The term does not include
``intelligence'' or other information-gathering activities in which information pertaining to specific
individuals is obtained for purposes directly related to
enforcement of the criminal laws.
(d) Research or statistical information means any information which
is collected during the conduct of a research or statistical project and which is intended to be utilized for
research or statistical purposes. The term includes information which is collected directly from the
individual or obtained from any agency or individual having possession, knowledge, or control thereof.
(e) Information identifiable to a private person means information
which either-(1) Is labelled by name or other personal identifiers, or
(2) Can, by virtue of sample size or other factors, be reasonably
interpreted as referring to a particular private person.
(f) Recipient of assistance means any recipient of a grant,
contract, interagency agreement, subgrant, or subcontract under the Act
and any person, including subcontractors, employed by such recipient in
connection with performances of the grant, contract, or interagency
agreement.
(g) Officer or employee of the Federal Government means any person
employed as a regular or special employee of the U.S. (including
experts, consultants, and advisory board members) as of July 1, 1973, or at any time thereafter.
OMB Submission

National Juvenile Probation Census Project

Page 37

(h) The act means the Omnibus Crime Control and Safe Streets Act of
1968, as amended.
(i) Applicant means any person who applies for a grant, contract, or subgrant to be funded pursuant to
the Act.
(j) The Juvenile Justice Act means the ``Juvenile Justice and
Delinquency Prevention Act of 1974, as amended.''
(k) The Victims of Crime Act means the Victims of Crime Act of 1984.
[41 FR 54846, Dec. 15, 1976, as amended at 43 FR 16974, Apr. 21, 1978;
51 FR 6400, Feb. 24, 1986]

Sec. 22.20 Applicability.
(a) These regulations govern use and revelation of research and
statistical information obtained, collected, or produced either directly by BJA, OJJDP, BJS, NIJ, or OJP or
under any interagency agreement, grant, contract, or subgrant awarded under the Crime Control Act, the
Juvenile Justice Act, and the Victims of Crime Act.
(b) The regulations do not apply to any records from which
identifiable research or statistical information was originally
obtained; or to any records which are designated under existing statutes as public; or to any information
extracted from any records designated as public.
(c) The regulations do not apply to information gained regarding
future criminal conduct.
[41 FR 54846, Dec. 15, 1976, as amended at 43 FR 16974, Apr. 21, 1978;
51 FR 6400, 6401, Feb. 24, 1986]

Sec. 22.21 Use of identifiable data.
Research or statistical information identifiable to a private person may be used only for research or
statistical purposes.

Sec. 22.22 Revelation of identifiable data.
(a) Except as noted in paragraph (b) of this section, research and
statistical information relating to a private person may be revealed in
identifiable form on a need-to-know basis only to-(1) Officers, employees, and subcontractors of the recipient of
assistance;
(2) Such individuals as needed to implement sections 202(c)(3), 801, and 811(b) of the Act; and
sections 223(a)(12)(A), 223(a)(13),
223(a)(14), and 243 of the Juvenile Justice and Delinquency Prevention
Act.
(3) Persons or organizations for research or statistical purposes.
Information may only be transferred for such purposes upon a clear
OMB Submission

National Juvenile Probation Census Project

Page 38

demonstration that the standards of Sec. 22.26 have been met and that,
except where information is transferred under paragraphs (a) (1) and (2) of this section, such transfers shall
be conditioned on compliance with a Sec. 22.24 agreement.
(b) Information may be revealed in identifiable form where prior
consent is obtained from an individual or where the individual has agreed to participate in a project with
knowledge that the findings cannot, by virtue of sample size, or uniqueness of subject, be expected to
totally conceal subject identity.
[41 FR 54846, Dec. 15, 1976, as amended at 51 FR 6400, Feb. 24, 1986]

Sec. 22.23 Privacy certification.
(a) Each applicant for BJA, OJJDP, BJS, NIJ, or OJP support either
directly or under a State plan shall submit a Privacy Certificate as a
condition of approval of a grant application or contract proposal which
has a research or statistical project component under which information
identifiable to a private person will be collected.
(b) The Privacy Certificate shall briefly describe the project and
shall contain assurance by the applicant that:
(1) Data identifiable to a private person will not be used or
revealed, except as authorized under Sec. Sec. 22.21, 22.22.
(2) Access to data will be limited to those employees having a need
therefore and that such persons shall be advised of and agree in writing to comply with these regulations.
(3) All subcontracts which require access to identifiable data will
contain conditions meeting the requirements of Sec. 22.24.
(4) To the extent required by Sec. 22.27 any private persons from
whom identifiable data are collected or obtained, either orally or by
means of written questionnaire, shall be advised that the data will only be used or revealed for research or
statistical purposes and that
compliance with requests for information is not mandatory. Where the
notification requirement is to be waived, pursuant to Sec. 22.27(c), a
justification must be included in the Privacy Certificate.
(5) Adequate precautions will be taken to insure administrative and
physical security of identifiable data.
(6) A log will be maintained indicating that identifiable data have
been transmitted to persons other than BJA, OJJDP, BJS, NIJ, or OJP or
grantee/contractor staff or subcontractors, that such data have been
returned, or that alternative arrangements have been agreed upon for
future maintenance of such data.
(7) Project plans will be designed to preserve anonymity of private
persons to whom information relates, including, where appropriate, name-stripping, coding of data, or
other similar procedures.
(8) Project findings and reports prepared for dissemination will not contain information which can
reasonably be expected to be identifiable to a private person except as authorized under Sec. 22.22.
(c) The applicant shall attach to the Privacy Certification a
description of physical and/or administrative procedures to be followed
to insure the security of the data to meet the requirements of Sec.
OMB Submission

National Juvenile Probation Census Project

Page 39

22.25.
[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]

Sec. 22.24 Information transfer agreement.
Prior to the transfer of any identifiable information to persons
other than BJA, OJJDP, BJS, NIJ, or OJP or project staff, an agreement
shall be entered into which shall provide, as a minimum, that the
recipient of data agrees that:
(a) Information identifiable to a private person will be used only
for research and statistical purposes.
(b) Information identifiable to a private person will not be
revealed to any person for any purpose except where the information has
already been included in research findings (and/or data bases) and is
revealed on a need-to-know basis for research or statistical purposes,
provided that such transfer is approved by the person providing
information under the agreement, or authorized under Sec. 22.24(e).
(c) Knowingly and willfully using or disseminating information
contrary to the provisions of the agreement shall constitute a violation of these regulations, punishable in
accordance with the Act.
(d) Adequate administrative and physical precautions will be taken
to assure security of information obtained for such purpose.
(e) Access to information will be limited to those employees or
subcontractors having a need therefore in connection with performance of the activity for which obtained,
and that such persons shall be advised of, and agree to comply with, these regulations.
(f) Project plans will be designed to preserve anonymity of private
persons to whom information relates, including, where appropriate,
required name-stripping and/or coding of data or other similar
procedures.
(g) Project findings and reports prepared for dissemination will not contain information which can
reasonably be expected to be identifiable to a private person.
(h) Information identifiable to a private person (obtained in
accordance with this agreement) will, unless otherwise agreed upon, be
returned upon completion of the project for which obtained and no copies of that information retained.
[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]

Sec. 22.25 Final disposition of identifiable materials.
Upon completion of a research or statistical project the security of identifiable research or statistical
information shall be protected by:
(a) Complete physical destruction of all copies of the materials or
the identifiable portion of such materials after a three-year required
recipient retention period or as soon as authorized by law, or
OMB Submission

National Juvenile Probation Census Project

Page 40

(b) Removal of identifiers from data and separate maintenance of a
name-code index in a secure location.
The Privacy Certificate shall indicate the procedures to be followed and shall, in the case of paragraph (b)
of this section, describe procedures to secure the name index.

Sec. 22.26 Requests for transfer of information.
(a) Requests for transfer of information identifiable to an
individual shall be submitted to the person submitting the Privacy
Certificate pursuant to Sec. 22.23.
(b) Except where information is requested by BJA, OJJDP, BJS, NIJ,
or OJP, the request shall describe the general objectives of the project for which information is requested,
and specifically justify the need for such information in identifiable form. The request shall also indicate,
and provide justification for the conclusion that conduct of the project will not, either directly or indirectly,
cause legal, economic, physical, or social harm to individuals whose identification is revealed in the
transfer of information.
(c) Data may not be transferred pursuant to this section where a
clear showing of the criteria set forth above is not made by the person
requesting the data.
[41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]

Sec. 22.27 Notification.
(a) Any person from whom information identifiable to a private
person is to be obtained directly, either orally, by questionnaire, or
other written documents, shall be advised:
(1) That the information will only be used or revealed for research
or statistical purposes; and
(2) That compliance with the request for information is entirely
voluntary and may be terminated at any time.
(b) Except as noted in paragraph (c) of this section, where
information is to be obtained through observation of individual activity or performance, such individuals
shall be advised:
(1) Of the particular types of information to be collected;
(2) That the data will only be utilized or revealed for research or
statistical purposes; and
(3) That participation in the project in question is voluntary and
may be terminated at any time.
(c) Notification, as described in paragraph (b) of this section, may be eliminated where information is
obtained through field observation of individual activity or performance and in the judgment of the
researcher such notification is impractical or may seriously impede the progress of the research.
(d) Where findings in a project cannot, by virtue of sample size, or uniqueness of subject, be expected to
totally conceal subject identity, an individual shall be so advised.
OMB Submission

National Juvenile Probation Census Project

Page 41

Sec. 22.28 Use of data identifiable to a private person for judicial,
legislative or administrative purposes.
(a) Research or statistical information identifiable to a private
person shall be immune from legal process and shall only be admitted as
evidence or used for any purpose in any action, suit, or other judicial, legislative or administrative
proceeding with the written consent of the individual to whom the data pertains.
(b) Where consent is obtained, such consent shall:
(1) Be obtained at the time that information is sought for use in
judicial, legislative or administrative proceedings;
(2) Set out specific purposes in connection with which information
will be used;
(3) Limit, where appropriate, the scope of the information subject
to such consent.
[41 FR 54846, Dec. 15, 1976, as amended at 45 FR 62038, Sept. 18, 1980]

Sec. 22.29 Sanctions.
Where BJA, OJJDP, BJS, NIJ, or OJP believes that a violation of
section 812(a) of the Act or section 1407(d) of the Victims of Crime
Act, these regulations, or any grant or contract conditions entered into thereunder has occurred, it may
initiate administrative actions leading to termination of a grant or contract, commence appropriate
personnel and/or other procedures in cases involving Federal employees, and/or initiate appropriate legal
actions leading to imposition of a civil penalty not to exceed $10,000 for a violation occurring before
September 29, 1999, and not to exceed $11,000 for a violation occurring on or after September 29, 1999
against any person responsible for such
violations.
[Order No. 2249-99, 64 FR 47102, Aug. 30, 1999]

OMB Submission

National Juvenile Probation Census Project

Page 42