Report of the National Task Force on Privacy, Technology, And…

U.S. Department of Justice Office of Justice Programs

Bureau of Justice Statistics Report of the National Task Force on Privacy, Technology, and Criminal Justice Information

Law and policy Change drivers Recommendations

Privacy, Technology, and Criminal Justice Information

U.S. Department of Justice Office of Justice Programs Bureau of Justice Statistics

Report of the National Task Force on Privacy, Technology, and Criminal Justice Information

August 2001, NCJ 187669

Report of the work prepared under Cooperative Agreement number 96-BJ-CX-K010, awarded to SEARCH Group, Incorporated, 7311 Greenhaven Drive, Suite 145, Sacramento, California 95831. Contents of this document do not necessarily represent the views or policies of the Bureau of Justice Statistics or the U.S. Department of Justice. U.S. Department of Justice Bureau of Justice Statistics

Lawrence A. Greenfeld Acting Director

Acknowledgments. This report was prepared by SEARCH, The National Consortium for Justice Information and Statistics, Kenneth E. Bischoff, Chair, and Gary R. Cooper, Executive Director. The project director was Sheila J. Barton, Deputy Executive Director. Robert R. Belair, SEARCH General Counsel, wrote this report. Kevin L. Coy, Associate, Mullenholz, Brimsek & Belair, assisted in its preparation. Twyla R. Cunningham, Manager, Corporate Communications, and Linda B. Townsdin, Writer/Editor, edited this report, and Jane L. Bassett, Publishing Specialist, provided layout and design assistance. The Federal project monitor was Carol G. Kaplan, Chief, Criminal History Improvement Programs, Bureau of Justice Statistics.

Report of work prepared under Cooperative Agreement number 96-BJ-CX-K010, awarded to SEARCH Group, Incorporated, 7311 Greenhaven Drive, Suite 145, Sacramento, California 95831. Contents of this document do not necessarily represent the views or policies of the Bureau of Justice Statistics or the U.S. Department of Justice.

The U.S. Department of Justice authorizes any person to reproduce, publish, translate, or otherwise use all or any part of the copyrighted material to this publication, except for those items indicating they are copyrighted or printed by any source other than SEARCH, The National Consortium for Justice Information and Statistics.

Page ii Report of the National Task Force on Privacy, Technology and Criminal Justice Information Contents

I. Introduction and executive summary ...... 1

II. Report purpose and scope...... 8

III. Information privacy standards: Background ...... 10

IV. Privacy protections for criminal justice information ...... 12 A brief overview of the structure of the criminal justice information system ...... 12 Constitutional and common law standards with respect to the privacy of criminal history record information ...... 14 Constitutional standards ...... 14 Common law standards ...... 16 Federal criminal history record legislation and regulations...... 16 SEARCH Technical Report No. 13 ...... 18 State legislation...... 18 Access to criminal history record information in “open,” “intermediate,” and “closed” record States: Three case studies...... 21 Florida: An “open records” State ...... 21 Washington: An “intermediate records” State ...... 23 Massachusetts: A “closed records” State ...... 25

V. Change drivers and trend lines: The basis for a new look at privacy and criminal justice information ...... 27 Information privacy concerns at a historic high level...... 28 Public opinion survey results...... 28 Activity at the Federal and State level to protect privacy ...... 30 Privacy issues are receiving increasing media attention, often requiring companies and government agencies to modify their practices ...... 31 Other indications of the importance of privacy concerns: The European Union Data Protection Directive, omnibus proposals in the United States, and self-regulatory initiatives...... 35 The Information Culture ...... 36 Changes in technology...... 37 Information technologies...... 41 Identification technologies ...... 42 Communication technologies, including the Internet...... 46

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page iii Trend toward integrated systems ...... 49 Definition of integration...... 49 Benefits and privacy risks of integration...... 50 A new approach that closely resembles a “Business Model” for the criminal justice system...... 51 More public access, demand for criminal justice records...... 53 Changes in the marketplace: Growing commercialization of records as private companies sell criminal justice records compiled from public record information...... 56 The changing marketplace...... 56 The Fair Credit Reporting Act ...... 58 The Individual Reference Services Group ...... 60 Privacy risks posed by changes in the marketplace...... 60 Federal and State initiatives ...... 61 The Security Clearance Information Act of 1985...... 62 Sex offender statutes...... 62 The Brady Handgun Violence Prevention Act ...... 63 The National Child Protection Act...... 64 Juvenile justice reform...... 65 A brief history of the philosophy of the juvenile justice system...... 65 Recent legal trends ...... 67 Criminal intelligence information systems ...... 69

VI. Task Force recommendations ...... 71 Background ...... 71 Recommendations and commentary ...... 71

VII. Conclusion...... 82

Appendix 1: Task Force participants ...... 83

Appendix 2: Glossary of criminal justice information terms...... 105

Appendix 3: Comparison of criminal history and other privacy measures...... 109

Page iv Report of the National Task Force on Privacy, Technology and Criminal Justice Information I. Introduction and executive summary

Rationale for Bureau of Justice In the mid-1970s and again in Those efforts and recommenda- Statistics and SEARCH project the mid-1980s, BJS and its tions by BJS and SEARCH predecessor organizations, along made a direct contribution to the In 1998, the Bureau of Justice with SEARCH, had looked development of law and policy Statistics (BJS) in the Office of closely and comprehensively at for the handling of CHRI in all Justice Programs (OJP), U.S. this very issue. Those reviews: 50 States. Department of Justice, and · Concluded that CHRI SEARCH, The National Con- By the late 1990s, however, it should not be made avail- sortium for Justice Information had become apparent that able to the general public. and Statistics,1 determined that changes in technology, as well the time was appropriate to con- · Recognized that there are as in the public’s attitude about duct a comprehensive project2 to some legitimate, noncrimi- access to information and pri- review the law and policy ad- nal justice uses of CHRI vacy, made it appropriate and dressing the collection, use, and (for example, for back- important to take a new look at dissemination of criminal justice ground checks for positions CHRI law and policy. In par- record information and, par- of trust). ticular, the existing CHRI law ticularly, criminal history record takes a “smokestack” approach: 3 · Recognized a sharp distinc- information (CHRI). tion between arrest-only and one body of law for the com- conviction information, and prehensive CHRI maintained by recommended more relaxed law enforcement at a central 1 Hereafter, SEARCH. rules for the dissemination State repository (sometimes re- 2The project was funded by and oper- of conviction information. ferred to as a “rap sheet”); an ated under the auspices of the Bureau entirely separate body of law of Justice Statistics (BJS). Since its · Strongly endorsed the view regulating the dissemination and inception, BJS has taken a leadership that CHRI should be made use of the very same records role in the improvement of criminal available for various non- history record information and the de- (albeit, not as comprehensive or velopment of appropriate policies for criminal justice purposes complete) maintained in the handling this information. SEARCH is only after a search con- courts; another separate body of a State criminal justice support organi- ducted on the basis of fin- law and policy for the collec- zation comprised of one governor’s gerprints. tion, use, and dissemination of appointee from each State, the District this information by various of Columbia, and the territories of · Recommended that various Puerto Rico and the U.S. Virgin Is- privacy and fair information commercial compilers; and a lands, as well eight at-large Members practice protections should different set of laws for the me- selected by the SEARCH Chair. For attach to the handling of dia’s handling of this informa- over 3 decades, SEARCH has pro- CHRI, including a right on tion. This smokestack approach, moted the effective and appropriate use combined with an eruption of of information, identification, and the part of the record sub- communications technology for State ject to see and correct the public concern about privacy, and local criminal justice agencies. For record. and further combined with a the same period of time, SEARCH has necessary and constructive ef- been vitally concerned with the privacy fort sweeping the Nation to in- and public access implications of the tegrate criminal justice and automation and use of personally iden- other governmental information tifiable criminal justice record information. systems, set the scene for an in- 3CHRI consists of arrest and convic- depth review of CHRI law and tion information, as well as other types policy. of disposition information.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 1 Goals and deliverables 4. Targeted standards applying tions in the report reflect the the recommendations of the Task Force’s consensus views, The goal of BJS and SEARCH National Task Force on Pri- but do not necessarily reflect the was to craft a road map for the vacy, Technology and views of any particular member development of a new genera- Criminal Justice Informa- of the Task Force or of his or tion of CHRI law and policy. tion,5 as set forth in this re- her institutional affiliations. Specifically, the BJS/SEARCH port, to specific types of effort consists of four deliver- criminal justice record in- ables: formation and integrated Key factors changing the systems. Work in this area criminal history record infor- 1. This report, which analyzes began with the development mation environment existing law and policy for of design principles for handling CHRI; identifies safeguarding the privacy of The Task Force identified the the technological and so- personal information in in- following technological, cul- cietal developments that tegrated criminal justice tural, economic, and other may be changing the crimi- systems (to be published “change drivers” that are mov- nal justice privacy environ- separately). Additional ing the Nation toward a new ment; and makes initial projects to promote the next information environment and recommendations to address generation of criminal jus- impelling the consideration of the next generation of tice information privacy law new criminal justice record in- criminal justice information and policy recommended in formation privacy policies. law and policy. this report are under devel- · Public concern about pri- 2. A first-ever, public opinion opment. vacy. In the late 1990s, the survey about public access American public registered to CHRI undertaken by the To assist in conducting the pro- the strongest concerns ever Opinion Research Corpora- ject, BJS and SEARCH con- recorded about threats to tion and Dr. Alan F. vened a Task Force of their personal privacy from Westin.4 preeminent academics, criminal both government and busi- justice officials (including rep- 3. A national conference — ness. In a 1999 study con- resentatives from law enforce- the proceedings of which ducted by Dr. Alan F. ment, the courts, corrections, will be published separately Westin, 94 percent of re- and prosecution), private-sector — to address and highlight spondents said they are con- compilers and resellers of emerging criminal justice cerned about the possible criminal justice record informa- information privacy issues, misuse of their personal in- tion, the media, and the criminal which was held in Wash- formation. Of the con- justice record user community.6 ington, D.C., on May 31 cerned, 77 percent said they The Task Force held three, and June 1, 2000. were “very concerned.” multiple-day meetings: Asilo- mar in Pacific Grove, Califor- · The “Information Cul- nia, on January 13-14, 1999; ture.” A new and emerging Boston, Massachusetts, on May culture of information ac- 4The summary results of this survey, 11-12, 1999; and Victoria, Brit- cess and use facilitated by along with interpretive commentary, is ish Columbia, Canada, on Octo- personal computers, brows- being published separately by BJS in a ber 18-19, 1999. The ers, search engines, online forthcoming companion report titled observations and recommenda- databases, and the Internet, “Privacy, Technology and Criminal Justice Information: Public Attitudes has helped to create a de- 5 Toward Uses of Criminal History In- Hereafter, Privacy Task Force or mand for, and a market in, formation, Summary of Survey Find- Task Force. information, including ings,” (NCJ 187633). Hereafter, 6Biographies of Task Force partici- criminal justice information, Privacy Survey Report. pants are included as Appendix 1.

Page 2 Report of the National Task Force on Privacy, Technology and Criminal Justice Information while, at the same time, profound impact upon the · Government statutes and fostering in many a sense of approach that criminal jus- initiatives. A host of new lack of control over one’s tice agencies take toward government initiatives and personal information and a obtaining and using infor- laws, aimed at providing loss of privacy. mation — a “data-driven, criminal justice information problem-solving approach.” to broader audiences, on a · Technological change. These changes are: a new, more cost-effective and Revolutionary improve- more cooperative, commu- timely basis, has also fueled ments in information, iden- nity-based relationship be- the availability of criminal tification, and tween criminal justice justice information. communications technolo- agencies and citizens; and gies (including increasingly · Juvenile justice reform. added criminal justice advanced software applica- Demands for juvenile jus- agency responsibilities to tions and Internet-based tice records, particularly provide information to sur- technologies), and the in- those involving violent of- rounding communities, creased affordability of fenses that result in treating Federal, State, and local these technologies fuels the juvenile information in a agencies, other police de- appetite for information and way which very much re- partments, and other organi- creates new players in the sembles the handling of zations. This new approach criminal justice information adult records, is also putting also creates privacy risks arena. pressure on traditional in- through a wider circulation formation and privacy poli- · System integration. Initia- of criminal justice informa- cies. tives to integrate criminal tion. justice information systems · Intelligence systems. · Noncriminal justice de- operated by law enforce- Criminal justice intelligence mand. A persistent and ment, courts, prosecution, systems are being auto- ever-increasing demand by and corrections, as well as mated, regionalized, and noncriminal justice users to initiatives to integrate these armed with CHRI and other obtain CHRI has had a per- systems with information personal information to cre- vasive and important impact systems maintaining other ate detailed personal pro- on the availability of infor- types of personal informa- files for law enforcement mation. tion, create powerful new use. information resources. At · Commercial compilation the same time, these inte- and sale. Changes in the in- gration initiatives may cre- formation marketplace — Content of project report ate uncertainty about the which feature the private types of privacy laws and sector’s acquisition, com- This project report begins with a policies that apply to these pilation, and sale of crimi- review of information privacy new systems and which di- nal justice information law and policy. The report lute existing policies de- obtained from police and, identifies five interests critical signed to keep information more particularly, court- to a democracy and that are separate. based open record systems served by information privacy: — are making information (1) due process and fairness, (2) · New approach that closely similar to that found in individual dignity, (3) individ- resembles a “Business criminal history records ual autonomy, (4) oversight and Model” for the criminal more widely available to trust in governmental institu- justice system. Two fun- those outside the criminal tions, and (5) the promotion of damental changes in the justice system. privacy-dependent relationships. way the criminal justice system operates have had a

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 3 In reviewing the history of in- collection, use, and dissemina- The report also includes brief formation privacy, the report tion of CHRI. case studies of three States that describes the development of have taken very different ap- the code of fair information The report provides further proaches to public access to law practices in the early 1970s, a background by tracing the de- enforcement CHRI: Florida, code that continues to shape velopment of Federal and State which takes an “open record” both U.S. and worldwide pri- criminal history record legisla- approach; Washington, which vacy policy to this day. tion and regulation. In the pe- takes an “intermediate” ap- riod since 1967, the Congress, proach (providing significant The report provides further the Justice Department, State access to conviction information background information with an legislatures, and regulatory but very limited access to non- overview of the criminal justice bodies have devoted consider- conviction information); and information system structure. able attention to standards for Massachusetts, a largely The report describes the Na- collecting, maintaining, using, “closed-record” State that per- tion’s system for the interstate and disseminating CHRI. Both mits access only to criminal exchange of CHRI, including BJS and SEARCH have been justice entities. the role of the Federal Bureau of active participants in the devel- Investigation (FBI), the central opment of these standards. The The bulk of the report focuses State repositories of CHRI, the report notes that today, these on the “change drivers” de- Interstate Identification Index standards provide for the fol- scribed above. In particular, the (III), the National Crime Pre- lowing: subject access and cor- report gives attention to the vention and Privacy Compact rection rights; restrictions on the public’s concern about privacy (which establishes formal pro- amalgamation of criminal his- and the technological changes cedures and governance struc- tory information with other that make previously inaccessi- tures for noncriminal justice use types of personal information; ble court records widely avail- of the III), and the Compact various kinds of standards to able. Council. The report also enu- ensure the accuracy, complete- merates the types of personally ness, and timeliness of CHRI; identifiable information that are fingerprint support of informa- Task Force recommendations encompassed within the term tion entered into law enforce- “criminal justice record infor- ment criminal history systems Finally, the report presents the mation,” including juvenile jus- and obtained from those sys- 14 recommendations adopted by tice information, investigative tems; various kinds of disposi- the National Task Force on Pri- and intelligence information, tion reporting requirements; vacy, Technology and Criminal various kinds of original records sealing and purging standards in Justice Information. of entry, and, of course, the the case of old information or criminal history record. arrest information without a Several points should be em- disposition; security standards; phasized about these recom- The report also sets forth the standards for criminal history mendations: constitutional and common law use or dissemination; wide- · First, the purpose of these standards that apply to CHRI. spread criminal justice access to recommendations is not to The report emphasizes that the CHRI; limited noncriminal jus- prescribe the specifics of a courts recognize individuals tice access to CHRI; and very new generation of law and have a privacy interest in CHRI limited public access to CHRI. policy for criminal justice which pertains to them, but that record information. Rather, this interest has seldom been relied upon by the courts to strike down or limit statutory and regulatory standards for the

Page 4 Report of the National Task Force on Privacy, Technology and Criminal Justice Information the purpose of the recom- · Fourth, the Task Force view recommendations to the mendations is to address the is that the creation of com- Federal and State legisla- conceptual and structural prehensive profiles about tive, executive, and judi- outline of a new generation individuals is a threat to cial branches of of law and policy. Accord- privacy and, importantly, is government as they work ingly, the Task Force rec- perceived by the public as a to balance the increasing ommends that further work threat to privacy. Accord- demand for all forms of on these specifics be un- ingly, the Task Force rec- criminal justice informa- dertaken by a statutorily ommends that criminal tion and the privacy risks chartered study organization justice record information associated with the col- with a 3-year sunset. not be amalgamated with lection and use of such in- other types of personal information. The Task · Second, in looking at the formation (such as financial Force recommends that approach to CHRI, the Task or medical information) in the body look at informa- Force recommends a global databases of criminal his- tion and privacy issues policy to address criminal tory and criminal justice re- arising from all types of history and juvenile justice cords. criminal justice informa- record information largely tion, including criminal without regard to whether · Fifth, the Task Force view history record informa- this information is held by is that the national initiative tion, intelligence and in- law enforcement agencies to integrate various criminal vestigative information, (that is, the central State re- justice record information victim and witness infor- positories), the courts, or systems, in order to improve mation, indexes and flag- commercial compilers and the utility, effectiveness, ging systems, wanted aggregators. The Task and cost efficiency of these person information, and Force’s rationale for this systems, is a positive devel- civil restraining orders. approach is that the privacy opment and should be en- The Task Force further and information implica- couraged. The Task Force recommends that such a tions are largely unaffected recognizes, however, that body be comprised of by whether the information the establishment of these public and private is sourced to courts, law en- kinds of systems raises pri- stakeholders; that the forcement, or commercial vacy and profiling issues body be limited to an ad- compilers. and, therefore, the structure visory role; and that it and content of integrated in- · Third, the Task Force reaf- have neither rulemaking formation systems should firms the importance of us- nor adjudicatory author- be shaped to minimize these ing fingerprints to the extent ity. Finally, the Task threats. that technology, cost, and Force recommends that availability make finger- the body sunset after not Specifically, the Task Force prints available to law en- more than 3 years, unless adopted the following recom- forcement, the courts, and statutorily reauthorized. mendations, which were subse- the commercial sector. Only quently endorsed in January with the use of fingerprints II. The Task Force recom- 2000 by SEARCH’s Member- can a reliable determination mends the development of ship Group (governors’ appoint- be made that a criminal a new generation of ees): history record pertains to criminal justice informa- the person who is the sub- tion and privacy law and I. The Task Force recom- ject of the search. policy, taking into ac- mends that a body be count public safety, pri- statutorily created to con- vacy, and government sider and make policy

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 5 oversight interests. This use of the information; and users make this prac- law and policy should be and the onward transfer of ticable. broad in scope, so as to the information (the redis- address the collection, semination of the criminal VIII. The Task Force recom- maintenance, use, and history information by mends that criminal his- dissemination of criminal downstream users). tory record information justice record information should be sealed or ex- by law enforcement agen- V. The Task Force recom- punged (purged) when the cies, including State cen- mends that intelligence record no longer serves an tral repositories and the and investigative infor- important public safety or FBI, the courts, and mation also be addressed other public policy inter- commercial compilers by new privacy law and est. A sealed record and resellers of criminal policy, but that this proc- should be unsealed and justice record informa- ess should begin with the available for criminal jus- tion. establishment of a Task tice and/or public use Force dedicated exclu- only when the record III. The Task Force recom- sively to a review of in- subject has engaged in a mends that the adequacy telligence and subsequent offense or of existing legal remedies investigative systems, and when other compelling for invasions of privacy the law and privacy issues public policy considera- arising from the use of related to those systems. tions substantially out- criminal history record in- weigh the record subject’s formation should be reex- VI. The Task Force recom- privacy interests. During amined by legal scholars, mends that legislators and the period that a criminal State legislatures, Con- criminal history record in- history record is sealed, gress, State and Federal formation system manag- use and disclosure should agencies, and the courts. ers develop, implement, be prohibited. and use the best available IV. The Task Force recom- technologies to promote IX. The Task Force recommends the development of data quality and data se- mends that individuals a new generation of con- curity. who are the subject of fidentiality and disclosure criminal history record in- law and policy for crimi- VII. The Task Force recom- formation be told about nal history record infor- mends that criminal his- the practices, procedures, mation, taking into tory record information, and policies for the col- account the type of crimi- whether held by the lection, maintenance, use, nal history record infor- courts, by law enforce- and disclosure of criminal mation; the extent to ment, or by commercial history information about which the database con- compilers and resellers, them; be given a right of tains other types of crimi- should, subject to appro- access to and correction nal justice information priate safeguards, be sup- of this information, in- (victim and witness in- ported by and accessible cluding a right to see a re- formation, or intelligence by fingerprints to the ex- cord of the disclosure of or investigative informa- tent legally permissible the information in most tion) and sensitive per- and to the extent that circumstances; and enjoy sonal information technology, cost, and the effective remedies for a (medical or financial in- availability of fingerprints violation of any applica- formation, and so on); the to both database managers ble privacy and informa- purpose for the intended tion standards. In

Page 6 Report of the National Task Force on Privacy, Technology and Criminal Justice Information addition, the Task Force XII. The Task Force recom- XIV. The Task Force recom- recommends that States mends that where public mends that new criminal establish meaningful policy considerations re- justice privacy law and oversight mechanisms to quire amalgamation of in- policy should continue to ensure that these privacy formation, systems be give weight to the dis- protections are properly designed to recognize and tinction between convic- implemented and en- administer differing stan- tion information and forced. dards (including dissemi- nonconviction informa- nation policies and tion. The Task Force rec- X. The Task Force recom- standards) based upon dif- ognizes, however, that mends that where public fering levels of data sen- there are certain instances safety considerations so sitivity, and allow the in which disclosure of require, the record of a flexibility necessary to nonconviction informa- juvenile offender who revise those standards to tion may be appropriate. commits an offense reflect future changes in which, if committed by an public policy. adult, would be a felony or a violent misdemeanor, XIII. The Task Force recom- be treated in the same mends that the integration manner that similar adult of criminal justice infor- records are treated. Even mation systems should be if a State opts to retain encouraged in recognition stronger privacy and con- of the value of integrated fidentiality rules for these systems in improving the types of juvenile records, utility, effectiveness, and these records should be cost efficiency of infor- fingerprint-supported and mation systems. Prior to should be capable of be- establishing integrated ing captured in an auto- systems, however, pri- mated, national system. vacy implications should be examined, and legal XI. The Task Force recom- and policy protections in mends that criminal jus- place, to ensure that fu- tice record information ture public- and private- law and policy should re- sector uses of these in- strict the combining of formation systems remain different types of criminal consistent with the pur- justice record information poses for which they were into databases accessible originally created. In ad- to noncriminal justice us- dition, once an integrated ers and should restrict the system is created, any amalgamation of criminal future uses or expansions justice record information of that system should be in databases with other evaluated to assess the types of personal infor- privacy implications. mation, except where necessary to satisfy public policy objectives.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 7 II. Report purpose and scope

It hardly comes as a surprise in, the operation of the po- The answer, of course, is that that Federal agencies collect litical system as well as the there are powerful competing vast amounts of personal infor- judicial system. values, interests, and concerns. mation, including information One such interest is privacy. · Promoting private-sector collected through the criminal Privacy encompasses not only accountability. The use of justice system. It is also no sur- secrecy but also fair information background checks that rely prise that this information col- practices regarding the use, ac- on public record informa- lection activity serves critical cess, accuracy, right to chal- tion allows the verification public safety and other public lenge inaccurate information, of assertions made by indi- values. Moreover, access to and knowledge that record sys- viduals (or facts omitted by public record information, in- tems even exist.7 These infor- individuals), thereby per- cluding criminal justice information privacy interests were mitting prospective employ- mation, promotes interests given voice in the 1970s, at a ers and business partners to critical to a democratic society, time when centralized and protect themselves and vul- including: automated record systems were nerable populations which chiefly associated with govern- · Promoting government may be in their care, in- mental activities. During the accountability. Access to cluding children, the dis- 1970s, a set of broad fair infor- public records helps the abled, and the elderly. mation practice policies public monitor government · Promoting meritocracy. In emerged, with specific applica- activities, thereby assisting a mobile society where tions for criminal justice infor- the public to hold elected merit (often initially repre- mation. Since the 1970s, there officials and nonelected sented by credentials) is of- have been many changes, in- civil servants accountable ten used rather than family cluding technological, political, and protecting against secret connections and lineage for and marketplace changes, that government activities. purposes such as employ- have changed the information · Promoting first amendment, access to public re- environment. ment rights. Access to cords provides an important public record information means of verifying an indi- This report identifies develop- helps to create the informed vidual’s credentials, in- ments that may be outpacing citizenry necessary for the cluding whether the established privacy and fair in- robust, wide-open public individual has a criminal re- formation practices protections debates that play an impor- cord. for criminal justice information, tant structural role in se- and which may necessitate a curing and fostering free Because this information is new look at appropriate law and speech and republican self- collected and used for the good policy for managing this infor- government. of society, why isn’t that the end mation. The report is intended of the debate? Why not make all · Promoting confidence in to serve as a resource for State information, including personal the judicial and political and Federal policymakers, the information collected by Federal systems. Access to public agencies, publicly available? record information bolsters 7Other values and interests include public knowledge about, national security interests, secrecy re- and helps instill confidence quirements necessary to facilitate ongoing law enforcement investigations, the protection of trade secrets, and so on.

Page 8 Report of the National Task Force on Privacy, Technology and Criminal Justice Information courts, criminal justice agencies, separate Task Force or other private-sector, self-regulatory group devoted solely to that is- organizations, privacy advo- sue, particularly a group with cates, and individuals interested more representation from the in privacy and criminal justice investigative and intelligence issues. communities than is reflected in the membership of the Task For purposes of this report, Force on Privacy, Technology “criminal justice information” is and Criminal Justice Informa- defined broadly to include all tion. information obtained, maintained, or generated about an individual by the courts or a criminal justice agency as a result of suspicion that the individual may be engaging in criminal activity or in relation to his or her arrest and the subsequent disposition of this arrest. “Criminal justice information” includes: criminal history record information (CHRI); criminal intelligence information; criminal investigative information; disposition information; identification record information; nonconviction information; and wanted person information.8

Criminal intelligence and criminal investigative information are within the definition of criminal justice information as it is addressed in this report. The Task Force concluded after considerable deliberation, however, that changes in criminal intelligence and investigative information systems raise complex and discrete privacy issues. Those issues merit examination by a

8Technical Report No. 13: Standards for the Security and Privacy of Crimi- nal History Record Information, 3rd ed. (Sacramento: SEARCH Group, Inc., 1988) pp. 8-9. Hereafter, Technical Report No. 13, 3rd ed. A glossary of justice information terms is included as Appendix 2.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 9 III. Information privacy standards: Background

Customarily, the term “infor- sectors) makes decisions 4. An interest in promoting a mation privacy” is used to refer about individuals in a way sense of trust in, and a to standards for the collection, that comports with notions check upon the behavior of, maintenance, use, and disclo- of due process and fairness. institutions. When individu- sure of personally identifiable Accuracy of CHRI and use als lose the ability to selec- information. A central compo- of that information which tively disclose their nent of “information privacy” is includes providing notice to sensitive personal informa- the ability of an individual to the individual and giving tion, they lose trust in the control the use of information the individual an opportu- public and private institu- about him or herself.9 nity to respond, is consistent tions that collect, hold, use, with notions about fairness. and disclose this personal Information privacy is fre- The absence of these pro- information. (Public opinion quently distinguished from other tections may produce erro- surveys indicate that the clusters of personal interests neous or unjustified public’s “distrust index” that are nourished by the pri- decisions about employ- (the extent to which the vacy doctrine, including sur- ment, credit, health care, public distrusts the govern- veillance privacy — the interest housing, or other valued ment) is at all-time high in being free from governmental benefits or statuses. levels of approximately 80 and other organized surveillance percent.)11 2. An interest in protecting of individual activities under individual dignity. When 5. An interest in promoting the circumstances where the indi- individuals endure stigma, viability of relationships vidual has a reasonable expec- embarrassment, and hu- critical to the effective tation of privacy; and miliation arising from the functioning of a democratic behavioral privacy — the right uncontrolled use and disclo- society. Numerous relation- to engage in certain intimate and sure of information about ships, such as the doctor- sensitive behaviors (such as be- them, they lose the sense of patient relationship, the haviors relating to reproductive dignity and integrity essen- lawyer-client relationship, rights) free from governmental tial for effective participa- or even the news media and or other control.10 tion in a free and confidential source relation- democratic society. ship, depend upon promises Protection of information pri- of confidentiality in order to vacy is widely seen as serving at 3. An interest in protecting promote the candid sharing least five interests that are criti- individual autonomy. When of personal information and cal to a democracy: individuals lack control trust within the relationship. over personal information 1. An interest in ensuring soci- about themselves, they lose ety (both public and private The concept of information pri- a sense of control over their vacy as a distinct branch of pri- lives. The ability of indi- vacy is relatively new. The 9 viduals to control personal See, for example, Alan F. Westin, concept found full voice in the Privacy and Freedom (New York: information about them- late 1960s, amid rising concerns Atheneum, 1967) p. 7. Hereafter, Pri- selves promotes personal about computers and growing vacy and Freedom. autonomy and liberty. 10In Whalen v. Roe, 429 U.S. 589, disenchantment with govern- 599, 600 (1977), the Supreme Court ment, and articulated in writings discussed the various clusters of interests protected by the broad term “privacy.” 11See note 75 infra.

Page 10 Report of the National Task Force on Privacy, Technology and Criminal Justice Information such as Alan Westin’s book, 3. There must be a way for an questioned whether the Code of Privacy and Freedom,12 with individual to prevent infor- Fair Information Practices re- later iterations in the 1972 Na- mation about him obtained mains a viable approach,18 the tional Academy of Science’s for one purpose from being Code and balancing privacy report, Databanks in a Free So- used or made available for with competing interests contin- ciety,13 and the 1973 Report of other purposes without his ues to provide a framework for the Secretary of Health, Educa- consent. fair information practices in the tion and Welfare’s Advisory United States.19 4. There must be a way for an Committee on Automated Per- individual to correct or sonal Data Systems (HEW Re- amend a record of identifi- port).14 able information about him. These seminal works recognized 5. Any organization creating, the importance of information maintaining, using, or dis- privacy and the need to balance seminating records of iden- privacy with other competing tifiable personal data must interests, such as public safety. assure the reliability of the As part of this dialogue, the data for their intended use HEW Report’s “Code of Fair and must take reasonable Information Practices” set forth precautions to prevent mis- eds. (Toronto: University of Toronto Press, 1999) pp. 68-93. five basic procedural principles use of the data.15 18Ibid. Other privacy experts continue for fair information practices: to believe that Fair Information Prac- The HEW Code of Fair Infor- 1. There must be no personal- tices and the “balancing of interests” mation Practices was widely data recordkeeping systems approach can continue to serve as the influential when it was released, basis for privacy law and policy, either whose very existence is se- and served as a basis for the as currently constituted or with modifi- cret. Federal Privacy Act of 1974. cations. See, for example, David H. Flaherty, “Visions of Privacy: Past, 2. There must be a way for an The HEW Code of Fair Infor- Present and Future,” in ibid., pp. 19-38. individual to find out what mation Practices was further 19See, for example, Testimony of information about him is in examined and applied to spe- Donna E. Shalala, Secretary, U.S. De- a record and how it is used. cific recordkeeping relation- partment of Health and Human Serv- ships in the 1977 Report of the ices, before the Senate Committee on Privacy Protection Study Com- Labor and Human Resources, Septem- mission.16 Balancing privacy ber 11, 1997 (recommending that the Congress pass health information pri- 12Privacy and Freedom, supra note 9. with competing interests has vacy legislation based upon the 1973 13 Alan F. Westin and Michael A. also been widely accepted as a Code of Fair Information Practices). Baker, Databanks in a Free Society: means of accounting for privacy Not surprisingly, however, the Fair Computers, Record-Keeping and Pri- concerns.17 Although some have Information Practices outlined in the vacy (New York: Quadrangle Books, HEW Report have been expanded upon 1972). See also, Robert R. Belair, “In- in the nearly 30 years since they were formation Privacy: A Legal and Policy first promulgated. Today, influenced in 15 Analysis,” in Science, Technology and Ibid., p. 41. part by developments in Europe, dis- Uses of Information (Washington, 16U.S. Privacy Protection Study cussion of fair information practices D.C.: National Science Foundation, Commission, Personal Privacy in an also frequently focus, for example, on 1986). Information Society (Washington, D.C.: procedural and substantive safeguards 14Records, Computers and the Rights U.S. Government Printing Office, July surrounding the collection of informa- of Citizens, DHEW Publication No. 1977). tion to ensure that information is used (OS) 73-97 (Washington, D.C.: De- 17Charles D. Raab, “From Balancing only for purposes consistent with those partment of Health, Education and to Steering: New Directions for Data for which the information is collected, Welfare, 1973), available at http:// Protection,” in Visions of Privacy: and that the information collected is aspe.hhs.gov/datacncl/1973privacy Policy Choices for the Digital Age, relevant to the purpose for which it is /tocprefacemembers.htm. Colin J. Bennett and Rebecca Grant, being collected.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 11 IV. Privacy protections for criminal justice information

A brief overview of the history record about a State for a serious/ structure of the criminal particular individual. reportable offense (stan- justice information system dards vary among the — III Compact. In October States, but, customarily, re- 1998, the Congress en- Before examining the legal and portable offenses are mis- acted the Crime Identi- policy regime surrounding demeanors punishable by a fication Technology Act criminal justice information, year or more in prison, plus (CITA),20 which in- this section briefly reviews the felonies). The repository cludes as Title II, the structure of the criminal justice also maintains an automated National Crime Pre- information system as it relates record of those individuals’ vention and Privacy to CHRI (at both the Federal arrests, along with all avail- Compact Act (III Com- and State levels), juvenile jus- able dispositions. This re- pact). Once ratified by tice information, intelligence cord is referred to as a the States, the III Com- and investigative information, criminal history record or pact will permit the III and original records of entry. “rap sheet.” to be used by authorized, noncriminal jus- — Repository mission. The · Criminal history record tice requestors.21 central State reposi- information: Federal role. tory’s principal mission At the Federal level, the FBI · Criminal history record is to provide CHRI to functions as a criminal his- information: central State State and local law en- tory record repository, repositories. Every State forcement agencies. The holding both Federal of- has established a “central repositories also pro- fender information and re- State repository” of criminal vide CHRI to the other cords of arrest and history information and fin- components of the dispositions under State gerprints, operated by a criminal justice system law. State law enforcement — courts, prosecutors, — Interstate Identification agency. Central State re- and corrections — as Index (III). During the positories maintain a fin- well as certain non- last 30 years, the FBI, gerprint record of every criminal justice users.22 working with the State individual arrested in the — Information maintained criminal justice infor- by repositories. Tradi- mation community, de- tionally, central State veloped the III. The III 2042 U.S.C. § 14601. repositories maintain consists of an FBI- 21 subject identification in- maintained index of all As of June 2001, 12 States (Mon- tana, Georgia, Nevada, Florida, Colo- formation (fingerprint individuals with State or rado, Iowa, Connecticut, South Federal criminal history Carolina, Arkansas, Alaska, Oklahoma, records, supported by a and Maine) had ratified the III Com- National Fingerprint pact, which became effective on April 22Robert R. Belair and Paul L. Woo- File. Authorized re- 28, 1999, following the ratification of dard, Use and Management of Criminal the Compact by the first two States. History Record Information: A Com- questors access the III The Compact now applies between the prehensive Report, Criminal Justice to determine whether States that have ratified it and the Fed- Information Policy series, NCJ 143501 any State (or the FBI for eral government. See, “Crime Preven- (Washington, D.C.: U.S. Department of Federal offenses) tion and Privacy Compact,” available at Justice, Bureau of Justice Statistics, maintains a criminal http://www.search.org November 1993) pp. 14-17. Hereafter, /policy/compact/privacy.asp. Use and Management of CHRI.

Page 12 Report of the National Task Force on Privacy, Technology and Criminal Justice Information records), criminal his- ception for the very to criminal justice agen- tory information (which largest local agencies, cies.) historically and tradi- have withdrawn from tionally consists of the business of main- · Investigative and intelli- identifying information, taining formal and gence information. Cus- arrests, and available comprehensive criminal tomarily, investigative and dispositions, but little or history records (other intelligence information has no information about than booking informa- rarely been maintained at a third parties such as tion and other original central State repository; witnesses, victims, or records of entry). In- when maintained, it has not family members),23 and stead, local agencies been integrated with CHRI. certain other informa- rely on the State re- Historically, investigative tion (such as pretrial pository and, through and intelligence information release information and the State repository, the was maintained only at the felony conviction flags). FBI to provide complete local police agency or law Repositories virtually and comprehensive enforcement agency level; it never maintain other criminal history records. was not automated or fin- types of personal infor- gerprint-supported; and it mation (employment · Juvenile justice informa- was shared on a closely history, medical history, tion. Juvenile justice infor- held, need-to-know basis military, or citizenship mation is, broadly speaking, within the law enforcement status, and so on).24 information on juveniles, community.26 which, but for the age of the — Liaison with FBI. Re- juvenile, would be consid- · Original records of entry. positories serve as a ered criminal justice infor- Pieces of an individual’s contact point and liaison mation.25 Traditionally, the criminal history record, but with the FBI: sending repositories do not maintain only infrequently an indi- fingerprints and arrest juvenile justice information; vidual’s entire criminal and disposition infor- for the few repositories that history record, are held in mation to the FBI; re- do, it is frequently not inte- “open record” files main- sponding to search grated with adult records of tained by police agencies inquiries from the FBI; that individual. (As a practi- and courts. These original and initiating search in- cal matter, juvenile justice records of entry describe quiries to the FBI on information, until very re- formal detentions and ar- behalf of authorized, in- cently, was not available on rests and include incident State requestors. any kind of reliable or orga- reports, arrest reports, case — Information maintained nized basis. Rather, each reports, and other informa- by local agencies. Over separate juvenile or family tion that documents that an the past 30 years, local court and each separate law individual has been de- agencies, with rare ex- enforcement agency would tained, taken into custody, maintain juvenile records. or otherwise formally These records frequently charged. In addition, re- 23 See, SEARCH Group, Inc., In- were not automated or fin- cords of court proceedings creasing the Utility of the Criminal gerprint-supported. Moreo- History Record: Report of the National ver, traditionally, some of Task Force, Criminal Justice Informa- 26See, Robert R. Belair, Intelligence tion Policy series, NCJ 156922 these records were not and Investigative Records, Criminal (Washington, D.C.: U.S. Department of available by law (based on Justice Information Policy series, NCJ Justice, Bureau of Justice Statistics, sealing requirements), even 95787 (Washington, D.C.: U.S. De- December 1995) pp. 23-27. partment of Justice, Bureau of Justice 24 Ibid., pp. 22-23. 25This age varies by State. Statistics, February 1985) pp. 43-49.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 13 maintained by the courts in- and suppliers and by local Court held “as a categorical clude indictments, arraign- criminal justice agencies. Fun- matter that a third party’s re- ments, preliminary hearings, damental changes in expecta- quest for law enforcement re- pretrial release hearings, tions about the availability and cords or information about a and other court events that, utility of criminal justice infor- private citizen can reasonably by law and tradition, are mation fueled accelerating pres- be expected to invade that citi- open to public inspection. sures for more and easier access zen’s privacy, and that when the Until very recently, both to criminal justice information. request seeks no ‘official infor- types of open record sys- mation’ about a Government tems were manual or, at agency, but merely records that best, only partially auto- Constitutional and the Government happens to be mated; they were not com- common law standards storing, the invasion of privacy prehensive or reliable, and with respect to the privacy is ‘unwarranted’” and therefore related only to events occur- of criminal history record exempt from disclosure under ring at the particular law en- information FOIA’s privacy provision.30 forcement agency or court. As a consequence, these — Constitutional In 1995, the Court again ad- systems were difficult and standards dressed the privacy risk posed expensive to use and largely by computerized criminal his- unsuitable for the compila- The Constitution remains tory information. In Arizona v. tion of a reliable or compre- largely neutral with respect to Evans,31 the Court found that the hensive criminal history the privacy of CHRI. In par- “exclusionary rule” does not record file. Compilation of ticular, the Supreme Court has require suppression of evidence these records into a criminal held that the Constitution does seized incident to an arrest re- history file on an individual not recognize a privacy interest sulting from an inaccurate com- was also difficult because in the dissemination by criminal puter record when the error was these record systems were justice agencies of information caused by court, rather than po- incident-focused, rather about official acts, such as ar- lice, personnel. In a concurring than individual-focused, and rests.27 In 1989, in Department opinion, Justice O’Connor noted were not comprehensive, of Justice v. Reporters Com- that “the advent of powerful, cumulative, or otherwise mittee for Freedom of the computer-based recordkeeping linked on the basis of the Press,28 the Supreme Court did systems … facilitate[s] arrests individuals involved in each recognize, however, that there is in ways that have never before incident. a statutory privacy interest, un- been possible. The police … are der the Federal Freedom of In- entitled to enjoy the substantial By the 1990s, these relatively formation Act (FOIA), in advantages this technology con- traditional elements of the automated, comprehensive fers. They may not, however, criminal justice information en- criminal history records.29 The rely on it blindly. With the vironment were changing. benefits of more efficient law Criminal justice information, 27Paul v. Davis, 424 U.S. 693, 713 enforcement mechanisms comes particularly including court- (1976). the burden of corresponding based CHRI, was largely auto- 28489 U.S. 749 (1989). constitutional responsibilities.”32 mated and was becoming more 29The Court has used statutory law, publicly available. The role of rather than constitutional law, to protect extends to confidential communications the central repositories as the privacy in other contexts as well. In between a licensed social worker and a gatekeeper for CHRI was being Jaffee v. Redmond, 518 U.S. 1 (1996), patient in the course of psychotherapy. for example, the Court, recognizing the 30489 U.S. 749, 780 (1989). challenged not only by the sensitivity of mental health informa- 31514 U.S. 1 (1995). courts, but also by automated, tion, held that Rule 501 of the Federal 32 for-profit information brokers Rules of Evidence recognizes a psy- Ibid., at 17-18 (O’Connor, J., con- chotherapist-patient privilege, which curring).

Page 14 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Justice Ginsburg, in dissent, the use of such information “di- also characterized the case as a also expressed concern over the rectly or indirectly to sell a challenge to the “facial validity” impact of modern technology on product or service to any indi- of the California statute and not privacy: “Widespread reliance vidual or group of individuals.” a challenge based upon the im- on computers to store and con- plementation or actual experi- vey information generates, United Reporting Publishing ence with the statute.38 For these along with manifold benefits, Corp., a private publishing reasons the Court opined that new possibilities of error, due to service that had been providing California could distinguish both computer malfunctions and arrestee address information to among users and uses in crafting operator mistakes … . clients under the old statute, rules for access to State-held [C]omputerization greatly am- filed suit, alleging that the stat- records. The Court left open the plifies an error’s effect, and cor- ute was an unconstitutional possibility, however, that the respondingly intensifies the violation of its first amendment statute, as applied, might im- need for prompt correction; for commercial speech rights. The pinge on United Reporting’s inaccurate data can infect not Ninth Circuit, while finding that commercial speech rights. only one agency, but the many arrestees have a substantial pri- agencies that share access to the vacy interest in the information 33 database.” at issue, nevertheless concluded by the Federal Communications Com- (as did the district court) the mission that required consumers to opt- During the 1999-2000 term, the California law was an uncon- in to most disclosures of their consumer Supreme Court handed down stitutional infringement on proprietary network information (CPNI). U.S. West, Inc. v. Federal two decisions regarding statu- United Reporting’s first Communications Commission, 182 tory controls on access to public amendment commercial speech F.3d 1224 (10th Cir. 1999), cert. denied, record information, which, rights because the “myriad of 530 U.S. 1213 (2000). CPNI is infor- while not decided on privacy exceptions … precludes the mation that relates to the quantity, grounds, are likely to encourage statute from directly and materi- technical configuration, type, destina- stronger privacy initiatives. ally advancing the government’s tion, and amount of use of a telecom- 36 munications service subscribed to by purported privacy interest.” any customer of a telecommunications The first opinion, Los Angeles carrier that is made available to the Police Department v. United On December 7, 1999, the Su- carrier by the customer solely by virtue Reporting Publishing Corp.,34 preme Court voted 7 to 2 to re- of the carrier-customer relationship, arose from a 1996 change in verse, reinstating the California including most information contained in telephone bills. See, 47 U.S.C. § California law governing the statute. In its opinion, the ma- 222(f)(1)(A)-(B). release of arrest information.35 jority characterized United Re- 38In a related development, on De- The change limited the release porting as a case dealing with cember 13, 1999, the Supreme Court of arrestee and victim address access to government records issued an order in McClure v. Amelkin, information to those who certify rather than restrictions on free 528 U.S. 1059 (1999), setting aside a that the request is made for speech.37 The Supreme Court decision by the Sixth Circuit Court of scholarly, journalistic, political, Appeals that struck down a Kentucky law limiting access to motor vehicle or governmental purposes, or 36United Reporting Publishing Corp. accident reports. The Sixth Circuit for investigative purposes by a v. Los Angeles Police Department, 146 struck down the law — which allows licensed private investigator. F.3d 1133, 1140 (9th Cir. 1998). access to accident victims, victims’ The law specifically prohibits 37The Court’s decision did not ad- lawyers, victims’ insurers, and the dress the commercial speech interests news media (but not for commercial at issue in the regulation of the use of purposes) — after finding that the law personal information in private records, violates commercial free speech rights. The Supreme Court sent the case back 33Ibid., at 26 (Ginsburg, J. dissent- an issue that has also drawn the atten- to the Sixth Circuit and ordered the ing). tion of the appellate courts. The Tenth Circuit Court of Appeals, for example, lower court to restudy the case, taking 34528 U.S. 32 (1999). acted on first amendment commercial into consideration the Supreme Court’s 35 CAL. GOV. CODE § 6254(f). speech grounds, to vacate a rule issued decision in United Reporting.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 15 In the second opinion, Reno v. sult in criminal fines and a civil the need to show tangible harm Condon,39 the Supreme Court cause of action against a person arising from the alleged disclo- unanimously reversed the who knowingly violates the sure or misuse of criminal his- Fourth Circuit Court of Appeals, statute.44 Although the Court’s tory records have proven to be rejecting a tenth amendment40 brief opinion was based on tenth virtually insurmountable obsta- challenge by the State of South amendment rather than privacy cles to common law privacy Carolina to the constitutionality grounds, the decision potentially actions.46 The limited nature of of the Driver’s Privacy Protec- opens the door for further Fed- common law and constitutional tion Act of 1994 (DPPA).41 The eral regulation of access to State privacy protections has meant DPPA provides that State de- records on privacy grounds.45 that safeguarding information partments of motor vehicles privacy interests has been left (DMVs) “shall not knowingly — Common law standards largely to the legislative arena. disclose or otherwise make available to any person or entity Common law privacy doctrines, personal information about any such as the widely recognized Federal criminal history individual obtained by the de- privacy tort of public disclosure record legislation and partment in connection with a of private facts, have proven regulations motor vehicle record.”42 The largely ineffectual when applied DPPA does contain 14 excep- to CHRI. Sovereign immunity, Beginning in the late 1960s and tions pursuant to which States civil and official immunity, and extending throughout the 1970s, may elect to disclose DMV re- information privacy standards 43 cords in certain instances. 4418 U.S.C. §§ 2723(a), 2724(a). for criminal justice information Violation of the DPPA may re- and, in particular, criminal his- 45The Court concluded that “the DPPA does not require States in their tory records, received consider- 39528 U.S. 32, 120 S.Ct. 483 (2000). sovereign capacity to regulate their able attention in statutory The Fourth Circuit case was the first of own citizens. The DPPA regulates the provisions and U.S. Department four decisions issued by the Courts of States as the owners of databases. It of Justice (DOJ) regulations. Appeals on the constitutionality of the does not require the South Carolina Although the privacy protec- DPPA; two decisions upheld the con- Legislature to enact any laws or regu- stitutionality of the DPPA, two held it lations, and it does not require State tions that emerged from that to be unconstitutional. See, Condon v. officials to assist in the enforcement of debate were not driven by con- Reno, 155 F.3d 453 (4th Cir. 1998) Federal statutes regulating private indi- stitutional requirements, con- (holding DPPA is unconstitutional); viduals. We accordingly conclude that stitutional values — such as the th Pryor v. Reno, 171 F.3d 1281 (11 Cir. the DPPA is consistent with the con- presumption that an individual 1999) (holding DPPA is unconstitu- stitutional principles enunciated in is innocent until proven guilty tional); Travis v. Reno, 160 F.3d. 1000 [New York v. United States, 505 U.S. (7th Cir. 1998) (upholding DPPA); 144 (1992); and Printz v. United States, — have played a role in the de- Oklahoma v. United States, 161 F.3d 521 U.S. 898 (1997)].” Reno v. Con- velopment of the law and regu- 1266 (10th Cir. 1998) (upholding don, 528 U.S. 32, 120 S.Ct. 666, 672 lations governing the DPPA). The DPPA has also been chal- (2000). In addition, the Court disagreed management of CHRI.47 lenged on first amendment grounds; with the Fourth Circuit’s holding that however, discussions of first amend- the DPPA exclusively regulated the ment challenges are omitted here. See, States, finding instead that the “DPPA 46See, Technical Memorandum No. for example, Travis v. Reno and Okla- regulates the universe of entities that 12: Criminal Justice Information, Per- homa v. United States participate as suppliers to the market spective on Liabilities (Sacramento: 40“The powers not delegated to the for motor vehicle information — the SEARCH Group, Inc., August 1977) United States by the Constitution, nor States as initial suppliers of the infor- (and as updated in 1981) pp. 5-20. prohibited by it to the States, are re- mation in interstate commerce and 47As the Privacy Protection Study served to the States respectively, or to private resellers or redisclosers of that Commission noted in its 1977 report: the people.” U.S. Const., Amend. X. information in commerce.” Ibid. As a “Constitutional standards specify that result, the Court did not address the 4118 U.S.C. § 2721 et seq. convictions, not arrests establish guilt. “question whether general applicability Thus denial of employment [for exam- 4218 U.S.C. § 2721(a). is a constitutional requirement for fed- ple] because of an unproved charge, a 43 18 U.S.C. § 2721(b). eral regulation of the States.” charge that has been dismissed, or one

Page 16 Report of the National Task Force on Privacy, Technology and Criminal Justice Information In 1967, the Report of the Presi- able national criminal justice While the comprehensive pro- dent’s Commission on Law En- information system.48 posals for uniform, nationwide forcement and the For most of the last 30 years, standards failed, Congress was Administration of Justice spoke the U.S. DOJ, working through not idle. In 1972, for example, of the need for an “integrated the FBI, the Law Enforcement Congress authorized the FBI to national information system” Assistance Administration “exchange identification re- and recommended that there be (LEAA) and its successor agen- cords” with State and local offi- established a “national law en- cies, including, in particular, cials for “purposes of forcement directory that records OJP, BJS, and the Bureau of employment and licensing,” an individual’s arrests for seri- Justice Assistance (BJA), and provided that the exchange of ous crimes, the disposition of the State and local criminal jus- information is authorized by each case and all subsequent tice information community, State statute and approved by formal contacts with criminal including SEARCH and the FBI the Attorney General, and pro- justice agencies related to those Criminal Justice Information vided that the exchange of in- arrests.” The report also empha- Services Division’s Advisory formation is made only for sized that it is “essential” to Policy Board (CJIS APB), have official use and is subject to the identify and protect security and worked toward the implementa- same restrictions with respect to privacy rights to ensure a fair, tion of an automated national dissemination as would apply to credible, and politically accept- system for the exchange of the FBI.50 criminal history records, along with a set of comprehensive In 1973, Congress enacted the privacy standards. Several so-called “Kennedy Amend- for which there has been an adjudica- prominent features dominated ment” to the Omnibus Crime tion of innocence, is fundamentally unfair.” Supra note 16, Appendix 3, that environment. Control and Safe Streets Act of Employment Records, p. 50. The value 1968, which provides that all of arrest records as a decisionmaking Privacy standards for CHRI CHRI collected, maintained, or tool, particularly in the employment have been left largely to statu- disseminated by State and local context, has also been challenged on tory and regulatory initiative. criminal justice agencies with the grounds that racial minorities are arrested in disproportionately high During the 1970s, when public financial support under the Om- numbers. As a result, the Equal Em- concern about privacy, automa- nibus Crime Control and Safe ployment Opportunity Commission and tion, and governmental and pri- Streets Act must be made avail- several courts have found that inquiries vate information systems was able for review and challenge by about arrest records can be a violation running high, the Congress con- record subjects and must be of Title VII of the Civil Rights Act of sidered several legislative pro- used only for law enforcement 1964. See, for example, 29 C.F.R. § 51 1607.4(c)(1); and Gregory v. Litton posals that would have imposed and other lawful purposes. Sys., 316 F. Supp. 401 (C.D. Cal. uniform, national information LEAA implemented the Ken- 1970), aff'd as modified, 472 F.2d. 631 and privacy standards for CHRI. nedy Amendment by adopting (9th Cir. 1972) (fact that an individual All of those proposals failed.49 suffered a number of arrests without sion authorizes the Attorney General to any convictions was not conclusive as “acquire, collect, classify and preserve to wrongdoing and was irrelevant to 48Project SEARCH, Technical Report criminal identification, crime and other work qualifications and, because the No. 2: Security and Privacy Consid- records” and to “exchange such records mere inquiry into arrest records tends to erations in Criminal History Informa- and information with and for the offi- have a chilling effect on minority job tion Systems (Sacramento: California cial use of, authorized officials of the applicants, inquiries about arrests may Crime Technological Research Foun- federal government, the States, cities violate Title VII). The U.S. DOJ re- dation, 1970) pp. 3-5 (quoting from the and penal and other institutions.” quires that federally funded criminal President’s Commission Report). 50Pub. L. No. 92-544, Title II, § 201, justice information systems distinguish 49See, Use and Management of 86 Stat. 1115. between nonconviction information CHRI, supra note 22, p. 36. The FBI’s 51 (including certain arrest information) basic statutory authority to maintain 42 U.S.C. § 3789G(b), as amended and conviction information. 20 C.F.R. and disseminate criminal history re- by § 524(b) of the Crime Control Act of § 20.21(b). cords is at 28 U.S.C. § 534. This provi- 1973, Pub. L. No. 93-83 (1973).

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 17 comprehensive regulations — year after SEARCH was estab- impact on criminal justice in- known as the “DOJ regulations” lished, SEARCH published a formation management and pri- — intended to “assure that series of reports addressing privacy.57 CHRI wherever it appears is vacy and security in computer- collected, stored, and dissemi- ized criminal history files, and nated in a manner to insure the providing guidance for legisla- State legislation completeness, integrity, accu- tive and regulatory protections racy and security of such infor- for CHRI.54 The bulk of the criminal justice mation and to protect individual information maintained in the privacy.”52 The regulations set In 1975, SEARCH published United States is maintained at relatively detailed and ambitious the widely influential Technical the State level; therefore, most standards for data quality, while Report No. 13, SEARCH’s first of the legislation on governing giving States discretion to set comprehensive statement of 25 this information is found at the their own standards for dissemi- recommendations for safe- State level (with certain impor- nation, recognizing that incom- guarding the security and pri- tant exceptions, such as the DOJ plete or inaccurate criminal vacy of criminal justice regulations discussed above). history data, particularly arrest information.55 These recom- Throughout the 1970s and into information without disposition mendations influenced LEAA’s the 1980s, States adopted stat- information, could have nega- development of the DOJ regu- utes based in large measure on tive implications for the record lations discussed above, and the the DOJ regulations and the subject and his or her participa- Appendix to the DOJ regula- SEARCH recommendations. By tion in society. tions refers States to Technical the early 1990s, approximately Report No. 13 for guidance in one-half of the States had en- In addition to regulation of the formulating their State plans.56 acted comprehensive criminal handling of criminal history in- Technical Report No. 13 has history record legislation, and formation by criminal justice been revised twice since 1975 every State had enacted statutes agencies, Federal law also — most recently in 1988 — to that address at least some as- regulates private-sector uses of reflect technological and socie- pects of criminal history re- criminal history information in tal changes that have had an cords. The majority of State certain circumstances. The Fair laws followed the scheme in the Credit Reporting Act (FCRA), DOJ regulations that distin- for example, regulates the com- 54See, Technical Report No. 2: Secu- guishes between information pilation, disclosure, and use of rity and Privacy Considerations in referring to convictions and cur- consumer reports, which may Criminal History Information Systems, rent arrests (arrests that are no include criminal history infor- supra note 48; Project SEARCH, Tech- older than 1 year and that do not mation.53 nical Memorandum No. 3: A Model yet have the disposition) and State Act for Criminal Offender Record Information (Sacramento: California “nonconviction data,” which Crime Technological Research Foun- includes arrests more than 1 SEARCH Technical Report dation, May 1971); and Project year old without a disposition or No. 13 SEARCH, Technical Memorandum No. arrests with dispositions favor- 4: Model Administrative Regulations able to the accused. SEARCH has also been active for Criminal Offender Record Informa- tion (Sacramento: California Crime in the formulation of standards Technological Research Foundation, for the security and privacy of 1972). CHRI. Beginning in 1970, the 55 See, Technical Report No. 13: 57Technical Report No. 13, 3rd ed., Standards for the Security and Privacy supra note 8. The second revision oc- 52 28 C.F.R § 20.01. of Criminal Justice Information (Sac- curred in 1977, at which time the com- 53The Fair Credit Reporting Act is ramento: SEARCH Group, Inc., 1975). mentary to the 1975 report was discussed in greater detail in infra, 56See, 28 C.F.R. Part 20, Appendix § expanded, but the original recommen- chapter V, p. 58. 20.22(a). dations were unchanged. Ibid., p. 1.

Page 18 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Under the DOJ regulations and and/or offer corrections for virtually every State, all many State laws, conviction information in their criminal criminal histories information can be made avail- history records.61 maintained by a central able largely without restriction. State repository must be 1. Restrictions on the collec- Nonconviction data, on the supported by a finger- tion and/or integration of other hand, can not be made print record and, with criminal history informa- available under the DOJ regula- certain exceptions, re- tion. Most States have tions unless authorized by a quests must be accom- adopted formal or informal State statute, ordinance, execu- panied by a fingerprint. restrictions that segregate tive order, or court rule.58 Fur- Fingerprint support en- CHRI from other types of thermore, the DOJ regulations sures that the record personal information. Thus, provide that when CHRI is dis- maintained at the re- CHRI seldom includes ju- seminated to noncriminal justice pository relates to the venile justice information; agencies, its use “shall be lim- correct person, and that customarily never includes ited to the purpose for which it the repository’s re- investigative or intelligence was given.”59 sponse similarly relates information; and customar- to the correct person. ily never includes medical Today, a relatively stable and The principal exception information, employment uniform approach to protect the for law enforcement re- information, financial in- privacy of CHRI is in place quests occurs in information, military or citi- throughout the United States.60 stances where the law zenship status information, Five fundamental principles, in enforcement agency or other types of personal many ways reflective of the does not have the indi- information. Although re- HEW Code of Fair Information vidual in custody and, positories continue to seg- Practices, characterize the U.S. therefore, cannot pro- regate CHRI in this manner, approach to protecting the pri- vide a fingerprint, or in end-users of information in- vacy of CHRI: situations requiring a creasingly are able to com- quick turnaround. In 1. Subject access and correc- bine CHRI obtained from those instances, a tion. As of 1999, 51 of the the State repositories with “name-only” check 53 jurisdictions surveyed noncriminal history record (customarily, not just a (the 50 States plus the Dis- information obtained from name but also other trict of Columbia, Puerto commercial information demographic informa- Rico, and the U.S. Virgin vendors and other sources in tion, such as gender, Islands) give record subjects order to create a more de- date of birth, race, and a right to inspect their tailed picture of the individ- other physical indica- criminal history records, ual. tors) is permitted. and 44 jurisdictions permit 1. Data quality and data record subjects to challenge · Disposition reporting. maintenance safeguards. Repositories attempt to As of 1999, 52 of 53 juris- 58 obtain disposition in- 28 C.F.R. § 20.21(b). dictions have adopted stan- 59 formation from the 28 C.F.R. § 20.21(c)(1). dards for ensuring the courts. In recent years, 60BJS supports a biennial survey, accuracy and completeness the percentage of arrests conducted by SEARCH, to assess State of CHRI.62 privacy practices. See, Paul L. Woo- maintained at the re- dard and Eric C. Johnson, Compendium · Fingerprint versus positories that include of State Privacy and Security Legisla- “name-only” access. In available dispositions tion: 1999 Overview, NCJ 182294 has increased substan- (Washington, D.C.: U.S. Department of 61 Justice, Bureau of Justice Statistics, Ibid., p. 16. tially; however, incom- July 2000). Hereafter, Compendium. 62Ibid.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 19 plete records remain a cal, administrative, physi- sions also work effectively problem.63 cal, and/or personnel secu- to provide dissemination rity.65 As a practical matter, and confidentiality safe- · Sealing and purging. As however, security standards guards.) of 1999, 42 States have are in place for all 52 juris- adopted laws that per- · Criminal justice access. dictions that have estab- mit the purging (de- Law and policy in every lished central State struction) of State provides that repositories. The extent and nonconviction informa- criminal justice re- nature of those standards, tion and 27 jurisdictions questors can obtain all however, vary substantially. have adopted standards information in the for the purging of con- 3. Use and disclosure. As of criminal history record viction information if 1999, all 53 jurisdictions unless the information certain conditions are have adopted laws or regu- has been sealed by stat- met. In addition, 33 lations setting standards for ute or court order. Most States have adopted the use and/or dissemination States, however, have laws and regulations to of CHRI.66 As a practical some process for seal- permit the sealing of matter, every State makes ing or purging CHRI nonconviction informa- all CHRI available for when it is no longer tion and 30 States have criminal justice purposes. considered relevant. adopted laws and stan- Outside of the criminal jus- · Noncriminal justice ac- dards to permit the tice system, however, con- cess. The repositories sealing of conviction in- viction information is provide CHRI to non- formation.64 widely available but noncriminal justice re- conviction information re- 2. Security. As of 1999, 42 questors authorized by mains largely unavailable or jurisdictions have adopted State law, such as li- available only to certain formal standards for techni- censing boards and types of users (licensing certain types of em- boards and certain kinds of 63 ployers. In most States, As of 1999, the most recent year for employers who employ in- which figures are available, 18 States authorized noncriminal dividuals in highly sensitive and the District of Columbia report that justice requestors re- positions, such as school 80% or more of arrests within the past ceive less than the full bus drivers or child care 5 years in the criminal history database record — most often had final dispositions recorded, while workers).67 (Of course, limited to conviction- 32 States and the District of Columbia sealing and purging provi- report that 60% or more of the arrests only information. in the past 5 years have final disposi- 65 tions attached. Overall, the figures are Ibid. · Public access. Except in lower when arrests older than 5 years 66Ibid. a few “open record” are factored in. When arrests greater 67Traditionally, law and policy has States, such as Florida than 5 years old are included, only 15 distinguished sharply between convic- and Wisconsin, the gen- States report that 80% or more arrests tion and nonconviction information. In eral public is restricted in their entire criminal history database many jurisdictions, conviction infor- in its ability to obtain have final dispositions attached, while mation is available to broad segments CHRI from the central 32 States report that 60% or more ar- of noncriminal justice employers and rests have dispositions attached. Sheila other authorized users, if not the gen- State repository, with J. Barton, Survey of State Criminal eral public, through central repositories. the exception of certain History Information Systems, 1999, By contrast, nonconviction informa- classes of information, Criminal Justice Information Policy tion, even in 1999, is almost never such as sex offender series, NCJ 184793 (Washington, D.C.: publicly available from central reposi- registry information. U.S. Department of Justice, Bureau of tories, with rare exceptions in some Justice Statistics, October 2000) p. 2. States for special categories of of- 64Compendium, supra note 60, p. 16. fenses, such as sex offenses.

Page 20 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Access to criminal history record information in “open,” “intermediate,” and “closed” record States: Three case studies

Florida: An “open records” State

In 1977, the Florida Department record checks. Criminal history tronic submission. Requestors in of Law Enforcement (FDLE) checks for sensitive employ- this second category can request adopted a policy of making all ment, licensing, and firearms a search of Florida-generated State-generated criminal history purchases identified 264,148 criminal records for any pur- records available upon request individuals with criminal histo- pose, by paying the appropriate by any member of the public for ries. Noncriminal justice recipi- fee. These inquiries are typically any purpose, upon payment of ents of criminal history records “name only,” although finger- the applicable fees, which are fall into two broad categories. prints will be compared if sup- designed to offset the costs of The first category is comprised plied by the requestor. public record access requests. of agencies and organizations Responses to these requests in- with approved statutory authori- clude all unsealed, Florida- The policy, which is designed to zations to receive information generated criminal history re- implement the State’s public from the FBI as well as FDLE. cords in the FDLE computer- record law, is interpreted in As of September 30, 1999, this ized files. As of September 30, conjunction with Chapter 943 of category included 221 agencies 1999, this category includes the Florida Statutes, which with FBI-assigned originating approximately 15,913 agencies regulates the collection, mainte- agency identifiers (ORIs) signi- and organizations that filed nance, and dissemination of fying approval of their access 1,001,307 criminal record ac- criminal justice information. authority by the U.S. Attorney cess checks under the public Section 943.053(2) effectively General. This category is com- records law during fiscal year restricts the applicability of the prised primarily of State de- 1998-1999. These requests were State public records law to partments and agencies filed by all levels and types of Florida-generated records by authorized to access information agencies for a wide variety of providing that criminal justice for employment background purposes, although FDLE offi- information obtained from the checks, but the list also includes cials report the most common Federal government and other licensing bureaus, universities, reason was employment States shall only be dissemi- State commissions, and the screening. Most of these agen- nated in accordance with Fed- agency responsible for running cies are regular users that have eral law and policy, and the law the State lottery. For the fiscal been assigned account numbers and policy of the originating year ending June 30, 1999, these to facilitate billing and proc- States. Similarly, section agencies filed 271,230 records essing. Other requests are re- 943.054(1) restricts the ability requests for approved licensing ceived on a one-time-only or of FDLE to make available any and employment purposes. irregular basis from agencies or information derived from a individuals for undetermined system of the U.S. DOJ to only The second category is com- purposes. those noncriminal justice pur- prised of agencies and organi- poses approved by the Attorney zations without statutory In addition to requests for an General or the Attorney Gen- authorization that are eligible to individual’s entire criminal his- eral’s designee. receive information only from tory record, FDLE administers FDLE files pursuant to the pub- databases of sexual offenders During fiscal year 1998-1999, lic records law. There is a $15 and sexual predators (as defined FDLE responded to 1,484,273 fee for processing requests under Florida law) that the pub- requests for criminal history made either by letter or elec- lic can search over the Internet.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 21 Searches can be conducted online, instantly, on the basis of county, city, ZIP code, and/or pattern for last name. FDLE estimates that these databases, which contain records on approximately 15,650 offenders, received 347,245 hits during fiscal year 1998-1999.

Sources: § Florida Department of Law Enforcement. § Florida Department of Law Enforcement, Annual Per- formance Report, Fiscal Year 1998-1999. § Florida Department of Law Enforcement Internet site: http://www.fdle.state.fl.us § Paul L. Woodard, A Florida Case Study: Availability of Criminal History Records, The Effect of an Open Re- cords Policy (Sacramento: SEARCH Group, Inc., 1990).

Page 22 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Washington: An “intermediate records” State

The Washington State Patrol record, the requestor will re- or engagement decision.” Fur- (WSP) is responsible for the ceive a report detailing all State ther dissemination or use of the maintenance of the Washington of Washington convictions and record is prohibited. Violators repository of CHRI. pending arrests under 1 year old are subject to civil damages. without disposition. The record WSP estimates that, from 1996 Certified criminal justice agen- will also reflect whether the in- through 1999, it responded to cies may request and receive dividual is a registered sex of- 692,734 requests from busi- CHRI without restriction for fender or kidnapper. Secondary nesses/organizations/employers. criminal justice purposes. disclosure of CHRI obtained This includes volunteer and em- pursuant to the statute, however, ployee record checks. WSP does Noncriminal justice entities and is restricted. WSP estimates not maintain statistics specifi- individuals may receive access that, from 1996 through 1999, it cally regarding the number of to only conviction information. has responded to 392,218 re- employers who requested in- Depending upon the purpose of quests for CHRI by noncriminal formation. the request, WSP may respond justice agencies under this Act. under two different statutes, the WSP does not make sex of- Criminal Records Privacy Act Eligibility for access to CHRI fender information publicly (Chapter 10.97 Revised Code of under the Child and Adult Abuse available over the Internet, al- Washington (RCW)) or the Information Act is “limited to though some local departments Child and Adult Abuse Infor- businesses or organizations li- do so. WSP does make some mation Act (RCW §§ 43.43.830- censed in the State of Wash- sex offender information avail- .845). Responses to information ington; any agency of the State; able for certain employment requests made using Washing- or other governmental entities background checks. WSP dis- ton Access to Criminal History that educate, train, treat, super- seminates limited information (WATCH), an online system, vise, house, or provide recrea- on sex offenders to the general are immediate. Paper requests tion to developmentally disabled public in response to written take 3-10 weeks for processing. persons, vulnerable adults, or requests. Based upon the risk Fees, which are waived for non- children under 16 years of age.” level of the offender, local law profit organizations in certain If a record exists, it will include enforcement may notify neigh- circumstances, range from $10 “State of Washington convic- bors and community members for a “name-only” search to $25 tions and pending arrest of- or, in the case of high-risk of- for a fingerprint-supported fenses under one year old of fenders, issue press releases. search. WSP estimates that, crimes against children or other WSP estimates that it responded from 1996 through 1999, it has persons, crimes of financial ex- to 36 written requests for infor- responded to 1,128,392 non- ploitation, civil adjudications, mation on specific sex offenders criminal justice requests for and sex offender and kidnapper during 1999. These were spe- CHRI. registration information.” The cific requests for a list of State requires that the requestor sex/kidnapping offenders Requests made pursuant to the provide a copy of the report to through the WSP Public Disclo- Criminal Records Privacy Act, the record subject. Use of re- sure Office. Information pro- which provide the requestor cords obtained by employers vided includes name, date of with conviction information, pursuant to this Act is limited birth, registering agency, and can be made by anyone for any by RCW 43.43.835(5) to the date of registration. purpose, without the consent of “making the initial employment the record subject. If there is a

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 23 Sources: § Washington State Patrol. § Washington State Patrol Internet site: http:// www.wa.gov/wsp/crime /crimhist.htm § Devron B. Adams, Update 1999: Summary of State Sex Offender Registry Dissemi- nation Procedures, Fact Sheet series, NCJ 177620 (Washington, D.C.: U.S. Department of Justice, Bu- reau of Justice Statistics, August 1999) p. 7.

Page 24 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Massachusetts: A “closed records” State

The Massachusetts Criminal In addition, at the time of the individual privacy interests. History Systems Board (CHSB) request for access to the indi- There are approximately 6,700 was created in 1972 by the vidual’s criminal history record, noncriminal justice agencies in Criminal Offender Record In- the record subject must: Massachusetts authorized to formation Act (CORI) and is · Be incarcerated; or access criminal records. Parents, governed by a 17-member board for example, can seek access to · Be on probation; or comprised of representatives of all conviction and pending case the criminal justice community. · Be on parole; or information on prospective day- · Have been convicted of a care providers with the written, Criminal justice requests for misdemeanor, having been notarized consent of the record criminal history records are released from all custody subject. Parents are prohibited handled electronically, while (that is, incarceration, pro- from disclosing any results of public access requests, which bation, or parole) or super- the criminal history check to are restricted, are processed us- vision for not more than 1 third parties. In addition, Mas- ing the U.S. mail and email. year; or sachusetts law prohibits a per- · Have been convicted of a son from requesting or requiring Public access requests must in- felony, having been released a record subject to produce a clude the name and date of birth from all custody (that is, in- copy of his or her record, unless of the person who is the subject carceration, probation, or authorized to do so by CHSB. In of the inquiry. There is a $25 parole) or supervision 1999, CHSB processed 659,808 fee for processing requests, within the last 2 years; or requests for access to criminal which must be typed and ac- · Have been sentenced to the history information that is not companied by a self-addressed, custody of the Department publicly available. stamped envelope. Not all of Correction, having finally criminal history records are been discharged therefrom, Sex offender information is available to the public. The de- either having been denied subject to separate rules. Massa- termination of public access release on parole or having chusetts makes information depends upon a number of fac- been returned to penal cus- available about registered sex tors, including the charge, the tody for violating parole, for offenders classified by the Mas- sentence, current status, and not more than 3 years. sachusetts Sex Offender Regis- length of time that has passed try Board (SORB) as posing a since sentence completion. Spe- CHSB estimates that it received moderate or high risk (after the cifically, in order for the infor- 12,373 public access requests offender has an opportunity for mation to be publicly accessible, during 1999. administrative evidentiary pro- the record subject must have ceedings). Registry information been: CHSB certifies applicants for may be obtained in person at · Convicted of a crime pun- access to non-publicly available local police departments or by ishable by a sentence of 5 criminal history information if requesting information from the years or more; or the requestor: (1) qualifies as a SORB by mail. · Convicted of any crime and criminal justice agency; (2) sentenced to a term of in- qualifies as an agency or indi- The form of public inquiries is carceration. vidual authorized to have access limited. If a member of the pub- by State law; and/or (3) it has lic makes an in-person request, been determined that the public he or she may: interest in disseminating such information clearly outweighs

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 25 1. Inquire whether a specifi- eye and hair color, the sex of- cally named individual or a fenses committed and the dates person described by suffi- of conviction and/or adjudica- cient identifying information, and a photograph of the tion to allow the police to offender, if available. If a writ- identify the individual is a ten request is submitted to the sex offender; or SORB, the requestor will be provided with a report identify- 2. Inquire whether any sex ing whether the person is a sex offenders live or work offender with an obligation to within the same city or town register; the offenses for which at a specific address, in- he/she was convicted or adjudi- cluding, but not limited to, a cated; and the dates of such residential address, business convictions or adjudications. address, school, after-school Responses to both personal and program, daycare center, mail requests are provided free playground, recreational of charge and all information area, or other identified ad- provided includes language dress; or cautioning that the misuse of 3. Inquire whether any sex sex offender information for offenders live or work at a purposes of harassment or dis- specific street address crimination is prohibited. within the city or town where the person is re- Sources: questing sex offender in- § Massachusetts Criminal formation; or History Systems Board. 4. Where the police depart- § Massachusetts Sex Offender ment is located in a city or Registry Board Internet site: town with more than one http://www.state.ma.us ZIP code area, the inquiry /sorb may ask whether any sex offenders live or work within a specified ZIP code. In Boston, such inquiry may be made by specified police district.

Only option one (inquiries about named individuals) is available in the case of written requests to the SORB.

If an in-person request results in the identification of a sex offender, the requestor will be provided with the offender’s name, home address, work address, age, sex, height, weight,

Page 26 Report of the National Task Force on Privacy, Technology and Criminal Justice Information V. Change drivers and trend lines: The basis for a new look at privacy and criminal justice information

By the late 1990s, 10 interre- Force hopes to encourage effec- · Technological change. lated and fundamental develop- tive debate as to a new genera- Revolutionary improvements were outflanking the tion of criminal justice ments in information, iden- generation of privacy and in- information privacy standards. tification, and formation safeguards that communications technolo- · Public concern about pri- emerged in the 1970s and the gies (including increasingly vacy. In the late 1990s, the 1980s. advanced software applica- American public registers tions and Internet-based the strongest concerns ever These trends and change drivers technologies), and the in- recorded about threats to have overtaken traditional rules creased affordability of their personal privacy from for access and use, arguably these technologies, fuels the both government and busi- requiring new rules to re- appetite for information and ness. Ninety-four percent of establish the balance between creates new players in the respondents said in a 1999 privacy and disclosure of crimi- criminal justice information survey that they are con- nal justice information.68 On one arena. cerned about the possible side of the equation, there is misuse of their personal in- · System integration. Initia- growing public concern about formation. Of the con- tives to integrate criminal privacy in general, and the concerned, 77% said they were justice information systems fidentiality of personal informa- “very concerned.”69 operated by law enforce- tion in particular. On the other ment, courts, prosecution, side, there are a number of cul- · The “Information Cul- and corrections — as well tural-, technological-, and pol- ture.” A new and emerging as to integrate these systems icy-driven factors that tend to culture of information ac- with information systems promote greater access to crimi- cess and use facilitated by maintaining other types of nal justice information. The personal computers, brows- personal information — Task Force concludes that many ers, search engines, online create powerful new infor- of these change drivers are irre- databases, and the Internet mation resources. At the versible. What is not irreversi- has helped to create a de- same time, these integration ble, however, is the degree to mand for, and a market in, initiatives may create un- which these change drivers will information, including certainty about the types of inform future privacy standards criminal justice information, privacy laws and policies for criminal justice information. while at the same time fos- that apply to these new By identifying the change driv- tering in many a sense of systems, and dilute existing ers set forth below, the Task lack of control over one’s policies designed to keep in- personal information and a formation separate. loss of privacy. 68These trends and change drivers re- · New approach that closely flect elements of cause and conse- resembles a “Business quence. It is, of course, not as Model” for the criminal important to assign degrees of causality to these developments as it is to iden- 69IBM Multi-National Consumer Pri- justice system. Two fun- tify and understand these developments vacy Survey, October 1999, p. 71, damental changes in the and the nature of the challenge that available at http://www.ibm.com way the criminal justice they pose to established criminal justice /services/e-business/priwkshop.html. system operates — (1) a information policy and privacy stan- Hereafter, IBM Consumer Privacy new, more cooperative, dards. Survey.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 27 community-based relation- · Government statutes and — Public opinion survey ship between criminal jus- initiatives. A host of new results tice agencies and citizens; government initiatives and and (2) added criminal jus- laws, aimed at providing Periodic surveys, including tice agency responsibilities criminal justice information those conducted by Harris Inter- to provide information to to broader audiences, on a active and Opinion Research surrounding communities, more cost-effective and Corporation in association with Federal, State, and local timely basis, has also fueled Dr. Alan F. Westin,70 repeatedly agencies, other police de- the availability of criminal indicate that the public is deeply partments, and other organi- justice information. concerned about privacy. zations — have had a · Juvenile justice reform. profound impact upon the The growing traction of privacy Demands for juvenile jus- approach that criminal jus- as an issue can be illustrated by tice records, particularly tice agencies take to ob- the following statistics from those involving violent of- taining and using public opinion surveys con- fenses, which result in information. This new ap- cerning consumer privacy is- treating juvenile informa- proach — a “data-driven, sues: tion in a way that very much problem-solving approach” resembles the handling of · A 1999 Wall Street Jour- — also creates privacy risks adult records, is also putting nal/NBC News survey through a wider circulation pressure on traditional in- asked respondents this of criminal justice informa- formation and privacy poli- question: “Which one or tion. cies. two issues concern them the · Noncriminal justice de- most about the next cen- · Intelligence systems. mand. A persistent and tury?” With 29 percent of Criminal justice intelligence ever-increasing demand by respondents, the potential systems are being auto- noncriminal justice users to “loss of personal privacy” mated, regionalized, and obtain CHRI has had a per- topped the list, finishing armed with CHRI and other vasive and important impact ahead of concerns about is- personal information to cre- on the availability of infor- sues such as terrorism, ate detailed personal pro- mation. overpopulation, world war, files for law enforcement and global warming.71 · Commercial compilation use. and sale. Changes in the in- 70 formation marketplace, As previously noted, one of the responsibilities of the National Task which feature the private Information privacy Force was to provide advice with re- sector’s acquisition, com- concerns at a historic high spect to the first-ever national opinion pilation, and sale of crimi- level survey of the public’s attitudes about nal justice information privacy and criminal justice informa- obtained from police and, Today, concern about information. The results of that survey, which more particularly, court- was developed and administered by tion privacy in the United States Opinion Research Corporation concur- based open record systems, is at a high-water mark. This rent to the preparation of this report and are making information concern is evidenced in public conducted once this report was largely similar to that found in opinion survey results, govern- finished, is being published separately criminal history records ment attention to the privacy by BJS as a companion report titled more widely available to “Privacy, Technology and Criminal issue, and media treatment of Justice Information: Public Attitudes those outside the criminal government and private-sector Toward Uses of Criminal History In- justice system. initiatives that are viewed as an formation, Summary of Survey Find- impingement on privacy or fair ings” (NCJ 187633). information practices. 71Albert R. Hunt, “Americans Look to 21st Century With Optimism and

Page 28 Report of the National Task Force on Privacy, Technology and Criminal Justice Information · In the late 1990s, the about government invasions · A large percentage of the American public registered of privacy (52% in 1994 public feels that consumers the strongest concerns ever and 51% in 1995), a sub- have “lost all control over recorded about threats to stantial minority expressed how personal information their personal privacy from primary concern about ac- about them is circulated and both government and busi- tivities of business (40% in used by companies.”76 ness. In a 1999 survey, 94% 1994 and 43% in 1995). · Seventy-two percent said of respondents said they are And, almost two-thirds of they have read or heard a concerned about the possi- the public disagreed with great deal or a moderate ble misuse of their personal the statement that “the Fed- amount about invasion of information. Of the con- eral Government since Wa- privacy in the past year. cerned, 77% said they were tergate has not been One-quarter of the public “very concerned.”72 seriously invading people’s (25% in 1991 and 1995) privacy (64% in 1990 and · In that same 1999 survey, said they have personally 62% in 1995).”74 72% of Internet users said been victims of what they they were “very” concerned · Surveys suggest that the felt was an invasion of their about threats to their per- driving factors behind pri- privacy,77 and 29% (in sonal privacy today when vacy attitudes, both in gen- 1999) said they had been using the Internet, and 92% eral and in specific victims of a business inva- said they were “very” or consumer areas, are the in- sion of their consumer pri- “somewhat” concerned. dividual’s level of distrust vacy.78 However, 66% believed that in institutions and fears of · There has also been a major the “benefits of using the technology abuse.75 increase in privacy-asserting Internet to get information, behaviors by U.S. consum- send email, and to shop far 74 Louis Harris and Associates, Equi- ers. The percentage of peo- outweigh the privacy prob- fax-Harris Mid-Decade Consumer ple who said they have lems that are currently being Privacy Survey (1995) p. 9. worked on today.”73 75Ibid., p. 12. The Harris/Westin Dis- trust Index, first used in 1978 and § Medium (distrustful on 2 ques- · A mid-1990s survey indi- tested throughout the 1990s, combines tions): 42% cated that although a narrow measurement of distrust in institutions § Low (distrustful on 1 question): majority of survey respon- (government, voting, and business) 23% dents worried primarily with fear that technology is almost out § Not (no distrustful answers): 6% of control. The surveys have found that In 13 of the survey’s 16 questions ask- a respondent’s score on the Distrust ing about general privacy concerns and Index correlates with a majority of that measuring specific privacy attitudes, Confidence,” Wall Street Journal respondent’s positions on privacy in the strongest privacy positions were (September 16, 1999) p. A9. On the general and the industry-specific ques- registered by the High Distrustful re- other hand, in 1995, when an Equi- tions on each survey. fax/Harris survey gave respondents a spondents; the next strongest by the The higher the Distrust Score, the more list limited to nine consumer issues to Medium Distrustful; and so on through a respondent will express concern rate in importance, privacy finished the Low to Not Distrustful. In survey about threats to privacy, believe that exactly in the middle (fifth) in terms of terms, this is confirmation of the direct consumers have lost all control over being “very important,” at 61%. Rated relationship between the Distrust ori- uses of their information by business, higher in being very important were entation and positions on privacy is- reject the relevance and propriety of controlling the cost of medical insur- sues. Ibid. information sought in particular situa- ance (84%); staying out of excessive 76IBM Consumer Privacy Survey, su- tions, call for legislation to forbid vari- debt (83%); reducing insurance fraud pra note 69, p. 70. ous information practices, etc. (74%); and controlling false advertising 77Louis Harris and Associates, Inc., In 1995, for example, the American (71%). See, infra, note 74. 1996 Equifax/Harris Consumer Pri- public divided as follows on the Dis- 72IBM Consumer Privacy Survey, su- vacy Survey (1996) p. 4. trust Index: pra note 69, p. 71. 78 § High (distrustful on 3-4 ques- IBM Consumer Privacy Survey, su- 73 Ibid., pp. 72, 77. tions): 29% pra note 69, p. 74.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 29 refused to give information of the Gramm-Leach-Bliley Privacy is an issue that cuts to a business or company Act (G-L-B Act).81 It re- across political and ideological because they thought it was quires that financial institu- boundaries. On February 10, not needed or was too per- tions take steps to protect 2000, for example, Senator sonal has risen from 52% in the privacy of nonpublic fi- Shelby, Senator Richard Bryan 1990 to 78% in 1999. Also nancial information about (D-NV), Representative Ed in 1999, 53% of respon- consumers, including pro- Markey (D-MA), and Repre- dents said they have asked a viding notice and an op- sentative Joe Barton (R-TX) company not to sell or give portunity to opt-out of most held a news conference to an- their name and address to disclosures of nonpublic nounce the formation of the bi- another company, and 54% personal information to partisan, bicameral said they had decided not to nonaffiliated third parties. Congressional Privacy Caucus use or purchase something The enactment of the G-L-B (CPC). The purpose of the CPC from a company because Act, however, has not ended is to: (1) educate Members of they were not sure how their the debate. Many members Congress and staff about indi- personal information would of Congress believe that still vidual privacy issues; (2) pro- be used.79 stronger protections are vide a forum for the discussion needed. of individual privacy issues; and — Activity at the Federal (3) advocate for personal pri- · Senator Richard Shelby (R- and State level to pro- vacy protections. AL) included language in tect privacy the Department of Trans- The State legislatures have also portation Appropriations This high level of public con- been active on privacy issues. Act for fiscal year 200082 cern about privacy issues has During 2000, at least 1,622 con- that requires the States to not gone unnoticed by the Fed- sumer privacy bills (focusing on adopt an opt-in mechanism eral government and States. Re- financial services, health, insur- for use of personal informa- cent congressional activity ance, direct marketing, tele- tion in motor vehicle re- suggests that Congress likely communications, and cords for marketing will be increasingly active on a online/Internet services) were (excluding insurance rate range of privacy issues.80 For introduced in State legislatures setting), survey, or solicita- example: and 422 bills were enacted. tion purposes, and for any Thirty-nine States enacted leg- · Perhaps the most prominent use of driver’s license pho- islation, with health, finance, piece of privacy legislation tographs. and insurance-related measures to be enacted during the · Other domestic privacy is- being the most common enact- 106th Congress was Title V sues receiving congressional ments.83 In another example, attention include health in- groups as diverse as the Ameri- 79 Ibid., p. 87. formation privacy issues, can Civil Liberties Union 80 This is not to say that Congress also online privacy, the use and (ACLU) and Phyllis Schlafly’s has not been criticized as being insen- disclosure of the Social Se- sitive to privacy concerns. Congress, Eagle Forum have supported for example, passed legislation requir- curity number, access to health information privacy leg- ing a unique national health identifier public record/government islation. for every American (to facilitate health repository information, and care), as well as a requirement that all the possible creation of a States use an individual’s Social Secu- privacy study commission. rity number as the person’s driver’s license number (to combat illegal immigration). Congress later reversed itself in both cases, following com- 83Privacy & American Business, 81 plaints about the adverse privacy impli- Pub. L. No. 106-102. “Privacy Legislation in the States – cations of these measures. 82Pub. L. No. 106-69, § 350. 2000” (January 2001).

Page 30 Report of the National Task Force on Privacy, Technology and Criminal Justice Information At the same time, the Federal — Privacy issues are · DoubleClick. During its 4- executive branch has launched receiving increasing year life, Internet advertis- numerous privacy protection media attention, often ing giant DoubleClick has initiatives. The Federal Trade requiring companies collected clickstream infor- Commission (FTC), the Federal and government mation from its participat- Communications Commission, agencies to modify ing Web sites and then used the U.S. DOJ, the U.S. Depart- their practices that data to help those Web ment of Health and Human sites customize the banner Services, the Office of Man- Media coverage and its after- and pop-up advertisements agement and Budget, the Office math is also illustrative of in- that visitors see. Double- of the Vice President, the Fed- creasing concern over Click could not identify the eral financial regulatory agen- information privacy issues. visitor, only the visitor’s cies, the National Highway Typically, this cycle begins with computer. The privacy fire- Transportation and Safety Ad- media reports highlighting gov- storm began in November ministration (on intelligent ve- ernment or private-sector infor- 1999 when DoubleClick hicle-tracking systems), and the mation practices that raise spent $1.7 billion to pur- U.S. Department of Commerce privacy issues. Once these prac- chase Abacus Direct, the have all published privacy- tices become well-publicized, largest database of con- related regulations or guide- an ensuing firestorm of public sumer catalogue activity. lines; conducted privacy studies; pressure frequently forces the DoubleClick’s plan, which initiated privacy-related, ad- private- or public-sector entity drew intense criticism, was ministrative actions; and/or responsible to modify or termi- to marry its clickstream data promoted information privacy nate the practices that offended with Abacus’ offline data to initiatives. public sensibilities. To date, identify specific consumers although a few of the more (not just their computers), State officials have also been prominent privacy firestorms and then create a profile of active on the privacy issue. The have involved information that the consumer’s interests and National Association of Attor- may have been used by law en- buying activity. neys General, for example, has forcement to some degree for voted to make privacy one of intelligence or investigative Not only did DoubleClick their top priorities and several purposes, the most notable of receive a torrent of adverse Attorneys General have already these “firestorms” have not in- media coverage, it also re- taken legal action against com- volved criminal justice infor- ceived over 100,000 con- panies they believe to be mis- mation. sumer complaints in using consumer data.84 In response to an online protest addition, the Governor of Examples of private-sector pri- organized by the Center for Washington issued an Executive vacy firestorms during the past Democracy and Technol- Order requiring State agencies 2 years include: Internet adver- ogy. In addition, the FTC, to implement a set of privacy tising giant DoubleClick; Image as well as the attorneys gen- protections for public records to Data, a small New Hampshire eral of Michigan, Connecti- the maximum extent permitted company test marketing the use cut, New York, and by State law.85 of DMV photographs for anti- Vermont, announced an in- fraud and identity theft preven- vestigation of Double-

84Gail Appleson, “Drive to Protect tion purposes; America Online Click’s activities; several U.S. Consumer Privacy, ” Reuters (AOL); and supermarkets and class-action lawsuits had (March 24, 2000, 3:47 PM ET). pharmacies, such as Giant and been filed; and Internet- 85Governor Gary Locke, “Public Re- CVS. industry players, such as cords Privacy Protections,” Washington search engine AltaVista Co. State Executive Order 00-03 (April 25, and Internet home delivery 2000).

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 31 service Kozmo.com Inc., chant with a check or credit lic outcry that ensued, all took steps to distance them- card. three States terminated their selves from DoubleClick. If contracts with Image Data. that had not been enough, Image Data had entered into South Carolina, the only the company’s stock price agreements with South State that had transferred fell by more than 25 percent Carolina, Colorado, and photos before the story during the firestorm, but re- Florida to obtain driver’s li- broke, sought to retrieve bounded somewhat follow- cense photographs and other any photos already trans- ing the company’s information and was testing ferred. Image Data is re- announcement on March 2, its program in South Caro- ported to be moving 2000, that it would not go lina when the Post story forward with its program on forward with the profile broke. A public outcry en- an “opt-in” basis, giving plan.86 sued with State officials re- consumers the option of ceiving a torrent of angry having their driver’s license · Image Data. One of the telephone calls protesting photograph added to the largest privacy firestorms of the plan (a class-action law- Image Data database. 1999 began in January 1999 suit was even filed in Flor- when the Washington Post ida). Public ire appears to In the months subsequent to reported that Image Data, a have been a product of sev- the initial story, reports small New Hampshire com- eral factors. As one South arose alleging that the Se- pany, had developed a Carolina woman described cret Service and other Fed- product designed to combat it: “We were livid [upon eral agencies intended to check and credit card fraud hearing about the Image use the Image Data database and identity theft, using Data program]. In my of photographs for counter- State DMV photographs. opinion, a South Carolina terrorism, immigration con- Image Data had entered into driver’s license is a need, trol, and other law enforce- contracts with several not a want. We have no ment activities. Both the States, whereby Image Data choice but to give our in- Secret Service and Image was permitted to digitize formation in order to have Data have denied this DMV photographs of indi- one. Then they turn around charge, stating that while viduals and store the photo- and sell it to a company, as Federal authorities ex- graphs in a database. Under personal as it is: my weight, pressed interest in the tech- Image Data’s plan, mer- my height, my address — nology (and Congress chants would be able to ac- my God, my image. There “earmarked” funds for the cess this database, using a are endless possibilities as program in 1997), the data- small screen installed near to what could be done with base developed by Image the merchant’s cash register, it.” 87 As a result of the pub- Data was never a part of to verify the identity of the these discussions.88 purchaser when the cus- 87Robert O’Harrow, Jr., “Drivers An- tomer presented the mer- gered Over Firm’s Purchase of Photos,” · America Online. America Washington Post (January 28, 1999) Online announced a new pp. E1, E8. See also, Robert O’Harrow, privacy policy incorporating Jr., “Posing a Privacy Problem? 86 “DoubleClick Cries ‘Uncle’ …Sam Driver’s License Photos Used in Anti- (Sort of),” Privacy Times, Evan Hen- Fraud Database,” Washington Post Fla. Driver License Photos to Private dricks, ed., Vol. 20, No. 5 (March 3, (January 22, 1999) pp. A1, A22; Robert Firm,” Washington Post (February 2, 2000) pp. 5-6. See also, Bloomberg O’Harrow Jr. and Liz Leyden, “Sale of 1999) p. E3. News, “DoubleClick in Settlement License Photos Sparks Uproar, Colo- 88See, David McGuire, “Feds Deny Discussions” CNET News (Mar. 23, rado Governor Vows to Prevent Trans- Alleged Misuse of Photo Database,” 2000), available at fer to Private Firm,” Washington Post Newsbytes (September 7, 1999), avail- http://aolcom.cnet.com/news (January 30, 1999) p. E1; Robert able at http://www.infowar.com/class /0-1005-200-1582990.html. O’Harrow, Jr., “Gov. Cancels Sale of _1/99/class1_090899a_j.shtml.

Page 32 Report of the National Task Force on Privacy, Technology and Criminal Justice Information “Eight Principles of Pri- in the complaint for a jury laundering and other illegal vacy,” following well- to resolve, and the case is activities that may be occur- publicized reports of pri- still pending.89 ring through financial in- vacy breaches of AOL sub- stitutions. It is intended to scriber information, Media glare and public outrage detect patterns of illegal ac- including the proposed sale over privacy missteps is not tivity often characterized by of subscribers’ home tele- limited to the private sector. large cash deposits and phone numbers and the case Examples of governmental pri- withdrawals that are outside of Timothy McVeigh (no vacy missteps over the past few the normal and expected relation to the convicted years include the “Know Your activity.” Some opponents Oklahoma City bomber of Customer” proposal of the Fed- characterized the measure the same name). McVeigh eral Deposit Insurance Corpora- as turning bank tellers into was discharged from the tion (FDIC); the OASIS government informers and Navy for violating its policy proposal of the Health Care Fi- citizens into criminal sus- on homosexuals as a result nancing Administration pects. of personal information the (HCFA); a U.S. Postal Service Navy obtained from AOL proposal regarding private mail- Opposition to the proposed about McVeigh, without a boxes; and a Social Security KYC rule was widespread, search warrant or Administration initiative to pro- including an Internet-based McVeigh’s consent. vide individuals with online ac- campaign against the meas- cess to their Social Security ure. The FDIC was deluged · CVS/Giant Pharmacies. In earnings records. with criticism about the February 1998, the Wash- proposal, including a flood ington Post reported that · Know Your Customer. of complaints from indi- two pharmacy chains — One of the most controver- viduals. The agency re- CVS and Giant — used, or sial Clinton Administration ceived over 250,000 planned to use, an outside proposals, from a privacy comments on the proposed contractor to send prescrip- perspective, was the FDIC’s rule; all but a small handful tion refill notices and drug proposed “Know Your of the comments received promotional materials to Customer” (KYC) regula- were hostile to the proposal. pharmacy patrons using tions. The proposed KYC Hostility toward the pro- prescription information rule would have required all posed KYC rule came not supplied by the pharmacies. banks to develop a written only from the grass roots Within days of the initial program designed to enable level, but also on Capitol media report, both compa- the bank to “provide for Hill where a half-dozen bills nies took out full-page ad- identification and transac- designed to prohibit the im- vertisements announcing the tion monitoring procedures plementation of the rules cancellation of the pro- and identify transactions were introduced. In March grams, amid a flurry of that would be subject to 1999, the FDIC and the editorial criticism and cus- suspicious activity reporting other agencies that spon- tomer complaints. CVS has requirements.” According to sored the measure an- since been sued, with the the FDIC, the proposed nounced they were plaintiff alleging that CVS regulation was intended to withdrawing the measure in breached its fiduciary duty protect the integrity of the its entirety. as well as its duty of confi- banking system and to “as- dentiality to its pharmacy sist the government in its ef- · Outcome and Assessment customers. A State court forts to combat money Information Set. The rejected a motion to dismiss HCFA was caught in a pri-

by the defendants, con- 89Weld v. CVS, Superior Court of vacy storm in the spring of cluding that there is enough Massachusetts (Suffolk) No. 98-0897. 1999 as a result of its

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 33 planned “Outcome and As- tool for criminal activity. information to taxpayers sessment Information Set” The regulation also required quickly and easily. SSA (OASIS) for home health that CMRAs demand per- also noted there were severe care patients, which HCFA sonal identification from all penalties for fraudulently planned to have all home box renters and complete a accessing SSA records and care facilities complete form for submission to the that in order to request a re- about their patients. Fol- Post Office, which included port, the individual had to lowing adverse press cover- the box holder’s Social Se- supply five separate data age and criticism from curity number and other elements: name, Social Se- privacy advocates, Vice personal information. The curity number, date of birth, President Gore, and numer- Post Office would then place of birth, and mother’s ous Congressmen, the make that form available to maiden name. agency postponed imple- anyone who requested it. mentation of the project This did not stem the criti- while it revamped the pro- After complaints from citi- cism. Some privacy advo- gram. Changes were de- zens, privacy advocates, and cates, while supportive of signed to ensure that: (1) several members of Con- the idea of online access, only essential information gress, the Postal Service noted that all five of the would be collected; (2) the modified its regulation. It data elements required for information gathered would delayed the requirement that access were publicly avail- be properly protected; (3) “CMRA” be included in the able information, jeopard- disclosures of the informa- address. The post office also izing the security of the tion would be limited to the relaxed the registration re- information and the privacy minimum extent necessary quirements, announcing it of taxpayers. Senators with to carry out the mission of would not make applica- key oversight responsibili- HCFA; and (4) Medicare tions by small businesses ties for SSA voiced reser- beneficiaries would be fully publicly available and that it vations over the plan, and informed as to why infor- would advise CMRAs not to SSA was swamped with mation was being collected require Social Security tens of thousands of calls and how it would be used. cards as a form of identifi- from citizens complaining cation. Some privacy advo- about threats to their pri- · U.S. Postal Service. In cates found these revisions vacy. On April 9, two days March 1999, the U.S. Postal insufficient and continued after the USA Today story Service issued a regulation to oppose the regulation. first appeared, SSA “tempo- requiring users of commer- rarily” suspended the online cial mail receiving agencies · Social Security Admini- access initiative. Service has (CMRAs), such as Mail- stration (SSA). An April never been reinstated.90 In- boxes, Etc., to use the acro- 1997 USA Today report that stead, SSA has returned to nym “CMRA” in the the SSA was making Per- its prior practice of allowing address, thereby identifying sonal Earnings and Benefit individuals to request that the address is at a Estimates (PEBES) avail- PEBES statements using the CMRA (as opposed to a able to individuals over the Internet and mailing re- U.S. Postal Service post of- Internet sparked another sponses several weeks later. fice box or a regular com- privacy furor. When the mercial or residential story broke on April 7, address). Mail not comply- 1997, SSA initially de- ing with this rule would not fended the online disclosure 90 be delivered. The regulation of PEBES, which had begun See, “SSA Pulls Plug on Web Page Offering Americans’ Earnings,” Pri- was designed to help pre- approximately a month be- vacy Times, Evan Hendricks, ed., Vol. vent the use of CMRAs as a fore, as a way to provide the 17, No. 8 (April 17, 1997) pp. 1-2.

Page 34 Report of the National Task Force on Privacy, Technology and Criminal Justice Information — Other indications of the negotiate contractual arrange- will result in two sets of privacy importance of privacy ments that satisfy the terms of protections in the United States, concerns: The Euro- the Directive or otherwise meet one for information pertaining pean Union Data Pro- specific exceptions or tests (for to citizens of the EU and a sec- tection Directive, example, consent of the data ond, lower, standard for Ameri- omnibus proposals in subject; important public inter- cans. the United States, and est test; protection of the vital self-regulatory initia- interests of the data subject; or Omnibus legislation tives public information test).93 The EU Directive and growing The European Union Data The U.S. Department of Com- public concern over information Protection Directive merce spearheaded the Clinton privacy is also evidenced in a Administration’s efforts to reach growing trend at the State level: The European Union (EU) en- an understanding with the EU the active consideration of om- acted the “Directive on the Pro- regarding the Directive’s impact nibus privacy legislation. tection of Individuals with on transfers of personal data · In California, for example, Regard to the Processing of Per- from the EU to the United State Senator Steve Peace sonal Data and on the Free States. In July 2000, the Com- (D-El Cajon) introduced Movement of Such Data” (the merce Department and the Senate Bill 129, “The Per- Directive)91 in 1995, and it be- European Commission finalized sonal Information and Pri- came effective on October 25, and formalized the “Safe Har- vacy Act of 1999,” which, 1998. The Directive is a com- bor” agreement, after years of as originally introduced, prehensive, omnibus privacy negotiations and several public would have prohibited the measure that regulates the proc- discussion drafts. collection, use, and disclo- essing of personal data. sure of any type of person- Although the Safe Harbor ac- ally identifiable information The Directive places restrictions cord explicitly states that it is without the consent of the on the export of personal data to not intended to have applicabil- individual subject. countries outside the EU that are ity beyond international trade, deemed to lack “adequate” pri- the Directive and the Safe Har- — The original bill also vacy protections.92 European bor process are having an im- would have required or- Union officials do not believe pact on the domestic privacy ganizations to inform the United States has “ade- debate in the United States. It is individuals how and quate” privacy protections; too soon to determine the extent what type of informa- therefore, U.S. companies of the impact; however, at least tion is collected and the wishing to move personal data two factors are at work. First, purposes for which it is across borders from EU coun- the Directive and the Safe Har- used; the types of orga- tries to the United States have to bor discussions have generated nizations to which the information is dis- considerable media coverage, closed; and the choices 91Directive 95/46/EC. further raising the profile of pri- and means the organi- 92Under Article 2 of the Directive, vacy issues in the United States. “personal data” are broadly defined to Second, the Directive has in- zation offers to limit the include: “[A]ny information relating to creased the pressure on the use and disclosure of an identified or identifiable natural United States to strengthen its the information. person (‘data subject’); an identifiable privacy laws. Privacy advocates, — The final version of the person is one who can be identified, directly or indirectly, in particular by for example, have questioned bill, which was signed reference to an identification number or whether the Safe Harbor accord into law by Governor to one or more factors specific to his Gray Davis in Septem- physical, physiological, mental, eco- ber 2000, was more nomic, cultural or social identity.” 93 Directive, Article 26.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 35 limited in scope than advocacy group, and legislative who are aggrieved by a viola- the original bill, creat- and international scrutiny, and tion of these self-regulatory ing a privacy ombuds- in part because consumers in- guidelines.96 man with various creasingly expect companies to responsibilities, in- provide adequate privacy, the cluding, among others, private sector has launched sev- The Information Culture accepting complaints eral efforts to develop and im- about organizations plement voluntary privacy There is a considerable and from private citizens. guidelines. The Individual Ref- growing public demand for a The bill also imposes erence Services Group (IRSG), wide array of information, in- certain requirements on a trade association for compa- cluding criminal justice infor- State agencies.94 nies that sell identification and mation. This demand is fueled location information products, by, and also fuels, technological · Similar efforts, while ulti- has developed a set of self- advances that make it possible mately largely unsuccessful, regulatory principles for their to gather and store increasingly were undertaken during the member companies.95 In another larger amounts of information 1999-2000 legislative ses- example, the Online Privacy from an increasingly larger sion in both Massachusetts Alliance has developed cross- number of sources, in ever and New York. The Massa- sectoral privacy guidelines for faster, more reliable, and more chusetts legislation, with the companies that obtain personal efficient ways. Information, in- support of then-Governor information about consumers cluding criminal justice infor- Paul Cellucci and then- arising from online/e-commerce mation, also frequently marries Lieutenant Governor (now activity. BBBOnline and traditional text with a variety of Governor) Jane Swift, TRUSTe have developed pri- nontext formats including audio, would have addressed a vacy “seals” to be displayed by video, and digital imaging. wide range of privacy issues Internet sites adhering to certain ranging from how retailers privacy standards. As a practical matter, the pub- and marketers handled per- lic’s exposure to criminal justice sonal information to sur- These self-regulatory programs information was, for the most veillance of employees in and others require or encourage part, once confined to personal the workplace. In New companies to provide consum- experience, media reports, and York, a package of over a ers with notice about a com- mugshots posted in the local dozen bills designed to pany’s information and privacy post office. Today, large seg- safeguard the personal in- practices; a degree of choice in ments of the public expect to be formation of consumers, how much information the con- able to use criminal justice in- rather than a single bill, sumer wishes to provide or formation about individuals to were introduced with the whether the consumer wishes to better inform themselves about support of Assembly provide any information at all; others, including their neighbors Speaker Sheldon Silver (D- some access and correction and their caregivers.97 In addi- Manhattan) and Attorney rights; data quality protections; General Eliot Spitzer. security protections; and confi- 96A comparison of the privacy pro- dentiality safeguards. Increas- Self-regulatory initiatives tections provided by leading self- ingly, these voluntary programs regulatory codes, certain Federal pri- also provide for verification of vacy laws, and the Federal justice in- Finally, in part as a result of the company compliance and some formation system privacy regulations pressure generated by media, (DOJ regulations) are included as Ap- type of remedy for consumers pendix 3. 97Approximately 90% of the public 94 Codified at CAL. BUS. & PROF. would allow some access to conviction 95 CODE §§ 350-352 and CAL. GOV’T The IRSG is discussed in further records by potential employers, while CODE § 11019.9. detail in infra, p. 60. 38% would favor access by individuals

Page 36 Report of the National Task Force on Privacy, Technology and Criminal Justice Information tion, information, including This shift in attitudes is apparent merely created what amounted criminal justice information, is in the activities of business, to an automated “file cabinet.” increasingly searchable and ac- government, and individuals Whoever owned the automated cessible through the Internet or and applies not only to criminal file cabinet had responsibility other electronic means. justice information, but also to for managing the system; as a information sectors throughout practical matter, the “owner” The process builds upon itself. the economy. “If the shift to an enjoyed substantial discretion in Technological advances make information society means any- setting rules for the collection, information available to the thing, it means thinking about retention, use, and disclosure of public in a new, more efficient information as one of the most information maintained in that way. Then, as the public be- important resources in soci- automated file cabinet. Today’s comes acclimated to the new ety.”99 Businesses increasingly powerful and nimble informa- technology, it comes to expect seek to gather information about tion systems, however, facilitate the benefits and comes to an- their customers, storing this in- a far different environment. Us- ticipate and expect new ad- formation electronically in “data ers can access information from vances that will build further warehouses” where it can be remote locations and from mul- upon this technology, making retrieved later for analysis for tiple databases. In doing so, us- even more information more purposes ranging from inven- ers can create their own readily available. The public tory control to targeted market- multidimensional, cross- increasingly expects informa- ing. Government, including the sectoral, customized, personal tion on demand and expects in- courts, criminal justice agencies, information reports. Today, creasingly sophisticated and noncriminal justice agen- those who maintain these data- databases and search engines to cies, increasingly views per- bases are less able to control assist them in meeting their sonal information as a means to how information in them are needs. This includes, but is not improve decisionmaking in ar- used. With the ability to draw limited to, criminal justice in- eas ranging from child support and assemble information from formation. Members of the pub- enforcement, immigration con- the various databases, informa- lic, while concerned about trol, and gun control, to bail de- tion users may be able to create protecting their own privacy, cisions. customized, comprehensive in- expect to be able to access information products for use in formation to protect themselves The Task Force views this move various settings. and their children from risks toward an “Information Cul- that may be posed by offenders ture” as an important factor in These customized reports could and others. As one commentator criminal justice information include a mix of criminal justice observed: “Given a choice be- policy. and noncriminal justice infor- tween privacy and accountabil- mation about an individual. ity, all of us can be relied upon These reports could support to choose privacy for ourselves Changes in technology criminal justice applications, but and accountability for every- could also be deployed in non- body else.”98 Computers have been used to criminal justice settings. The capture and manage criminal evolution of these types of per- justice information since at least sonal reports will be influenced the late 1960s. Until recently, and shaped by current and fu- wanting to learn if a neighbor has a however, computerized criminal ture law governing information criminal record. Privacy Survey Report, justice information systems collection, use, and disclosure. supra note 4, p. 5. 98Chris Gaither, “Big Brother is Your 99James Boyle, Shamans, Software, This information management Friend,” Wired News (September 20, and Spleens: Law and the Construction revolution is occurring contem- 1999) (quoting science fiction author of the Information Society (Boston: poraneously with a revolution in David Brin). Harvard University Press, 1996) p. 174.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 37 identification technology — the potential to obtain juvenile its forms of application such as DNA, livescan, and justice information, combined and accepted capabili- Automated Fingerprint Identifi- with information about educa- ties and the strands of cation Systems — that gives tional background, financial the web are altered. users the potential not only for a status, medical information, Sometimes the strands richer, customized information immigration, and citizenship open fairly widely to product, but also for a product status is certain to ignite a new accommodate new with a much higher degree of privacy debate about who forms of technological reliability and integrity (that is, should get access to this kind of use; sometimes, they an assurance the information information; for what purposes; hold fairly firm to block truly relates to the person who is and subject to what privacy certain uses of the tech- the intended subject of the in- safeguards and restrictions. nology or substantially quiry). alter its application.”100 It is a cliché to say we are living The Internet is a dramatic and in the “Information Age” or in The strands of the “steel web,” new feature on the information an “information society” or that representing the way informa- landscape. The Internet is an we are in the midst of an “In- tion is viewed by society, are inexpensive and relatively user- formation Revolution.” Never- being reshaped by the new in- friendly technology, which not theless, it is undeniable that formation technologies. only provides robust informa- technological advances in com- tion management capabilities, puting and communications are One of the most significant but also does so on a real-time, significantly impacting the way technologies that has been communications platform. Fur- in which information is viewed making its way through the thermore, the Internet creates by the public, by the courts and “steel web” of society is the remarkable opportunities for criminal justice agencies, and by computer. Today, the computer national and international publi- government agencies generally. is a central fixture in American cation — and remarkable risks life. Computers are used for to privacy. Recently, several One way to conceptualize the everything from word process- States have placed all or parts of manner in which technology is ing, to data storage, to inventory their sexual offender databases received and integrated by soci- control at supermarkets, to ad- on the Internet. A few States, ety is to think of a new technol- vanced mathematical research. including Texas and Washing- ogy as a physical object moving The centrality of computers is ton, make conviction informa- into a steel web representing just as applicable in the criminal tion available over the Internet. society’s existing rules and ar- justice recordkeeping arena. As rangements. recently as 1986, the then- These information technology Director of the Federal Bureau advances hold enormous prom- “Technology never of Prisons was able to refer to ise for criminal justice users and breaks through this so- computers as “the ultimate authorized, noncriminal justice cial web, which is an status symbol.”101 Today, in users to obtain comprehensive, extremely dense inter- reliable, and customized infor- twining of economic, 100Alan F. Westin, preface to Donald mation about individuals on a legal, organizational, A. Marchand, The Politics of Privacy, near-instantaneous basis. These social, and cultural con- Computers, and Criminal Justice Re- advances, however, also create straints. Rather, a new cords: Controlling the Social Costs of or, at a minimum, exacerbate technology makes a Technological Change (Arlington, Va.: Information Resources Press, 1980) p. privacy risks. The online avail- slow and gradual pas- vi. Hereafter, The Politics of Privacy. ability of an individual’s crimi- sage through the web. 101Norman A. Carlson, “The Federal nal history and criminal justice In the process, both the Bureau of Prisons and Data Quality,” in record information, along with technology is shaped in Data Quality Policies and Procedures: Proceedings of a BJS/SEARCH Con-

Page 38 Report of the National Task Force on Privacy, Technology and Criminal Justice Information contrast, it is the rarest of office — the nondiscoverability — In addition to the time involved, worker who is without a com- that once protected the privacy there were additional costs, puter on his or her desktop. In of an individual’s criminal jus- which could be significant, for addition, advances in computing tice information, not by any in- copying the records. Thus, and telecommunications tech- tentional design, but because while the records technically nologies have acclimated the there was a “lack of will, time, were open to the public, ac- public to automatic teller ma- or energy” to obtain it. cessing the information imposed chines, credit cards, electronic transaction costs that had the commerce over the Internet, and Court records and police blotter effect of limiting public access. a host of other innovations that information, for example, tradi- depend on the ready transfer of tionally have been public docu- Advances in technology, how- information. ments available (with the ever, are eliminating these bar- exception of certain sealed re- riers to access and the de facto Increases in the speed of com- cords) to anyone who went to privacy protections that they puters and communications the courthouse to view them. In once afforded to those with ar- technologies are also having an the past, this imposed a number rest or conviction records. effect. While speed “for its own of barriers and “transaction Courts and police departments sake is hardly impressive,” it “is costs” on someone seeking to are automating their records, important because is allows men obtain arrest or conviction in- and many are making this in- to do things they otherwise formation: formation available in an elec- would not have done, for lack of tronic format on a wholesale · First, it was necessary to will, time, or energy. The de- basis. Thus, in doing so, they know in which of the Na- velopment of computers signi- permit private companies to as- tion’s thousands of courts or fies not just an increase in the semble databases of criminal police stations to look for speed of calculation, but offers justice information that include the record. as well a quantum leap in the information from jurisdictions amount and kinds of things that · Second, it was necessary to across the country — “one-stop can be done within a human actually go to the court- shopping” for criminal justice framework.”102 house or police station information. Some States go (which might be across the further. Texas and Washington, This ability to do things that street or across the country) for example, make conviction otherwise would not have been to view the records. information (and some arrest done due to “lack of will, time, · Third, it took time to deter- information) available to the or energy” has important impli- mine if the court or police public over the Internet. As of cations for the privacy of crimi- station had a record. May 1999, 15 States allow the nal justice information. public to access sex offender Technological innovations have · Fourth, it took time for po- databases over the Internet as removed (and are removing) lice or court staff to retrieve well.103 These databases allow many of the de facto protections the record.

· Fifth, if there was a record, 103 Devron B. Adams, Update 1999: further research might be Summary of State Sex Offender Regis- ference, NCJ 101849 (Washington, try Dissemination Procedures, Fact D.C.: U.S. Department of Justice, Bu- necessary elsewhere to de- Sheet series, NCJ 177620 (Washington, reau of Justice Statistics, November termine whether the case D.C.: U.S. Department of Justice, Bu- 1986) p. 46. Hereafter, Data Quality was prosecuted, or how the reau of Justice Statistics, August 1999). Policies and Procedures. case was resolved on ap- In addition to the 15 States that grant 102 Marchand, The Politics of Privacy, peal. public access to searchable sex of- supra note 100, p. 10 (quoting Kenneth fender databases via the Internet, 10 C. Laudon, Computers and Bureau- States have Internet sites that are either cratic Reform (New York: Wiley, accessible only to law enforcement or 1974) p. 6). are limited information about the reg-

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 39 the public to search not only by theories of negligent hiring if debate as to whether we should name, but also by geographic they hire an individual without reexamine our approach to location, such as ZIP code, so conducting a background check “public record information.”108 that it is possible to identify sex and the individual then commits In 1998, Congress, recognizing offenders in a neighborhood, an on-the-job crime.105 Increas- the vital role criminal justice whether the party conducting ingly, State and Federal statu- information, identification, and the search knows their names or tory law authorizes State central communication technologies not. repositories to disclose CHRI must play, enacted the Crime for background checks for posi- Identification Technology Act of With the reduction of the tions involving financial respon- 1998 (CITA).109 CITA author- “transaction costs” for such in- sibility or for the interaction izes $1.25 billion over 5 years quiries, it is possible to conduct with potentially vulnerable for grants to the States to up- background checks in an in- populations, such as children grade criminal justice and creased number of circum- and the elderly.106 criminal history record systems; stances and by a wider number improve criminal justice identi- of people. Background checks, It has been said the “strains that fication; promote the compati- while once largely the province technology places on our values bility and integration of of licensing boards, banks, secu- and beliefs, finally are reflected national, State, and local sys- rities firms, and government in economic, political, and tems for a variety of purposes; agencies screening for sensitive ideological conflict. That is, and capture information for sta- national security positions, are they raise questions about the tistical and research purposes to now possible (or even required) proper goals of society and the for a much larger, and continu- proper ways of pursuing those ally growing, roster of positions, goals.”107 That is true of the way including bus drivers, school in which the Information janitors, daycare workers, nurs- Revolution is affecting the col- 108While court records and other ing home workers, volunteer lection, use, and disclosure of original records of entry have traditionally been publicly available, not all coaches, and Boy Scout troop criminal justice information. information held by the Federal and 104 leaders. In the case of sex of- The fact that technology has State governments is publicly available. fender registries, there need not reduced the transaction costs CHRI contained in the State reposito- be an employment or volunteer involved in accessing criminal ries, for example, is only available for relationship at all. justice information, removing certain purposes in many, although not all, States. In addition, the Federal traditional de facto barriers that Privacy Act, Freedom of Information This trend is reflected not only once created protections, raises Act, and other Federal and State laws in the increasing commercial difficult questions about the restrict public access to a variety of sale of such information but also proper use of criminal justice information held by government agen- in the law. Employers may be information in this new envi- cies, including sensitive personal in- found liable under common law ronment, including spawning a formation, such as tax returns and health information. In May 1998, President Clinton issued an order to the istry itself rather than individual of- heads of executive departments and 105 fenders; 5 States without Internet sites See, infra, p. 53 (more public ac- agencies to review their compliance are planning to develop them, and the cess/demand). with the Federal Privacy Act to account remaining 20 States and the District of 106See, infra, p. 61 (Federal and State for changes in technology. See, Wil- Columbia report having no sex of- initiatives). liam Jefferson Clinton, “Memorandum fender registry site on the Internet and 107 Marchand, The Politics of Privacy, for the Heads of Executive Depart- provided no information as to whether supra note 100, p. 15 (quoting Em- ments and Agencies. Subject: Privacy one was planned. Ibid. manuel G. Mesthene, “The Role of and Personal Information in Federal 104See, for example, Valerie Strauss, Technology in Society” in Technology Records,” (May 14, 1998). “Ackerman Orders Volunteer Screen- and Man’s Future, Albert H. Teich, ed. 109Pub. L. No. 105-251, §§ 101-102 ing,” Washington Post (October 8, (New York: St. Martin’s Press, 1972) (October 9, 1998), 112 Stat. 1871 (to be 1999) pp. B1, B4. p. 148). codified at 42 U.S.C. § 14601).

Page 40 Report of the National Task Force on Privacy, Technology and Criminal Justice Information improve the administration of of the criminal justice commu- amounts of information are ac- criminal justice.110 nity, but now also to the small- cumulated and available to be est.112 Where the criminal justice searched on the basis of a mul- The areas identified in CITA are community’s exposure to the titude of discrete selection crite- reflective of a re-shaping of computer was once limited to ria. Today, it is possible to criminal justice information en- mainframes maintained by the gather and store large amounts vironment. The important theme FBI and central State reposito- of data about data subjects and of CITA — the integration of ries, today computers can be to enrich that data with infor- State, Federal, and local sys- found in even the smallest of mation obtained from outside tems, so that the criminal justice local police departments and in sources to create detailed infor- information systems will be patrol cars as well. mation profiles about individu- compatible — is discussed in als. It is also possible to search detail later in this report. Technological advances have those profiles to identify files on made computers smaller, faster, the basis of almost any common — Information and capable of storing ever- characteristic. Although it once technologies increasing amounts of data in may have been possible to seemingly ever-decreasing search a database using only an The importance of information amounts of space. Disk drive individual’s name or identifica- technologies in the collection, capacity now doubles at least tion number, for example, today organization, and dissemination once a year and, according to databases can be searched using of information, including crimi- experts, this time frame is addresses, telephone numbers, nal history information, can shrinking significantly.113 The or even random words. In addi- hardly be overstated. The in- ready availability of computers tion, data-matching programs creased power, utility, and af- at all levels of law enforcement, permit the comparison of multi- fordability of computer power as well as society at large, has ple databases for overlapping have revolutionized the way spurred advances in computer data. information is handled in the programming and data retrieval, United States. making it possible for users to This was, of course, not always customize systems to meet their the case. The criminal history In recent years, the price of own institutional needs. record system, while predating computer memory and other the computer, is a relatively new hardware has decreased,111 This increased programming innovation. At the beginning of making computers accessible and search flexibility, in turn, the 20th century there was not only to the largest members has supported the creation of hardly such a thing as a criminal “data warehouses” where large history record, let alone a crimi- 110Pub. L. No. 105-251, §§ 102(a), nal history record system.114 In (e). 1924, criminal history record- 112 111Owen M. Greenspan, et. al., Report While the cost of memory and keeping and fingerprinting took other computer hardware has declined, of the National Task Force on Court a step forward when Congress Automation and Integration, NCJ technology costs incurred by courts and 177601 (Washington, D.C.: U.S. De- criminal justice agencies may not have directed the FBI to create an partment of Justice, Bureau of Justice declined overall. Agencies have shifted “identification division” to ac- Assistance, June 1999) p. 24. Hereafter, from an environment where there was quire, maintain, and use finger- Task Force on Court Automation. “In only a mainframe, or perhaps no com- print information.115 This new puters at all, to the current environment 1975 an IBM mainframe cost approxi- identification division began mately $10 million and provided 10 where there must be a computer of million instructions per second (MIPS), some sort at practically every worksta- or about $1 million per MIPS. In 1998, tion. In addition, as the volume of users a Pentium® personal computer cost and workstations increase, the need for 114 approximately $2,500 and provided technical support has also increased. “Use and Management of CHRI, roughly 300 MIPS, at a cost of $6-$10 113Task Force on Court Automation, supra note 22, p. 20. per MIPS.” Ibid., at n. 26. supra note 111, p. 35. 115Ibid. p. 21.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 41 with 800,000 fingerprints ob- repositories by the courts and systems, particularly in high- tained from various sources, and law enforcement agencies. Until volume jurisdictions.119 maintained on manual finger- recently, the automation of ar- print cards.116 Over the suc- rest and disposition reporting to — Identification ceeding years, the FBI State repositories has lagged technologies accumulated paper fingerprint behind the automation of disclo- cards and information files by sures from the State repositories Means of identification the millions. Each individual’s in response to inquiries from file was fingerprint-supported law enforcement and the courts. Technological advances have and also retrievable by name or Increasingly, however, com- had a profound impact on iden- FBI number.117 These records puter technology is being used tification capabilities. People occupied huge warehouses and to automate the reporting proc- are identifiable in many ways, required armies of clerks to ess, thereby speeding the re- including name, Social Security maintain and update. porting process and saving number, or other account num- resources.118 ber, and by physical character- By the 1960s, the early com- istics. With the exception of puter brought the first move- Historically, arrest information physical characteristics, all of ment toward the automation to has been reported to the reposi- these identification methods are criminal history records. The tories and the FBI on fingerprint inherently unreliable in the expense of early computers re- cards that also included space criminal justice context. Names stricted their use to only the for textual information about the can be shared by many people largest institutional players, record subject. State law fre- and Social Security numbers such as the FBI. Computers quently requires that cards for can be falsified; this makes reli- proliferated slowly to include reportable offenses be submitted ance on such names and num- State repositories and the largest within 24-48 hours of arrest or bers unreliable in many of police departments. These “promptly” or “without undue instances, which opens the door early systems, however, were delay.” However, even if these to fraud, mistake, and abuse. little more than automated file laws are complied with, mail Physical characteristics, called cabinets, with manual input re- delays and normal data proc- “biometric identifiers,” are quirements and limited retrieval essing resulted in a delay of a unique characteristics for pur- capabilities. Automated systems week or more from the date of poses of personal identifica- were used for new entrants into arrest until the information was tion.120 Examples of biometric the criminal justice system, entered into the repository sys- identifiers include fingerprint- while records on offenders tems. Increased automation at ing, DNA, retinal scanning, whose records pre-dated the the local level and direct com- voice spectrography, and hand inauguration of the computer puter-to-computer transmissions geometry scanning.121 Although system were still maintained in now create the potential for real- biometric identification is a the traditional paper format. time transmission of data from the local law enforcement 119Ibid., p. 44. In addition to changing the agency to the State repository. 120Robert R. Belair and Robert L. manner in which State reposito- The same is true of disposition Marx, Legal and Policy Issues Relating ries organize and maintain reporting information from the to Biometric Identification Technolo- criminal justice information, courts, which is increasingly gies (Sacramento: SEARCH Group, Inc., 1990) p. 1. Hereafter, Biometric advances in information tech- automated with the advent of Identification Technologies. nologies have affected the way automated case management 121Ibid. There are many other poten- information is reported to the tial biometric identifiers including, for example, vein prints, poroscopy (pore prints), cheiloscopy (lip prints), 116 Ibid. otoscopy (ear prints), dentition prints, 117Ibid., p. 22. 118Ibid., p. 43. and sweat prints. Ibid., pp. 39-42.

Page 42 Report of the National Task Force on Privacy, Technology and Criminal Justice Information more reliable means of personal not without potential privacy come from criminal matters.125 identification, virtually none of and accuracy problems. First, Outside the criminal justice set- the identification documents name-only checks can result in ting, fingerprints are also the used in the United States is sup- multiple hits for individuals most widely used and recog- ported by biometric identifi- with common names, such as nized means of biometric identi- ers.122 John Smith. Second, as noted fication. Children are frequently previously in discussing tradi- fingerprinted. In addition, job Identification cards are the most tional identification documents, applicants and applicants for common form of identification falsification is a problem. If an many types of licenses are fin- device. In recent years, efforts individual assumes a false iden- gerprinted, not only as a means have been made to reduce the tity (identity fraud is an in- of identification, but also to fa- ability to falsify or counterfeit creasingly common crime), it is cilitate reliable criminal back- identification documents and to possible that the identity in ground checks. increase their utility to law en- question is that of a real person, forcement. Some of these not an identity that was simply In the criminal justice context, changes simply involve the use made up by the applicant.123 If Automated Fingerprint Identifi- of inks and other materials that this is true, and the applicant cation Systems (AFIS), which are more difficult to alter or commits a crime, it could lead first emerged in the late 1960s, counterfeit. Other innovations to the issuance of an arrest war- are an example of the power of include MICR lines or magnetic rant and other problems for an information technology ad- strips, which contain identifica- innocent person. vances.126 In an early AFIS, tion information and are more manual fingerprint records were difficult to tamper with than Fingerprinting scanned into a computer system, paper identification. It is also converted into digital records, possible to include digitized Fingerprinting is the best-known and stored. In order to search fingerprints and other biometric and most widely used means of the AFIS database, the finger- identifiers on the magnetic strip biometric identification. At- print that is the subject of the or in an embedded chip, to fur- tempts to use fingerprints for search was digitized and com- ther enhance reliability. These identification purposes, while pared to the existing fingerprints magnetic strips, as well as bar first the subject of scientific in- already digitized and on file. If codes, can also be “swiped” or quiry in the 17th century, can be the system made a potential “scanned” through reading de- traced back to ancient China and match, a fingerprint examiner vices by law enforcement to Egypt.124 Today, fingerprinting compared the fingerprints and quickly access the stored data. is a critical tool for law en- made an actual identification forcement efforts to solve crime determination. This technology Biometric identifiers are used in and fingerprinting criminal sus- was complemented in the 1980s the criminal justice field not pects is commonplace. The FBI, by the emergence of automated, only to link suspects to crime for example, receives approxi- direct-read fingerprint devices. scenes, but also as a reliable mately 50,000 fingerprints per Direct-read fingerprint devices means of verifying identity for day, about one-half of which take an inkless photograph of an background checks. There is increasing pressure, however, to 125 move to a name-only identifica- Vicki Smith, “FBI Touts Finger- print Database: Says Police Will Get ID tion regime to produce both 123In addition to the use of biometric and History within Two Hours,” The faster and less-expensive back- identification, information products, Associated Press (August 10, 1999), ground checks. Such a move to frequently drawing from information available at http://www name-only checks, however, is contained in public records, can also .abcnews.go.com/sections/us assist in detecting identity fraud. /dailynews/fbi990810.html. 124Biometric Identification Technolo- 126Biometric Identification Technolo- 122Ibid. gies, supra note 120, p. 13. gies, supra note 120, p. 2.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 43 individual’s finger or thumb and staff. This means law enforce- level, the fingerprint data and convert that fingerprint or ment can conduct “cold any relevant textual data will be thumbprint into a digital record. searches” (that is, searches transmitted electronically to the These inkless photographs take where there are no suspects or FBI for processing and the FBI, only seconds to produce and leads, other than fingerprints in turn, will electronically result in a clearer image than the found at the scene).130 Another transmit a response to the local traditional method of “rolling” result of AFIS is an increasing booking station. It is estimated the finger on a fingerprint card demand from law enforcement the entire process can be com- to create an inked impression.127 to expand the pool of finger- pleted in 2 hours or less, per- prints on file and accessible to mitting local law enforcement to The impact of AFIS, further an AFIS, thereby increasing the identify prior offenders and fu- enhanced by the increased effi- possibility of a match. Some gitives, even if they have pro- ciency and clarity of direct-read criminal justice sources have vided false identification technology, has been substan- argued in favor of expanding information, prior to their initial tial. In San Francisco, for exam- AFIS systems to include juve- bail hearing or release from ple, prior to AFIS, police made nile fingerprints.131 Other po- booking.132 approximately 60 identifications tential expansions of source of crime scene prints each year records for AFIS searches in- Retinal scans, voice spectro- by manually searching finger- clude child fingerprinting pro- graphy, and hand geometry print files.128 In slightly less than grams, fingerprints taken for 4 years from San Francisco’s professional licensing, finger- While fingerprinting is, by far, implementation of an AFIS, prints taken for security clear- the best known and most widely police had searched over 12,000 ance applications, and used biometric identifier, there crime scene fingerprints and employment background are other techniques, although made 2,500 criminal identifica- checks, to name a few. they are more likely to be used tions, a dramatic increase.129 for controlling an individual’s The FBI launched the next gen- access to information or loca- Potential privacy concerns also eration of AFIS technology in tions than for criminal investi- result from the increased effi- July 1999: the Integrated Auto- gations. Retinal scans record the ciency brought by this new in- mated Fingerprint Identification unique vasculature (blood ves- formation technology. Although System (IAFIS). Under IAFIS, sels) in the fundus, or posterior fingerprint searches used to be a fingerprint images (rather than orbit of the eye. In voice spec- time-consuming process, today traditional fingerprint cards) trography, a spectrograph pro- large databanks can be searched will be taken at local law en- duces a graphic representation in a very short time and with forcement agencies by livescan of the sound emitted by a hu- little or no additional effort by or cardscan equipment, proc- man voice. Hand geometry sys- essed by a local AFIS, and then tems, another means of transmitted electronically to the biometric identification, meas- 127Ibid. The appendix to the 1990 re- State repository for processing. ure characteristics, including port contains a detailed and technical If a positive identification is not finger lengths, finger density, analysis of AFIS. made at either the State or local hand width, the silhouette of the 128Ken Moses, “Maintaining and Us- entire hand, a profile view of the ing Juvenile Fingerprints,” in Juvenile knuckles and back of the hand, and Adult Records: One System, One 130U.S. Congress, Office of Technol- Record? Proceedings of a ogy Assessment, Criminal Justice, New and skin translucency. These BJS/SEARCH Conference, NCJ 114947 Technologies, and the Constitution, results can then be digitized and (Washington, D.C.: U.S. Department of Special Report, OTA-CIT-366 (Wash- Justice, Bureau of Justice Statistics, ington, D.C.: U.S. Government Printing January 1990) p. 50. Hereafter, Juve- Office, May 1988) p. 19. nile and Adult Records. 131Moses, Juvenile and Adult Re- 132Use and Management of CHRI, 129Ibid. cords, supra note 128, p. 51. supra note 22, p. 47.

Page 44 Report of the National Task Force on Privacy, Technology and Criminal Justice Information stored for future identifica- its stock as an identifier has other purpose for which the tion.133 risen. A 1990 SEARCH report sample was originally col- on biometric identifiers recog- lected). Privacy issues also arise DNA testing nized the potential of DNA from the retention of the under- testing as “enormous.”136 Poli- lying biological sample (rather Although fingerprinting is the cymakers have agreed, with than the digitized results of traditional and most widespread State after State (led by the DNA identification analysis), method of biometric identifica- General Assembly of Virginia because the biological sample tion, with a long pedigree and in 1988) establishing DNA could be analyzed subsequently years of public acceptance in the testing laboratories and data- for disease traits or other pur- criminal justice system, Deoxy- bases. poses beyond the original iden- ribonucleic Acid (DNA) testing tification purpose for which the is a newer and, in many ways, As with fingerprinting, DNA sample was collected.138 more versatile, biometric identi- testing is not an effective means fication innovation. DNA is of identification unless there is Civil libertarians are particularly unique among biometric identi- an identified sample to compare concerned about the privacy fiers: unlike fingerprints and with the unidentified DNA. risks posed by DNA databases. other biometric identifiers, Standards for collecting and Barry Steinhardt of the ACLU, DNA can reveal more about an maintaining these samples raise when asked to comment on ef- individual than simply his or her civil liberties and privacy con- forts to perfect a chip that could identity. This fact therefore cerns. The potential uses of be used to quickly produce a raises unique privacy concerns. DNA beyond identification raise unique genetic profile from DNA has been called “the single additional concerns because, DNA discovered at a crime greatest advance in the search unlike fingerprints, DNA can be scene, expressed the concern for truth since advent of cross- used to identify familial rela- this way: “Anything that makes examination.”134 That comment tionships as well as potential it easier and cheaper to create a was made in 1988, shortly after genetic defects or a genetic dis- DNA databank is dangerous the first time DNA testing was position for disease.137 The in- because it will increase the im- used, in a 1987 British case information privacy concept of petus to DNA test… . We don’t volving the rape and murder of minimizing the information oppose specific technologies, two young girls.135 collected and retained about an but what we are concerned individual to that which is nec- about is the creation of the data- Since then, DNA has exploded essary to the task can be put at banks.”139 onto the public scene, not only risk unless DNA testing systems for its vast potential as an iden- are carefully designed to capture tification and crime-solving only the information necessary tool, but also as the key to ad- for identification purposes (or 138Destruction of the underlying sam- vances in medicine and cloning. ples has been “met with harsh criticism from law enforcement representatives,” In the dozen years since DNA 136Ibid., p. 26. arguing that by destroying the samples was first used to solve a crime, 137Despite the identification benefits, law enforcement would, as one official put it, “be destined to start over every there is some public apprehension about being voluntarily tested. In Flor- time there’s a technological change.” 133SEARCH Group, Inc., “Biometric ida, for example, a free DNA- Declan McCullagh, “What to do with Technologies are Promising for Crimi- identification pilot program for school DNA Data?” Wired News (November nal Justice,” Interface (Spring 1991) p. children was not well received, despite 18, 1999) available at http://www 33. the fact that parents, not the State, .wired.com/news/politics 134 Biometric Identification Technolo- would receive and control the sample. /0,1283,32617,00.html. gies, supra note 120, p. 27 (quoting a Jeffrey McMurray, “Florida Police 139Robin Lloyd, “Lab on a Chip May 1988 comment by New York State Find Mystery in Parents’ Snub of DNA Turn Police Into DNA Detectives,” Judge Joseph Harris). Testing,” Washington Post (March 14, Washington Post (March 1, 1999) p. 135Ibid. 1999) p. A22. A9.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 45 States are building DNA data- — Communication tween repositories and law en- bases, typically by requiring technologies, including forcement, and with other felons, particularly those con- the Internet criminal justice agencies. Then- victed of violent crimes, to Senate Minority Leader Thomas submit DNA samples to the The communications Daschle (D-SD) summarized the State database. In December revolution importance of improved com- 1998, then-New York City Po- munications this way: “Revolu- lice Commissioner Howard The third area in which ad- tionary technological Safir recommended that DNA vances are generating both improvements in communica- samples be taken of all arres- benefits to criminal justice and tions systems allow localities tees, declaring “The innocents risks to privacy is communica- separated by great distances to have nothing to fear… . Only if tions technology. The past dec- share information instantane- you are guilty should you worry ade has witnessed an explosion ously. This communication about DNA testing.”140 Safir’s of new technologies that allow between law enforcement agen- proposal has been adamantly people (and systems) to com- cies can make the difference opposed by the New York Civil municate faster, easier, and between locating suspects and Liberties Union, which argues from more locations than ever getting them off the streets, or that mere arrest is insufficient before.143 These changes are leaving them free to commit grounds for collection of a DNA affecting the way criminal jus- more crimes.”144 sample.141 This debate is also tice information is communi- taking place on the national cated between various criminal Information distribution is no level, as the Federal government record repositories, between the longer tied to a fixed distribu- considers whether to develop courts and the repositories, be- tion point, such as where a tele- such a comprehensive DNA phone wire has been run. database. The National Com- Laptop computers outfitted with mission on the Future of DNA the Attorney General Regarding Ar- wireless communications pack- Evidence, which was appointed restee DNA Sample Collection,” avail- ages now permit law enforce- able at http://www.ojp.usdoj.gov by the Attorney General to /nij/dna/arrestrc.html. Some States ment officers to access a wide study issues related to the evi- are moving forward with additional array of Federal, State, and local dentiary use of DNA, has con- testing. New York State, for example, databases from remote loca- cluded that the practice is passed a law in 1999 increasing the tions, without the assistance of currently impractical due to a number of offenses with a DNA sample dispatchers.145 requirement upon conviction from 21 lack of staffing and other re- to 107, a change the Governor esti- sources in crime laboratories mated would increase the number of Electronic mail, or “email,” is nationwide and a backlog of samples collected in New York each another part of the communica- samples currently awaiting year from 3,000 to 30,000. Gary tions revolution. Data can now analysis.142 Tuchman, “New York to expand DNA be transmitted around the world testing of convicts,” CNN (October 20, almost instantly. Users can send 1999) available at http://www.cnn 140“DNA Samples in All Arrests?” .com/US/9910/20/dna.database one another not only directly Washington Post (December 15, 1998) /index.html. p. A16. The International Association 143These developments can be attrib- of Chiefs of Police has also called for uted, at least in part, to the explosion in the collection of DNA samples from all competition between telecommunica- 144 arrestees. J.D. Abolins, “International tions companies as a result of deregu- 144 Cong. Rec. S3,943 (April 30, Police Group Wants DNA Sample lation. Another factor in this arena is 1998) (statement of Senator Tom From ALL Suspects,” 2 ISPI Privacy the growing competition between tele- Daschle, D-SD). Reporter (Summer 1999). communications companies, cable sys- 145Kelly J. Harris, Law Enforcement 141Ibid., Post article, p. A16. tem operators, and Internet Service Mobile Computing: Armed with Infor- 142National Institute of Justice, “Rec- Providers as applications of these tech- mation, Technical Bulletin series (Sac- ommendation of the National Commis- nologies become increasingly interre- ramento: SEARCH Group, Inc., 1997, sion on the Future of DNA Evidence to lated. No. 1) p. 1.

Page 46 Report of the National Task Force on Privacy, Technology and Criminal Justice Information keyed-in messages, but also at- users to access and disseminate and officers can access NCIC tach files, thereby allowing po- information. When information through the State law enforce- tentially privacy-sensitive is transferred between systems ment network. In July 1999, the information to be externally over the Internet or other nonse- FBI inaugurated the next gen- distributed in a matter of key- cure means, there is added po- eration of the NCIC — a project strokes. Communications ad- tential that the transmission known as “NCIC 2000.” NCIC vances also make it increasingly would be intercepted. Encryp- 2000 upgrades the NCIC’s tele- possible for systems to share tion is one means to protect the communications system and its larger volumes of data elec- confidentiality of information at hardware to permit the paperless tronically and to do so at faster risk of being intercepted by an exchange of information. In ad- rates. In addition, while data unauthorized party. Encryption dition, NCIC 2000 is able to was once primarily processed in is the “transformation of plain- handle graphic information in text format, it is increasingly text into an apparently less paperless imaging format, in- possible to easily transmit, readable form (called cipher- cluding material such as mug process, store, and integrate text) through a mathematical shots, tattoos, and the signatures audio, video, and digital data, process. The ciphertext may be of offenders.147 creating a richer and more com- read by anyone who has the key plete data environment. that decrypts (undoes the en- The National Law Enforcement cryption of) the ciphertext.”146 Telecommunications System Increased speed and high- (NLETS) is a high-speed mes- quality fiber-optic networks al- Federal and interstate com- sage system maintained by the low such tasks as automated munications systems: Na- States through a not-for-profit arrest and disposition reporting tional Crime Information corporation. NLETS permits the to take place more quickly and Center, National Law En- interstate exchange of criminal easily than before. It also per- forcement Telecommunica- justice information between lo- mits larger quantities of data to tions System, and other cal, State, and Federal criminal be transferred from one com- resources justice agencies. NLETS sup- puter system to another because ports inquiries into a variety of data entry (by keystroke or The National Crime Information State files, including criminal scanning) now only needs to be Center (NCIC) is an automated history files, motor vehicle reg- done once, thereby relieving database of criminal justice and istration files, driver’s license “downstream” recipients of the justice-related information files, and other databases main- need to determine whether some maintained by the FBI, includ- tained by the States. NLETS of the data received is of enough ing “hot files” of missing or also interfaces with the NCIC, value to make the data entries. wanted persons, stolen vehicles, the Royal Canadian Mounted and identifiable stolen property. Police, the National Insurance The widespread maintenance Communications components of Theft Bureau, the National and dissemination of informa- the NCIC permit access to Center for Missing and Ex- tion in electronic form has NCIC files through central con- ploited Children, and other na- raised a host of concerns about trol terminal operators in each tional-level files.148 how to best protect the confi- State that are connected to the dentiality, accuracy, and integ- NCIC via dedicated telephone Among the funding priorities rity of information in electronic lines maintained by the FBI. designated in CITA are multi- form. This is typically accom- Local law enforcement agencies agency, multijurisdictional plished through a combination communications systems among of physical, administrative, and 146RSA Laboratories, “Frequently 147 technical measures designed to Asked Questions About Today’s Federal Bureau of Investigation, control access to data and to Cryptography: Glossary,” available at Press Release, July 15, 1999. control the ability of authorized http://www.rsasecurity 148Use and Management of CHRI, .com/rsalabs/faq/B.html. supra note 22, p. xi.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 47 the States to share routine and users in 1998 was approxi- matters, including burglary, emergency information among mately 47 million.151 It is esti- theft, and vandalism.154 Federal, State, and local law mated that, as of September enforcement agencies. “A 1997 2000, nearly 148 million As of May 1999, 15 States have incident along the Vermont and Americans had access to the posted sex offender and sexual New Hampshire border under- Internet, over 89 million of predator registration informa- scored the need for multi- whom were active users.152 This tion from State sex offender jurisdictional systems. During a explosive growth has caught registries on the Internet in a cross-border shooting spree that everyone’s attention. The public format accessible to and search- left four people dead, including is “surfing” the Internet in large able by the public.155 These sites two New Hampshire State and increasing numbers, busi- commonly include the of- Troopers, Vermont and New ness is enthralled by the promise fender’s name, address, vital Hampshire officers were forced of electronic commerce, and statistics, offense (sometimes to park two police cruisers next Congress and the State legisla- including case number), and to one another to coordinate tures are paying close attention sometimes a photograph as activities between Federal, to developments to determine well.156 These sites allow indi- State, and local law enforcement what legislation is necessary to viduals to search by name or officers because the two States’ regulate everything from Inter- geographic area (typically city, police radios could not commu- net privacy to Internet decency county, or ZIP code).157 States nicate with one another.”149 As a to Internet taxation. are not the only ones to sponsor result of this incident, officials sex offender sites on the Inter- from Vermont, New York, New The Internet is a growing means net. Local police also maintain Hampshire, and Maine have for law enforcement to interact sex-offender sites either on their developed the “Northern with the public and a valuable own or in concert with local Lights” proposal, which would research tool. The FBI and other newspapers.158 allow these northern-border law enforcement organizations, States to “integrate their law such as the Los Angeles Police enforcement communications Department, post their “most 154See, for example, http:// systems to better coordinate in- wanted” lists on the Internet.153 www.cji.net/sierraso/index .html (Office of the Sheriff of Sierra terdiction efforts and share in- Other law enforcement agencies County, California); and http:// 150 telligence data.” allow citizens to use the Internet www.placer.ca.gov/sheriff/ (Sheriff’s to make anonymous tips, report Department of Placer County, Califor- The Internet nonemergency crimes, and file nia). initial police reports in certain 155See, supra note 103. Perhaps the most important 156See, for example, technological development un- http://www.dps.state.ak.us derpinning the need for a reas- /nSorcr/asp/ (Alaska); sessment of the privacy http://www.fdle.state.fl.us 151About.com, Internet Industry, /Sexual_Predators/index.asp (Flor- landscape — the Internet — is “How many people use the Internet?” ida); http://www.state.in actually a by-product of the (August 1, 1999), available at .us/serv/cji_sor (Indiana); other advances in communica- http://internet.about.com http://www.ink.org/public tions and information technol- /industry/internet/library /kbi/kbiregoffpage.html (Kansas); ogy already discussed. The /archivebl/stats/blstats2a http://sex-offender .htm. .vsp.state.va.us/cool-ICE/ (Virginia); number of American Internet 152Nielsen//Netratings, “Average Web and http://www Usage, September 2000,” available at .statetroopers.com/sexoff

Page 48 Report of the National Task Force on Privacy, Technology and Criminal Justice Information In addition to interacting with systems to mean, “the electronic different components of the the public, law enforcement is sharing of information by two or criminal justice system on a also using the Internet to inter- more distinct justice entities particular level — the State po- act with fellow law enforcement within a system. The degree to lice system, the State court sys- officers and to do law enforce- which information systems are tem, the State prosecutors’ ment work. Internet sites such considered ‘integrated’ depends system, and so forth. Indeed, as www.officer.com and upon who participates, what local and municipal agencies www.leolinks.com provide law information is shared or ex- have been leaders in pioneering enforcement officers with ac- changed, and how data are horizontal integration. cess to a wide array of informa- shared or exchanged within the tion on everything from hate system.”159 Information exchanged groups and terrorism, to computer crime, traffic enforcement, It is also important to under- The information exchanged by statutes, other law enforcement stand what integration is not. integrated systems varies. organizations, police unions, Integration is not the mere link- “Some systems may include and educational and training age or connection of distributed only adult criminal justice data, opportunities. or dispersed databases. Nor is whereas others may include ju- integration the amalgamation of venile, family, domestic rela- private data in a particular in- tions, and social service data. Trend toward integrated formation system. Some systems may address all systems operating requirements, such as Participants … revenue management sys- Traditionally, each of the four tems, whereas others may limit components of the criminal jus- Participation in integrated sys- the database to case manage- tice system — law enforcement, tems can occur in three principal ment information requirements. prosecutors, courts, and correc- configurations: vertical integra- However, ‘information’ is in- tions — maintained a discrete tion of criminal justice users, creasingly more than just raw information system designed to horizontal integration of crimi- data elements: it may include meet that component’s particu- nal justice users, and the inte- images, audio, video, substance lar information needs. There gration of criminal and abuse test results, DNA profiles, was little, if any, linkage be- noncriminal justice databases. and fingerprint minutiae.”160 tween these systems, and certainly no system architecture Vertical integration refers to the Method of information that provided one system for all linkage of systems operated by exchange components. In recent years, the same type of criminal justice however, the criminal justice organization at various levels of The underlying technology of system has worked toward inte- government; city police systems an integrated system may also grating these systems, using a are linked with county police vary. Information may be ex- multipurpose architecture. systems that are linked with changed through a common da- State police systems, which are tabase that is shared by — Definition of integration linked with Federal systems, participating agencies. Informa- and so forth. Horizontal inte- tion may also be shared by a The BJA/SEARCH National gration refers to the linkage of coordinated system, with data Task Force on Court Automa- maintained in separate databases tion and Integration defines in- and exchanged via standardized 159Task Force on Court Automation, tegration of justice information supra note 111, p. 2. Although some messages. In addition, hybrid members of the Privacy Task Force systems exist, which allow believed that this definition was too http://oakparkjournal.com narrow, the Task Force used this defi- /sexoffend-op.htm (Oak Park, Illinois). nition as the basis of its discussions. 160Ibid., p. 3.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 49 agencies to maintain separate Integration, however, also poses utility to law enforcement, cor- databases while using a central privacy risks. First, there is the rections, prosecutors, and the database that controls the level potential that integrated systems courts, “function creep” be- of access afforded to different may propagate inaccuracy if the comes a real possibility and pri- users in the system.161 data are entered incorrectly in vacy concern. How widely the first instance. Second, an should the information in these — Benefits and privacy integrated system may make integrated systems should be risks of integration sensitive data about an individ- made available is a key ques- ual, which is important to one tion. Access by law enforce- Integration has numerous bene- part of the criminal justice sys- ment, courts, prosecutors, and fits. Integration may reduce la- tem, readily available to other corrections are common sug- bor costs and operating parts of the system, where that gestions. Should the list be ex- expenses by eliminating the information is not necessary or panded to include the defense need for agencies to undertake useful to the needs of that insti- bar or the public defender’s of- duplicative data entry and col- tutional player. The corrections fice? What about access for lection, eliminating the need to system, for example, gathers those outside the system, such maintain duplicate records, and large amounts of detailed in- as child support enforcement increasing efficiency. Further- formation concerning the lives and welfare agencies? more, the data in an integrated of inmates over the course of system may be more accurate their incarceration. An inmate’s A fourth privacy risk arises because it was only entered correction record might include when information subject to once. The information may also breaches of discipline and restrict rules in one sector is cap- be available on a more timely sulting disciplinary action; in- tured by an integrated system basis because information col- formation about sexual activity; operating in a more accommo- lected early in the process is sensitive medical information, dating privacy environment. available for later processes such as HIV status; drug use Data coming from the privacy- even before those later proc- and rehabilitation information; sensitive central repository envi- esses begin. This information mental health information; and ronment, for example, may be availability can improve the per- educational or employment in- captured in an integrated system formance of the courts and formation. Although this may be subject to the relatively privacy- criminal justice agencies, and important information for the lenient environment in the thereby improve public safety. corrections facility where the courts. This raises a question as Finally, and perhaps most im- inmate is held, it is not neces- to which privacy rules apply to portantly, data may be more sarily relevant to law enforce- information in an integrated complete because the responsi- ment officials or others with system. Do the standards for the bility for collecting and report- access to the integrated system. integrated system reflect the ing each data element is firmly policies of the most privacy- fixed with a particular agency.162 A third privacy risk arising from protective participating agency, integration is that there will be the least privacy-protective, or more information and increasing is a new privacy standard devel- 161Ibid. demands for its use. As systems oped for the integrated system? 162Ibid., p. 29. For a more extensive are integrated, the data in those Or, in the alternative, do privacy discussion of the benefits of integra- systems become richer and, rules vary depending upon the tion, see, ibid., pp. 29-34. See also, therefore, more valuable to a source of the information or the Robert L. Marx, System Integration: wider pool of potential users. purposes for which the infor- Issues Surrounding Integration of County-Level Justice Information Sys- Although a system may have mation is accessed? tems, NCJ 156841 (Washington, D.C.: been integrated to increase its U.S. Department of Justice, Bureau of Justice Assistance, November 1996) p. 29.

Page 50 Report of the National Task Force on Privacy, Technology and Criminal Justice Information A new approach that in a quick, accurate, and effi- economics of the drug trade — closely resembles a cient manner. The importance of separating the buyer from the “Business Model” for the information to the new criminal seller.166 This “separation” of criminal justice system justice model has been de- buyer and seller is accomplished scribed this way: by marches through, and vigils at, locations believed to be ven- In recent years, there has been a The new age of com- ues where drug dealing occurs. shift in the way courts and munity justice is made These activities are designed to criminal justice agencies view possible by the power spotlight venues where drug their mission. Increasingly, of information. Using trafficking occurs and discour- agencies focus on their interac- geo-coded data, crime age buyers who fear public ex- tion with the public and seek to control services are or- posure. Turn Around America accomplish their missions ganized around loca- views positive relations and in- through active crime prevention tions of crime events, formation-sharing with law en- efforts in addition to the more offenders, and victims. forcement as an important traditional approach of reacting Data, both official data element of their ability to suc- to crimes once they occur. In about crimes and of- ceed.167 Much of the building of addition to the well-known fenders and qualitative positive relations between such “community policing” model, data that come from in- community groups and the po- there “are literally hundreds of teraction with offenders, lice can be achieved without the examples of this trend, from victims, and neighbor- disclosure of personal informa- offender-victim reconciliation hood residents, drive tion. Although Turn Around projects in Vermont and Min- problem-solving and America claims to have drasti- neapolis to ‘beat probation’ in action. Information will cally lowered crime in areas it Madison, Wisconsin; from also provide evaluative neighborhood-based prosecution feedback about the suc- centers in Portland, Oregon, and cesses of strategies. The New York City, to community imaginative use (and 163 probation in Massachusetts.” production of informa- 166See, http://www These programs come in a vari- tion) is one of the fac- .drugfighters.com. ety of forms; the term “commu- tors that sets aggressive 167As noted in an article about the nity courts,” for example, community safety Turn Around effort in Waxahachie, Texas, “The relationship between the encompasses a wide range of strategies apart from the specialized courts, including: community and police depends on trust, more mundane concept shared information, cooperation, sup- teen courts, drug courts, misde- of the local constable.165 port, mutual respect and social interac- meanor courts, and family tion. If you try this approach in your 164 courts. A number of community orga- community, make every effort to keep law enforcement officials aware of nizations throughout the Nation These programs rely, in part, on your group’s concerns, goals and ac- use the information-sharing as- tivities. Ask that a representative from the ability to exchange informa- pects of community policing to the police attend each of your planning tion with the community about fight crime in their communi- sessions. Make certain they understand crimes, suspects, and criminals ties. Turn Around America, for that your intentions are to enhance and example, mobilizes neighbor- not replace the role of law enforcement within the community. Look at contact hoods in an effort to stop drug with local police as an education that 163 Todd R. Cleary and David R. Karp, trafficking. The group, which is will ultimately benefit everyone.” Na- “The Community Justice Movement,” led by neighbors in conjunction than Bickerstaff, “Community Anti- in Community Justice: An Emerging with law enforcement and oth- Drug Group Development Shows Field, David R. Karp, ed. (New York: ers, is designed to address the Community and Police Teamwork,” Rowman & Littlefield, 1998) p. 3. available at http://www Hereafter, Community Justice. .communitypolicing.org 164Ibid., p. 9. 165Ibid., p. 18. /artbytop/w4/w4bicker.htm.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 51 has targeted,168 civil liberties which specializes in misde- education program” that pro- organizations, such as the meanor cases, is one example. vides instruction in core sub- ACLU, have criticized the “Contained in one building, the jects as well as self-discipline, group’s practices as harassment Midtown Community Court supervision, and counseling.173 and an invasion of privacy of makes concrete use of a social individuals who have not been services center, a community Other examples of these charged with a crime.169 Con- service program, community changes, including the publica- cern has also been raised over mediation services, and a so- tion of sex offender information, the propriety of law enforce- phisticated information network reporting of child protection ment organizations sharing in- that tracks and relays cases as orders, and expanded disclosure formation about suspected drug they travel between depart- of CHRI for background checks traffickers with these groups.170 ments.”171 in the employment and firearms purchasing contexts, are dis- In addition to more community This kind of interactivity and cussed at length elsewhere in interaction, courts and criminal accountability often means that this report. One Task Force justice agencies are interacting CHRI is being widely shared by member characterized these new with one another and noncrimi- criminal justice agencies, not information flows as a “data- nal justice agencies in new ways only with other law enforcement driven, problem solving ap- to process offenders, rehabilitate agencies, but also with social proach” to crime and other so- offenders, and prevent future welfare agencies, educational cial problems. These crimes. Criminal justice agen- institutions, and the public. mechanisms are designed with cies and the courts frequently These new relationships and prevention in mind: prevention recognize new obligations that initiatives are increasing the of sex offenses, of child abuse make them responsible to, amount and expanding the and endangerment, of poor hir- and/or dependent upon, other scope of recipients of criminal ing decisions that could endan- agencies. The Midtown Com- history information. ger people and create liability munity Court in Manhattan, for employers, and of firearms In Texas, for example, law en- purchases by those whom soci- forcement agencies, prosecu- ety deems a risk. 168Turn Around America cites the tors, and probation officers are following statistics: “The … process required to notify the school Another distinct development is has proven effective all over the country with all types of communities in district where a student is be- the privatization or outsourcing ridding neighborhoods of drug traf- lieved to be enrolled of the stu- of criminal justice information ficking and drastically lowering crime dent’s arrest for designated functions. Privatization intro- and violence, for example: Taylor, offenses. In addition, the school duces a new player into the in- Texas, 80% crime reduction in targeted district must be apprised of formation equation — often a area; Waxahachie, Texas, 93% clearance for major crime cases; East Palo whether the matter is prosecuted private, for-profit company or Alto, California, 86% drop in crime; or adjudicated, as well as the service bureau. Private con- and Red Oak, Georgia, 98% drop in final disposition of the matter.172 tractors, however, can be con- 911 calls.” See, This information may serve as tractually bound to observe the http://www.drugfighters.com. the basis for the transfer of that same standards that are applica- 169See, Victoria Loe, “ACLU Scruti- student from the general student ble to government agencies. nizing Effort by Authorities to Shame population into an “alternative Drug Dealers” Dallas Morning News (July 2, 1996) p. 1A; John Moritz, In September 1999, the U.S. “Morales Backs Disclosure of Drug 171Community Justice, supra note DOJ published a final rule House Locations; Anti-Drug Activists 163, p. 9. amending its regulations to Want Addresses to Put Pressure on 172TEX. CRIM. PROC. CODE § 15.27. permit the criminal justice Dealers, Customers,” Ft. Worth Star- This article imposes certain confidenti- Telegram (December 24, 1996) p. 2. ality requirements on the school district 170Ibid. personnel receiving the information. 173TEX. EDUC. CODE § 37.008.

Page 52 Report of the National Task Force on Privacy, Technology and Criminal Justice Information agencies, subject to certain con- targets of vigilantism and physi- In one instance, a Kansas family trols, to grant private entities cally harmed.177 Another risk is was subjected to scorn, and access to CHRI for the purpose that offenders will lose their rocks thrown at their mobile of providing services for the jobs. In September 1999, Ore- home, after local officials administration of criminal jus- gon voluntarily placed its plans posted notices that a sex of- tice.174 Criminal justice agencies to provide public access to sex fender lived at their address. In will be required to include a offender registry information reality, the sex offender had security addendum approved by over the Internet on hold pend- lived at the address previously the Director of the FBI to their ing an ACLU-assisted lawsuit, and moved without notifying agreements with the private- in which 10 sex offenders each authorities.180 sector contractor to “authorize claimed that “[i]f his name, access to CHRI, limit the use of photograph, and identity is the information to the specific broadcast over the Internet as a More public access, purposes for which it is being sex offender, he will readily and demand for criminal justice provided, ensure the security immediately lose his employ- records and confidentiality of the infor- ment.” 178 Accuracy of registry mation consistent with applica- information is also a concern.179 Beginning in the late 1970s, ble laws and regulations, policymakers grew increasingly provide for sanctions, and con- interested in capturing, main- 177 tain such other provisions as the Examples of vigilantism against taining, and sharing criminal sex offender registrants reported by the Director of the FBI (acting for ACLU include the firebombing of a justice and criminal history re- the Attorney General) may re- registrant’s car in California, the beat- cord information and grew less quire.”175 The regulations also ing of a man believed to be a paroled interested in providing privacy authorize criminal justice agen- sex offender in New Jersey, and the safeguards for arrestees and of- cies to outsource certain dis- destruction of the homes of registrants fenders. During this same pe- in New Jersey and Washington by ar- patching, data processing, and son. ACLU, “Names Removed From riod, as noted earlier, the information service functions to Missouri Sex Offender List,” Press Supreme Court found that in- other government agencies pur- Release (August 27, 1997), available at formation about arrests and suant to executive order, statute, http://aclu.org/news/n082897a.html. convictions relates to public regulation, or interagency 178Robert Ellis Smith, “In the Courts: events and is, therefore, not agreement.176 Sex Offenders,” Privacy Journal Vol. subject to constitutional privacy 25, No. 11 (September 1999) p. 7. protections.181 The result, The new prevention model 179Accuracy concerns, of course, are throughout the 1980s and 1990s, poses potential privacy risks. not limited to sex offender registries. was a steady expansion of Inaccurate criminal justice information Sex offender registries, for ex- can have serious repercussions for the statutory and regulatory provi- ample, have been criticized by individual, including loss of employ- sions permitting the use and civil libertarians on numerous ment. A Maryland woman, for exam- disclosure of CHRI. grounds, including the potential ple, reportedly lost her job as a child- harm to registrants from the care director at a Maryland YMCA, Today, criminal justice and when, during a background check, her public disclosure of their status name and Social Security number erro- criminal history record infor- as registrants. One potential risk neously appeared during a search of a mation is available from State is that registrants may be the Baltimore County computer in connec- central repositories not only for tion with four child protective services criminal justice purposes, but cases. Although Baltimore County family services later acknowledged and corrected the error, the woman was not 180 reinstated by the YMCA. Evan Hen- Robert Ellis Smith, “Inevitable,” 17464 Federal Register 52223 (Sep- dricks, “Maryland Woman Victimized Privacy Journal, Vol. 23, No. 7 (May tember 28, 1999). by Inaccurate Criminal Data,” Privacy 1997) p. 4. 175 Ibid., at 52223 – 52224. Times, Vol. 17, No. 23 (December 15, 181See, for example, Paul v. Davis, 176Ibid., at 52224. 1997) pp. 9-10. 424 U.S. 693, 713 (1976).

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 53 also for a wide variety of non- conducting a background check, of cases, a pizza delivery chain criminal justice purposes which would have revealed the reportedly paid a total of authorized by law or regulation. aide had six larceny-related $375,000 to settle two lawsuits In particular, these purposes convictions, and that he did not by parents of young boys who include employment back- have the education or work ex- were allegedly molested by a ground screening, licensing eli- perience stated on his employ- pizza delivery man who, un- gibility checks, and a wide array ment application.183 Several known to the pizza company, of noncriminal justice, govern- months later, the employee had a prior record for burglary mental purposes. murdered a 32-year-old quadri- and grand theft.186 In addition to plegic man in his care and the the employer liability question, Demand continues to grow. This man’s 77-year-old grandmother, these cases also raise policy is particularly true of employers allegedly in order to cover up questions about the reintegration and volunteer organizations, ongoing theft from the man. The of convicted persons into soci- such as the Boy Scouts, which man’s parents sued, alleging ety after their sentence is com- increasingly seek access to that the company was negligent plete, and if background checks CHRI for pre-employment in allowing a convicted felon to are expected not only of persons background checks. There are care for their son. A jury found in sensitive positions, but also two driving forces behind this for the parents and awarded of those in positions tradition- increased demand for access: $26.5 million in punitive and ally viewed as being less sensi- (1) a desire to make informed compensatory damages.184 tive, such as pizza delivery hiring decisions that assess the persons.187 potential risk prospective em- Negligent hiring cases are not ployees may pose to the hiring limited to positions that are It is a rare legislative cycle, organization, its employees, or typically viewed as being sensi- however, that does not see the its clients; and (2) a desire to tive either because of the trust enactment of new State laws minimize potential legal expo- the position requires or the vul- authorizing access to criminal sure that could result from hir- nerable nature of the population history information for non- ing individuals without served. A jury held a Florida criminal justice purposes, either conducting a criminal history furniture store that did not con- for specified noncriminal justice check. duct a background check liable users or the public at large. Un- for $2.5 million in damages for like some negligent hiring cases, The potential for both harm to a person who was assaulted by a however, most legislative individuals and resulting em- store employee with a prior authorizations focus on posi- ployer liability is illustrated by criminal record.185 In another set tions that involve a particular recent negligent hiring cases.182 In one instance, a home health 183See, Ward v. Trusted Health, No. 94-4297 (Suffolk Super. Ct., Mass. prior to being hired as a full-time deliv- care company in Boston hired a eryman, the furniture store also failed home health care aide without February 1999). See also, Mayer & Riser, PLLC, “Worker Murders Man to conduct a job interview, request and His Grandmother: Employer Liable references, or request that the man complete an application form. Ibid. 182Under the tort of negligent hiring, for Negligent Hiring,” available at 186 an employer can be held liable for http://www.mayer See, Employment Data Services, wrongful acts of an employee if the -riser.com/Articles/ap “Negligent Hiring the New ‘Entitle- wrongful act was a cause-in-fact of the /liability/neghiring0599.htm. ment,’” available at http://users plaintiff's injury, provided that the fail- 184Ibid. .javanet.com/~empdata /negligent.html. ure of the employer to exercise due 185See, Tallahassee Furniture Co. v. 187 care in the hiring, training, or supervi- Harrison, 583 So.2d 744 (4 Fla. App. In addition to concerns about rein- sion of the employee was a cause-in- 1991), rev. denied 595 So.2d 558 (Fla. tegrating the former offender into soci- fact of the act of the employee who 1992). In addition to failing to conduct ety, there is also the related risk that the caused the injury. See, for example, a background check on the man, who former offender will be unable to ob- Miller v. Wal-Mart Stores, Inc., 580 worked for the company’s owner as a tain gainful employment and will be N.W.2d 233 (1998). part-time laborer for several months consigned to a permanent underclass.

Page 54 Report of the National Task Force on Privacy, Technology and Criminal Justice Information trust or regular interaction with these repositories were by non- the State repositories, not local vulnerable populations, such as criminal justice agencies.189 law enforcement.192 the sick, the elderly, and chil- As long ago as 1981, a dren.188 In the 105th Congress, BJS/SEARCH report, Privacy A 1998 survey determined that for example, the Senate held and the Private Employer, rec- approximately 35% of the fin- hearings on the need for access ognized that increased access to gerprint cards submitted by the to criminal history data for criminal history information, States to the FBI and processed nursing home workers; the particularly for employment during fiscal year 1997 were for Congress enacted legislation purposes, was a nascent trend. noncriminal justice purposes.193 strengthening the National At that time, however, there was The survey found that in eight Child Protection Act, which little data regarding the number States — Delaware, Florida, authorizes background checks of criminal history information Idaho, Massachusetts, Nevada, for employees providing serv- requests made to criminal jus- New Jersey, Oregon, and ices to children, the elderly, and tice agencies by private em- Washington — and the District the handicapped; and the Con- ployers.190 The report of Columbia, the number of re- gress amended the Fair Credit recognized that one means by quests for noncriminal justice Reporting Act to permit con- which employers could obtain purposes exceed the number of sumer reports to include con- criminal history information requests made for criminal jus- viction information, regardless about applicants — in addition tice purposes.194 A similar 1993 of how long ago the conviction to asking the applicant directly study found that only approxi- occurred. or using a third party such as a mately 9% of the fingerprint consumer-reporting agency — cards the FBI received from the The FBI has reported that the was “to request the data directly States that year were for non- number of criminal history re- from criminal justice agencies, criminal justice purposes, with cord access requests it receives usually local police depart- no States submitting more non- from noncriminal justice re- ments.”191 The role of local po- criminal justice requests than questers now exceeds the num- lice departments was criminal justice requests.195 ber of requests from criminal highlighted in the report, which justice. Noncriminal justice re- noted that many State statutes There are several State law pat- quests include not only private regulating the disclosure of terns and similarities in the employers, but also other gov- criminal history information treatment of criminal history ernment agencies not associated regulated only disclosures by record dissemination for non- with the criminal justice system. criminal justice purposes. Most An Office of Technology As- States treat conviction informa- sessment (OTA) survey in 1979 tion and open-arrest information of criminal history record sys- less than 1 year old (arrests with 189Gary R. Cooper and Robert R. Be- tem managers in 35 States found lair, Privacy and the Private Employer, no record of disposition) differ- 20.6 percent of the total number Criminal Justice Information Policy ently from nonconviction in- of access requests received by series (Washington, D.C.: U.S. De- formation. Typically, States partment of Justice, Bureau of Justice place few or no restrictions on Statistics, 1981) p. 14 (citing An As- the dissemination of conviction sessment of the Social Impacts of NCIC 188Other policy considerations are the records, and a number of States and CCH, prepared by the Bureau of basis for permitting access to non- Governmental Research and Service, do not place restrictions on criminal justice users. Manufacturers, University of South Carolina, for the open-arrest information less distributors, and dispensers of con- U.S. Congress’ Office of Technology trolled substances are prohibited from Assessment (1979) p. 227). Hereafter, hiring individuals convicted of felonies 192 Privacy and the Private Employer. Ibid., pp. 34-35. related to controlled substances, and are 193 190 Compendium, supra note 60, p. 8. expected to screen employees in other Privacy and the Private Employer, 194 circumstances. See, 21 C.F.R. §§ p. 14. Ibid. 1301.76, 1301.90, 1301.93. 191Ibid. 195Ibid, pp. 8-9.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 55 than 1 year old. Nonconviction Some States authorize the use of This trend, spurred primarily by records are restricted to a conviction information for any public reaction to high-profile greater degree, with dissemina- occupational licensing or em- abductions, rapes, and murders tion frequently limited to speci- ployment purpose, while other of young children, is discussed fied types of noncriminal justice States limit authorization for in more detail in the subsequent users for specified purposes.196 background checks using con- discussion of Federal legislation The different approaches reflect viction and, particularly, non- in this chapter. the fact that the widespread dis- conviction information to semination of nonconviction applicants for specific high-risk The growing number of users information makes it more diffi- occupations, such as child care, authorized to access CHRI for cult for an innocent arrestee to sensitive government positions, various purposes is one that the be reintegrated into society.197 elder care, care of the disabled, Task Force expects will con- Finally, the widespread report- health care, banking, firefight- tinue to grow. ing and dissemination of non- ers, and police.199 Similarly, the conviction data may exacerbate “Bible Rider” authorized the the potentially disproportionate FBI to exchange conviction in- Changes in the adverse impact of the criminal formation with officials of fed- marketplace: Growing justice system on minority erally chartered or insured commercialization of populations.198 banking institutions and certain records as private segments of the securities in- companies sell criminal dustry and with nuclear power justice records compiled plants.200 from public record information Another area where the States are authorizing access to CHRI, — The changing 196State statutes vary in their level of detail. Many States rely upon executive or even actively disclosing the marketplace orders, regulations, and written and information, relates to sex of- unwritten repository policies to sup- fenders. As noted earlier, 15 In the last few years a new mar- plement and elaborate on their statutes. States now post sex offender ketplace has emerged to meet Ibid., p. 8. registration information on the the burgeoning noncriminal jus- 197A Maryland woman, for example, Internet. Other States, such as tice demand for criminal history is reported to have lost her job running New York and California, offer data and to take advantage of a daycare center at a military housing complex because a background check a “900 number” for citizens to changes in information technol- revealed that the woman was arrested call to find out if an individual ogy. Today, private companies for burglary and assault. According to is a registered sex offender.201 routinely “harvest” public re- reports, the woman had been errone- cord information, including ar- ously arrested in 1985. Her superiors 199Compendium, supra note 60, p. 9. rest and conviction information, subsequently acknowledged that there from newly automated court was a discrepancy, but did not offer to 200This measure is popularly referred rehire her. See, supra note 179. to as the “Bible Rider” because it was dockets and, to a lesser extent, 202 198See, supra note 47. See also, Mi- originally sponsored by then-Senator police blotter systems. These chael A. Fletcher, “Criminal Justice Alan Bible (D-NV), who attached the authorization for such exchanges of Disparities Cited,” Washington Post 202Court records contain far more in- information as a rider to an appropria- (May 4, 2000) p. A2; Leadership Con- formation than simply indexes of tions bill. Regulations have since been ference on Civil Rights and Leadership charges leveled against a criminal de- published at 28 C.F.R. § 50.12. Conference Education Fund, Justice on fendant and the disposition of those 201 Trial: Racial Disparities in the Crimi- Robert Teir and Kevin Coy, “Ap- charges. Criminal court records may nal Justice System (Washington, D.C.: proaches to Sexual Predators: Commu- also include transcripts of preliminary May 4, 2000), available at http://www nity Notification and Civil hearings and court proceedings, voir .civilrights.org/policy_and Commitment,” 23 New England Jour- dire information, exhibits submitted _legislation/pl_issues nal on Criminal and Civil Confinement into evidence, deposition information, /criminal_justice/. (Summer 1997) pp. 405, 409, n. 18. motions and pleadings, and other in-

Page 56 Report of the National Task Force on Privacy, Technology and Criminal Justice Information companies then sell the criminal main, these records were main- tion obtained from public record history profiles to employers, tained on a court-by-court basis, sources, for example, is used for insurers, and other noncriminal and were organized either preventing fraud; promoting justice users. In addition, indi- chronologically or by docket child support enforcement; lo- vidual reference services “pro- number, or by name, sometimes cating witnesses for civil and vide critical assistance to with a date of birth in an index criminal cases, and missing Federal, State, and local gov- available to the public. In addi- children, heirs, and beneficiar- ernment agencies to carry out tion, these records were manual, ies; protecting consumers from their law enforcement and other paper-boxed records requiring a unqualified “professionals” or missions.”203 Further, these researcher to travel to the court potential predators; locating and companies or their customers to physically access and inspect apprehending individuals elud- may merge criminal record in- the records. All of this had the ing law enforcement; supporting formation with an individual’s practical impact of limiting the media research; and increasing education, employment history, accessibility of these records to the ease with which the public credit history, and other records, those who had reason to believe can access public records.205 as well as with putative data to that a particular individual had create informal but, nonetheless, appeared in a particular court at Privacy in the Information Age powerful and comprehensive a particular time, and had the (Washington, D.C.: Brookings Institu- reports. resources and motivation to tion Press, 1997) pp. 66-68. Some State conduct this kind of a search. constitutional provisions, such as Arti- Although court records have cle 1, Section 1 of the California Con- always been in the public do- The automation of court records stitution, have been interpreted to apply and, to a lesser extent, of police to both the public and private sector. The California Supreme Court has held formation generated as a case advances blotters and the emergence of that a plaintiff alleging an invasion of through the criminal justice system. companies that harvest and dis- privacy in violation of the State con- These records can easily include sensi- seminate arrest and conviction stitutional right to privacy must estab- tive personal information about the records have changed the crimi- lish “(1) a legally protected privacy defendants, victims, and witnesses in a nal justice information privacy interest; (2) a reasonable expectation of particular case. This information can be privacy in the circumstances; and (3) generated not only as paper records, but landscape. These companies, conduct by the defendant constituting a also in the form of computer-aided frequently referred to as “indi- serious invasion of privacy.” Even if transcription, videotaped depositions, vidual reference services com- the plaintiff proves all three of these and in some jurisdictions, televised panies,” gather not only CHRI, elements, the defendant has an affirma- trials. Court systems are increasingly tive defense if the invasion of privacy aware of the sensitive nature of the but also other types of personal and public record information. “substantially furthers one or more information contained in court records. countervailing interests” and the plain- In Washington, for example, the State The companies make this in- tiff is unable to show there are “feasible Judicial Information System Commit- formation available to corporate and effective alternatives to [the] de- tee is conducting public meetings and professional users, as well fendant’s conduct which have a lesser around the State to discuss the impacts as government agencies and impact on privacy interests.” Hill v. and effectiveness of its data dissemina- individuals. National Collegiate Athletic Associa- tion policy as part of its review of the tion, 865 P.2d 633, 657 (Cal. 1994). To policy. “The policy review will focus date, however, application of these on the major issues that the requests for This information, compiled State constitutional privacy protections information have raised over the last from a variety of sources, can be has not resulted in significant informa- four years and will revisit the extent to used for a wide range of pur- tion privacy protections beyond those which compiled information on indi- derived from the U.S. Constitution. viduals needs protection.” See, “Data poses, which may or may not be regulated by statute.204 Informa- Cate, Privacy in the Information Age, Dissemination Policy Review,” avail- p. 68. able at www.courts.wa.gov 205Piper & Marbury, L.L.P., White /datadis/policy.cfm. 204Over a dozen State constitutions Paper: Individual Reference Services 203 Federal Trade Commission, Indi- contain language protecting personal (Washington, D.C.: Individual Refer- vidual Reference Services: A Report to privacy rights, usually from govern- ences Services Group, December 1997) Congress (December 1997) p. 9. ment interference. See, Fred H. Cate, p. 2. Hereafter, IRSG White Paper,

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 57 One member of the IRSG , the required); and a “Federal crimi- from child kidnappers to bank Online Professional Electronic nal court record report” for ac- robbers to jewel thieves.212 Network (OPEN), for example, tions in the Nation’s 94 Federal makes a relatively comprehen- District Courts.208 Typically, — The Fair Credit sive criminal arrest and convic- county record searches are Reporting Act tion record search product completed within two business available to its business and pro- days, Federal court searches The Fair Credit Reporting Act fessional subscribers that within three business days, and of 1970 (FCRA), as amended, “searches millions of online ar- State repository requests “usu- regulates the use of CHRI by rest records submitted by county ally take considerably longer … consumer-reporting agencies for jail facilities from an every- the turn around varies by employment, credit, and certain growing [sic] number of States. State.”209 This vendor accepts other purposes.213 Consumer- Arrest record data includes orders via a toll-free telephone reporting agencies are organiza- booking time, inmate ID, ar- number; other companies selling tions that, for a fee or on a co- resting agency and charge code background checks permit or- operative, nonprofit basis, are in with description. Also available dering online.210 the practice of assembling or through this search is the ability evaluating personally identifi- to place orders for on-site In addition to the commercial able information obtained from searches for conviction infor- sale of CHRI to the public, a third parties and bearing upon a mation in any U.S. County.”206 number of commercial vendors consumer’s credit worthiness, For this product, arrest records also sell identification and loca- character, reputation, personal can be searched using name or tion products that are used by characteristics, or mode of liv- Social Security number, while law enforcement agencies ing. This, of course, includes conviction information searches ranging from the U.S. Marshals criminal history information, require name, Social Security to local sheriff’s departments number, date of birth, and for the apprehension of fugi- 212 county to be searched.207 tives.211 U.S. Marshals, for ex- See, http://www.dbtonline.com. A special agent of the Bureau of Alcohol, ample, were able to apprehend Tobacco and Firearms characterized the Another reference services two fugitives using a system value of such services as “a tremendous company, identifying itself on offered by CDB Infotek, a benefit to our law enforcement mission the Internet as the “Global In- member of the IRSG. The Mar- and a real time saver … . The sponta- formation Network,” offers sev- shals entered the names of two neous retrieval of accurate data maintained in [the database] contributed to eral CHRI products, including: a fugitives and the system re- effectively directing and positioning “county criminal court record turned information indicating a our surveillance teams that resulted in report,” from a potential pool of nearby location. DBT, another the surrender of two suspects. When 3,300 counties; a “Statewide member of the IRSG, reports one of the suspects was believed to be criminal repository record re- that its products are used by in a large apartment complex, your … port,” from approximately 30 more than 1,000 law enforce- system was able to provide us complete drivers license information for every State repositories (a release ment agencies and that law en- driver in the complex which totaled form from the subject may be forcement has used its products over 700 and did so in less than 10 to apprehend criminals ranging minutes. [It] is an incredible tool for law enforcement providing us with a capability to assimilate information 208See, for example, http://www available at http://www from your uniquely cross referenced .searchinfo.com/criminal.html. .irsg.org/html/white_paper records.” Letter from Robert J. 209 .htm. Ibid. Creighton, Special Agent in Charge, 206“OPEN Products,” available at 210Ibid. For an example of a firm Miami Field Division, Department of http://www.openonline.com permitting online ordering, see, the Treasury, Bureau of Alcohol, To- /productguide.htm http://www.1800ussearch.com. bacco and Firearms, to Database Tech- #criminalacrcmvoc.htm. 211IRSG White Paper, supra note 205, nologies, Inc. (September 14, 1995). 207Ibid. p. 12. 21315 U.S.C. § 1681 et seq.

Page 58 Report of the National Task Force on Privacy, Technology and Criminal Justice Information such as arrest and conviction As substantially amended in agency that provided the in- information. 1997, the FCRA includes all of formation. the safeguards expected in a · Consumer-reporting agen- Under the FCRA, a consumer- comprehensive, fair information cies must, upon request, reporting agency may only pro- practice/privacy statute, includ- provide a consumer with a vide a consumer report to a ing notice to consumers; con- copy of that consumer’s party when the agency has rea- sent, including opportunities for file, as well as a listing of son to believe that the party will opt-in/opt-out; accuracy, rele- everyone who has requested use the report to make a credit vance, and timeliness standards; it recently. The cost to the determination, an employment confidentiality and use safe- consumer of obtaining the determination, an insurance un- guards; security expectations; report cannot exceed $8, derwriting determination, or consumer access and correction and may be free if requested otherwise in connection with a rights; content restrictions; and in connection with a recent legitimate business need in a remedies, including administra- denial of benefits or other transaction involving the con- tive sanctions and private rights specified circumstances. sumer or pursuant to written of action. More specifically, the instructions of the consumer.214 FCRA provides consumers with · Consumers are permitted to the following privacy rights: request a correction of information they believe to be · A consumer-reporting 214 inaccurate. The consumer- Consumer-reporting agencies, agency that furnishes a con- however, are forced to rely on the rep- reporting agency must in- sumer report for employ- resentations of permissible purposes vestigate unless the dispute ment purposes containing made by their customers. Therefore, if is frivolous. The consumer- a customer makes a false representa- public record information, reporting agency must also tion, he or she can obtain a consumer including criminal history send a written investigation report without actually having a per- records, which is “likely to missible purpose. Although making report to the individual and have an adverse effect upon such a misrepresentation is punishable a copy of the revised report, a consumer’s ability to ob- under the FCRA, the penalty may not if changes were made. The tain employment,” must ei- always be sufficient to discourage the consumer may also request conduct. Such appears to have been the ther provide the consumer that corrected reports be case in WDIA v. McGraw-Hill, C-1-93- with notice at the same time sent to recent recipients. If 448 (December 1, 1998, S.D. Ohio). In that the information is re- WDIA, a consumer-reporting agency the dispute is not resolved ported to the potential em- sued the parent company of Business in the consumer’s favor, the ployer or “must maintain Week after a Business Week reporter consumer has the option of obtained a consumer report on then- strict procedures” to ensure including a brief statement Vice President Dan Quayle for an arti- that the information is com- to the consumer’s file, typi- cle, after falsely representing that he plete and up-to-date. 215 had a permissible purpose to receive cally for distribution with the report. WDIA sought $75,000 in · A consumer must be noti- future reports. actual damages and $45 million in pu- fied when information is · Consumer-reporting agen- nitive damages. However, the court, used to take an action which ruled in WDIA’s favor on the cies must remove or correct against him or her, such as merits, awarded only $7,500 in actual unverified or inaccurate in- the denial of employment. damages and no punitive damages at formation from its files, all, noting that the news coverage was a In such cases, the party de- typically within 30 days af- “vital public interest” and Business nying the benefit must pro- ter the consumer disputes Week promised not to engage in such vide the consumer with conduct in the future. The reporter is the information. reported to have claimed the ruling was information on how to con- a “vindication.” Robert Ellis Smith, “In tact the consumer-reporting · In most cases, a consumer- the Courts: Business Week” Privacy reporting agency may not Journal, Vol. 25, No. 3 (January 1999) report negative information p. 7. 21515 U.S.C. § 1681k (FCRA § 613). that is more than 7 years old

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 59 (including arrest informa- require signatory and complying · Have an information prac- tion); 10 years for bankrupt- companies to: tices policy statement noti- cies. A 1998 amendment to fying individuals of their · Make efforts to educate the FCRA permits the inclu- information practices. their customers and the sion of criminal conviction public about their services, · Provide individuals with a information, without time the privacy issues associ- means for limiting the gen- limitations. ated with those services, the eral public’s access to non- · Consumers can sue for vio- IRSG Principles, and the public information. The lations or seek assistance societal benefits from the companies may also provide from the FTC and other responsible flow of infor- individuals with the ability Federal agencies responsi- mation. to limit access to other in- ble for the enforcement of formation in their databases. · Acquire individually identi- the FCRA. fiable information from · Provide individuals with only reputable sources in information about the types — The Individual the public and private sector and sources of the public Reference Services and take measures to under- record and publicly avail- Group stand the information col- able information that the lection practices of those companies include in their In 1997 the major companies in sources. information products and the individual reference services services. industry, joined by the three · Take reasonable steps to national consumer-reporting ensure the accuracy of the · Limit the distribution of systems, established the Indi- information in their prod- information about individu- vidual Reference Services ucts, and to either correct als identified as being less Group (IRSG). Companies in inaccurate information or than 18 years of age. the individual reference services refer the individual to the industry provide public record agency that created the in- — Privacy risks posed by information, including CHRI formation. changes in the marketplace (obtained primarily from the · Limit the distribution of courts), to government agencies, nonpublic information ac- Changes in the marketplace, companies, law firms, private cording to specified criteria particularly the emergence of investigators, and, in some in- based on the nature of the sophisticated private-sector stances, the public. The IRSG information requested and networks providing CHRI, raise adopted self-regulatory princi- the intended use of that in- a number of privacy issues: ples (IRSG Principles) that be- formation. came effective at the end of · First, of course, private- 216 · Maintain systems and fa- 1998. The IRSG Principles sector resellers of criminal cilities to protect informa- histories encourage and fa- tion from unauthorized 216Individual Reference Services cilitate the availability of access by means of physi- Group, “Individual Reference Service criminal history information cal, electronic, and admin- Industry Principles” (December 15, to the public or to non- 1997), available at http://www istrative safeguards. .irsg.org/html/industry criminal justice business us- _principles_principles.htm. The ers in a way that is fast, IRSG Principles apply to information of the seven characteristics (credit convenient, and inexpen- products that assist users to identify worthiness, credit standing, credit ca- sive. individuals, verify identities, and locate pacity, character, general reputation, individuals for various purposes. These personal characteristics, or mode of · Second, the commercial identification and location products are living) set forth in the FCRA definition marketplace for criminal of “consumer report,” which is set forth beyond the scope and protections of the histories may exacerbate the FCRA because they do not bear on one at 15 U.S.C. § 1681a(d).

Page 60 Report of the National Task Force on Privacy, Technology and Criminal Justice Information risk of communicating in- · Finally, because private da- significant privacy risks. This complete or inaccurate re- tabases seldom are sup- report describes several initia- cords. Records obtained ported by fingerprints or tives. from police blotters or from other biometric identifiers, court sources are customar- they run a risk of misidenti- Perhaps the most important of ily less complete than re- fication and of attributing the new Federal initiatives is the cords held by the State erroneous information to an National Instant Criminal Back- criminal record repositories. individual. On the other ground Check System (NICS), hand, Task Force partici- which became operational in · Third, there is certainly the pants are aware of few ex- November 1998. NICS, as potential that the commer- amples of misidentification authorized in the 1993 Brady cial-sector records will keep arising from name checks Handgun Violence Prevention and disclose records, re- used in commercial criminal Act, provides firearms dealers gardless of how long ago history reporting systems. with instantaneous information the underlying offense oc- about whether an individual has curred. Although the FCRA Although commercial harvest- a criminal history record back- provides a 7-year limitation ing and reporting of criminal ground that makes the individ- for disclosures of arrest in- histories may pose a privacy ual ineligible to obtain a formation by consumer- risk, it should also be noted that firearm. The NICS draws on reporting agencies, noncon- commercial systems meet a three Federal databases that in- sumer-reporting agencies burgeoning noncriminal justice clude CHRI, information on are subject to no such re- demand and facilitate use of wanted persons, and certain striction. In addition, as these records for numerous im- other kinds of sensitive infor- noted, the FCRA was portant public safety, anti-fraud, mation, including mental health amended in 1998 to permit and other economically and so- information, information on in- the disclosure of conviction cially important purposes.217 dividuals who have received information, regardless of dishonorable discharges from the date of the conviction. the military, and citizenship As a result, it is legally pos- Federal and State status information. The sensi- sible to create a private initiatives tivity and breadth of this infor- criminal history database mation, combined with its that will forever record and The Federal government is availability on a name-only ba- report an individual’s inter- spearheading numerous initia- sis, seems certain to add fuel to actions with the criminal tives aimed at providing the criminal justice information justice system. authorized users with better and privacy debate. Thus, private databases may more timely criminal justice In 1998, as noted, Congress outflank State sealing and information. One inevitable ef- amended the FCRA to remove a expungement laws. Once a fect of such efforts is to create at provision that prohibited con- criminal record has been least the potential for new and sumer-reporting agencies from captured in a private data- reporting “obsolete” conviction base or published in the 217IRSG White Paper, supra note 205, information (that is, convictions newspaper (now also elec- p. 1. “Individual reference services more than 7 years old).218 tronically searchable and provide important societal benefits. available on the Internet) or They help a broad range of people, published on the Internet, from welfare mothers seeking to enforce child support orders, to pension 218Consumer Reporting Employment court or other legal direc- beneficiaries and heirs, to fraud vic- Clarification Act of 1998, Pub. L. No. tives to seal or expunge tims. These services also assist in im- 105-347, § 5. It has been suggested that those records have limited portant governmental functions, such as a similar FCRA obsolescence require- effect. tracing fraud, apprehending criminals, ment for arrest information also be and locating witnesses to crimes.” Ibid. eliminated.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 61 — The Security Clearance agencies cannot obtain sealed and murder of 7-year-old Ash- Information Act of 1985 data, thereby preserving State ley Estelle, summed up the im- prerogatives in the area. Fur- portance of such legislation this The Security Clearance Infor- thermore, Federal agencies must way: “Legislatures and justice mation Act of 1985 (SCIA)219 obtain the written consent of the agencies must remove barriers opens virtually all CHRI to the individual, and the information that prevent the free flow of in- Central Intelligence Agency, the obtained may only be used for formation between agencies so Office of Personnel Manage- national security purposes. criminal justice professionals ment, the U.S. Department of are not reluctant to do their job Defense, and the FBI for back- — Sex offender statutes out of fear of liability. Informa- ground checks for security tion is critical to our systems. clearances and for placement of In 1989, Jacob Wetterling, then Secrecy is the sex offender’s people in national security du- 11, was abducted at gunpoint by best friend, so we must shine a ties. This Act eliminated wide a masked man, never to be seen light on everything they do.” 224 disparities between State laws; again.222 In 1994, 7-year-old A string of recent Federal stat- some gave the security agencies Megan Kanka was raped and utes seeks to turn on that light. broad access and others pro- murdered by a repeat sex of- vided no access at all.220 fender who lived next door to The Jacob Wetterling Crimes her, after he lured her inside Against Children and Sexually SCIA, however, does not pro- with promises to let her play Violent Offender Registration vide unlimited access. The Gen- with a puppy. Polly Klaas and Act, named after Jacob Wetter- eral Accounting Office (GAO), Ashley Estelle suffered similar ling, requires States to establish in a February 1999 report on the fates at the hands of offenders in effective registration systems military’s criminal history California and Texas, respec- for convicted child molesters screening practices, noted that tively. These crimes brought and other sexually violent of- SCIA does not require States or repeat sex offenders to the fore- fenders. The most dangerous of the FBI to provide the military front of the national conscious- these offenders, “sexually vio- with access to criminal history ness and led to a flurry of State lent predators” are subject to records for determining whether and Federal legislation.223 more stringent registration stan- an individual is suitable for dards. The Act requires States to mere enlistment in the mili- Texas State Senator Florence require designated sex offenders tary.221 In addition, Federal Shapiro (R-Plano), who spear- to register and provide law en- headed the drive for sex of- forcement with a current ad- 219Pub. L. No. 99-169 (1985), codi- fender legislation in Texas dress for 10 years, with sexually fied in part at 5 U.S.C. § 9101. following the abduction, rape, violent predators required to 220 provide more extensive regis- Robert R. Belair, “Public Avail- ability of Criminal History Records: A to readily obtain access to State and tration information. The Act Legal Analysis,” in Open vs. Confiden- local criminal history information at also requires that this informa- tial Records, Proceedings of a reasonable costs for the purpose of tion be retained by the State BJS/SEARCH Conference, NCJ 113560 accepting or retaining individuals into (Washington, D.C.: U.S. Department of central repository and made service.” Ibid., p. 12, n. 12. Justice, Bureau of Justice Statistics, public in certain public safety 222 1988) p. 16. Patty Wetterling, “The Jacob Wet- circumstances.225 terling Story,” in National Conference 221Military Recruiting: New Initia- on Sex Offender Registries: Proceed- tives Could Improve Criminal History ings of a BJS/SARCH Conference, NCJ Screening, GAO/NSIAD-99-53 168965 (Washington, D.C.: U.S. De- (Washington, D.C.: U.S. General Ac- partment of Justice, Bureau of Justice 224Florence Shapiro, “The Big Picture counting Office, February 1999) p. 11. Statistics, May 1998) p. 3. Hereafter, of Sex Offenders and Public Policy,” in Hereafter, Military Recruiting Report. Sex Offender Registries Conference. Sex Offender Registries Conference, p. According to this report, the U.S. De- 223 94. partment of Defense has proposed leg- See, Teir and Coy, supra note 201, 225 islative changes to “give it the authority p. 405. 42 U.S.C. § 14071.

Page 62 Report of the National Task Force on Privacy, Technology and Criminal Justice Information The Federal Megan’s Law, States that fail to have “mini- 940,000 records of prohibited named after Megan Kanka, mally sufficient” programs. Fi- persons, as outlined in the builds on the Wetterling Act.226 nally, the Act changes the Brady Act, such as individuals While the Wetterling Act, as Wetterling Act requirement that who have received dishonorable originally enacted, gave law offenders register for 10 years to discharges from the armed enforcement the option to re- a lifetime registration require- services, individuals who have lease information about sex of- ment for aggravated offenders, renounced their citizenship, fenders who were perceived as a recidivists, and sexually violent mental defectives, threat to public safety, Megan’s predators.228 illegal/unlawful aliens and Law, like many of its State others.”231 counterparts, requires States to — The Brady Handgun release information about sex Violence Prevention Act Recognizing the potentially offenders when it is required for sensitive nature of the public safety. This “mandatory The 1993 Brady Handgun Vio- information that would be used community notification” is de- lence Prevention Act229 estab- by the NICS, the Brady Act signed to inform parents and lished the NICS for the purpose require s establishment of security members of the community of determining if an individual and priva cy safegua rds: “Afte r when a sex offender, who is is disqualified from the pur- 90 days’ notice to the public and perceived to be a threat to pub- chase of a firearm on the basis an opportunity for hearing by lic safety, moves into a neigh- of: indictment for or conviction intereste d partie s, the Attorney borhood. Megan’s parents said of a felony; being a fugitive Gene ral shall presc ribe after their daughter’s rape and from justice; being an unlawful regulations to ensure the privacy murder that they had been un- user of, or addicted to, a con- and secur ity of the information of aware that her killer, who was trolled substance; having been the [NICS] system.”232 Furthe r, their neighbor, was a previously adjudicated as mentally defec- the Act prohibits gun deale rs convicted sex offender, and that tive or committed to a mental from disclosing nonpublic they would have been especially institution; being an illegal information receive d as a result vigilant if they had known a alien; having renounced U.S. of a background c heck except to convicted sex offender lived in citizenship; being dishonorably the purchase r or to law their midst. discharged from the military; having been convicted of a mis- 231 The third of the Federal sex of- demeanor of domestic abuse; or National Instant Criminal Back- ground Check System (NICS): The fender statutes, the Pam being subject to a protective First Seven Months (November 30, 230 Lychner Sexual Offender order. 1998-June 30, 1999) (Washington, Tracking and Identification D.C.: Federal Bureau of Investigation, Act,227 establishes a national When a Federal firearms Criminal Justice Information Services database for the tracking of sex licensee conducts a NICS check, Division) pp. 2-3. The 940,000 records offenders. The Act also requires a name search is conducted in in the NICS index, which concern mental defectives, the dishonorably the FBI to administer sex of- three different databases at the discharged, etc., are currently only a fender registration programs in national level to determine the small portion of the overall number of eligibility status of an applicant records checked as a part of a Federal to purchase a firearm: the NICS check, when compared to the 226 104 P.L. 145, 100 Stat. 1345. NCIC, III, and the NICS index. approximately 34.7 million criminal 227 history records in the III and the The Lychner Act was named in The NICS index “contains about memory of victims’ rights activist Pam 700,000 records on wanted persons and protective orders in the NCIC. Ibid., p. Lychner, who founded the victims’ rights organization Justice for All after 3. 22842 U.S.C. § 14072. she was brutally attacked by a twice- 23218 U.S.C. § 922 Historical and 229 convicted felon. She later died, along Pub. L. No. 103-159 (November Statutory Notes, National Instant with her two daughters, in the crash of 30, 1993). Criminal Background Check System § TWA flight 800 in July 1996. 23018 U.S.C. § 922(g) (Supp. 1997). (h) (Supp. 1997).

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 63 enforceme nt authorities, or applications for firearm transfe r six States, yet with volunteers in pursuant to a court orde r. The were reje cte d. The FBI’s all 50 States.239 As a result of Act also addresse s the rete ntion reje ction rate was 1.8% (81,000 these concerns, Congress and destruction of background applications) and the rejec tion amended the NCPA in 1998 to check rec ords and fire ar ms rate for checks handled by State permit qualified entities, such as purchaser applications. Further, and local agencie s was 3% schools or youth-serving non- the Brady Act gives purchasers a (123,000 applications). In over profit organizations, to conduct right to review denials and 70% of the c ases where an fingerprint-based background correct errone ous information, application for fir ear ms transfe r checks using the national sys- and prohibits the esta blishme nt was rejected, a cur rent felony tem regardless of whether State by Federa l age ncies of fire ar ms indictment or prior felony law specifically authorizes them registr ation systems. conviction was the rea son.235 to conduct such checks, provided that certain criteria are On Octobe r 30, 1998, the U.S. — The National Child met.240 DOJ issued final regulations for Protection Act the NICS.233 The final rule The number of people/positions included provision for an “audit The National Child Protection potentially covered by the log” that would be retained on a Act of 1993 (NCPA)236 author- NCPA is staggering. In the area tempora ry basis “solely for the izes States to make nationwide of child care alone, for example, purpose of satisfying the background checks (based upon State criminal record check statutory require me nt of ensuring fingerprint-based identification) statutes frequently cover day- the priva cy and sec urity of the to determine if a care “provider care, foster and adoptive homes, NICS and the proper has been convicted of a crime schools, social service/welfare administration of the system.” 234 that bears upon the provider’s agencies, school bus/ transpor- During 1999, NICS’ first full fitness to have responsibility for tation services, juvenile deten- year of operation, NICS the safety and well-being of tion/residential facilities, those proc essed about 8.6 million children, the elderly, or indi- with supervisory or disciplinary inquiries. The FBI conducted viduals with disabilities.”237 The power over children, youth or- about one-ha lf of the presa le NCPA, as originally enacted, ganizations, youth camps, pub- background c hecks for which permitted use of the national lic recreation, or youth these inquirie s wer e made, with system only as authorized by programs.241 The American Bar the other half being handled by State law and approved by the 238 State and local age ncies. In 1999, U.S. Attorney General. This, 239Testimony of U.S. Representative approxima tely 2.4% (204,000) of as might reasonably be ex- Mark A. Foley (R-FL) before the pected, resulted in inconsisten- House Judiciary Subcommittee on 23363 Federal Register 58303 (Octo- cies among State laws. National Crime regarding H.R. 2488, the Vol- unteers for Children Act (April 30, ber 30, 1998), to be codified at 28 volunteer organizations, such as C.F.R., Part 25. 1998). the Boys and Girls Clubs of 240 234 Volunteers for Children Act, Pub. Ibid. On Nove mber 30, 1998, the America, found themselves with same day NICS became operational, the L. No. 105-251, §§ 221-222 (October Nationa l Rifle Association filed suit in State-authorized access in only 9, 1998), 112 Stat. 1885 (amending 42 Fede ral district court arguing that the U.S.C. § 5119a). 241 FBI’s audit log, even if intende d to be 235Lea Gifford, et. al., Background Noy S. Davis, “Authorized Record “temporar y,” was a violation of Section Checks for Firearm Transfers, Bulletin Checks for Screening Child Care and 103(I) of the Brady Act (pr ohibiting Fed- series, NCJ 180882 (Washington, D.C.: Youth Service Workers,” in National eral agencies from establishing a national U.S. Department of Justice, Bureau of Conference on Criminal History Re- gun registry). Both a Feder al district Justice Statistics, June 2000), pp. 1-3. cords: Brady and Beyond, Proceedings court and the Court of Appe als for the of a BJS/SEARCH Group Conference, 236Pub. L. No. 103-209 (Dec. 20, District of Columbia Circuit have held in NCJ 151263 (Washington, D.C.: U.S. 1993). favor of the government. See , National Department of Justice, Bureau of Jus- 237 Rifle Association of Ame ric a v. Reno , 42 U.S.C. § 5119a(a). tice Statistics, 1995) p. 85, figure 2. 216 F.3d 122 (D.C. Cir. 2000). 238Ibid. Hereafter, Brady Conference.

Page 64 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Association Center on Children over privacy and criminal jus- The U.S. Supreme Court, in a and the Law estimates that tice. 1967 decision, characterized the nearly 35 million adults have juvenile justice system this way: contact with children through — A brief history of the “The early conception of the these kinds of programs.242 The philosophy of the Juvenile Court proceeding was NCPA also covers elder care juvenile justice system one in which a fatherly judge and care of the disabled. The touches the heart and con- potential workload implications The juvenile justice system was science of the erring youth by and the potential numbers of one of the products of the “Pro- talking over his problems, by access requests for and disclo- gressive Movement” of the late paternal advice and admonition sures of criminal history infor- 19th and early 20th centuries. and in which in extreme situa- mation are staggering. “To the Progressives, crime was tions, benevolent and wise in- the result of external forces, not stitutions of the State provided of the exercise of an individ- guidance and help, to save him Juvenile justice reform ual’s free will. Their goal was to from a downward career.”245 reform the offender, not punish The child was seen as impres- Concerns regarding the fre- the offense.”243 The Illinois sionable and malleable, not truly quency of juvenile crime, its State Legislature established the responsible for his or her ac- periodic violence and recidivism Nation’s first independent juve- tions, and should not be saddled have combined to generate pres- nile court system in 1899, to be with responsibility for his or her sure to open juvenile records to a system in which “children actions in the same manner, and greater use within both the were not to be treated as crimi- with the lifelong impact, as criminal justice and the non- nals nor dealt with by the proc- adult offenders. criminal justice communities. ess used for criminals.”244 The Concomitantly, these same Illinois juvenile court, and those The juvenile justice record- forces have generated pressure subsequently created in other keeping system was also de- to improve the quality of juve- States, adopted the British no- signed with the protection of the nile history records, including tion of parens patriae (the State child in mind. A law review making the records fingerprint- as parent) and the State came to commentary in 1909 stressed supported and assuring appro- see its role as stepping in when that the importance of confi- priate disposition reporting. Re- parents failed to carry out their dentiality for juvenile records cent Federal legislation has supervisory responsibilities. was to “get away from the no- focused attention on the privacy tion that the child is to be dealt issues associated with juvenile with as a criminal; to save it records by including initiatives from the brand of criminality, to rework the juvenile justice 243Robert R. Belair, Privacy and Ju- the brand that sticks to it for information system to make it venile Justice Records: A Mid-Decade life; to take it in hand and in- look much more like the adult Status Report, Criminal Justice Infor- stead of first stigmatizing and mation Policy series, NCJ 161255 system. The effort to improve (Washington, D.C.: U.S. Department of then reforming it, to protect it juvenile history records and to Justice, Bureau of Justice Statistics, from the stigma — this is the make juvenile history records 1997) p. 6. Hereafter, Privacy and Ju- work which is now being ac- more available is controversial venile Justice Records Status Report. complished (by the juvenile and adds to the emerging debate 244Robert R. Belair, Privacy and Ju- court).”246 venile Justice Records, Criminal Justice Information Policy series (Washington, D.C.: U.S. Department of Justice, Bu- 242Kimberly Dennis, “Report on Na- reau of Justice Statistics, 1982) p. 12 245 tional Study of Existing Screening (quoting Eldefonzo, Law Enforcement In re Gault, 387 U.S. 1, 25-26 Practices by Child Care Organiza- and the Youthful Offender, 3rd ed. (New (1967). tions,” in Brady Conference, p. 90, York: John Wiley & Sons, 1978) p. 246Mack, “The Juvenile Court,” 23 figure 1. 147). Harvard Law Review 104, 109 (1909).

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 65 During the 1950s and 1960s this Although the Supreme Court’s The statistical growth of violent view of the juvenile justice sys- extension of “adult” rights to juvenile crime during the late tem came into question, with the juveniles broke down one of the 1980s and early 1990s, and the Supreme Court noting in 1966 walls around the juvenile justice media attention accompanying that “While there can be no system, increased juvenile crime it, created a powerful counter- doubt of the original laudable (and increased media attention argument for many. As Reggie purpose of juvenile courts, to juvenile crime) created addi- B. Walton, formerly the presid- studies and critiques in recent tional pressures for changes in ing judge of the criminal divi- years raise serious questions as the juvenile justice system. sion of the District of Columbia to whether actual performance Public attitudes toward youthful Superior Court put it: “To the measures well enough against offenders hardened over the crime victim, and society as a the theoretical purpose to make years, with ever-decreasing tol- whole, it matters not whether tolerable the immunity of the erance for youthful offenders, the offender is 16 or 17, or has process from the reach of con- particularly violent offenders. just turned 18. What is impor- stitutional guarantees applicable While the public might agree tant is that a crime has been to adults.”247 The Court an- that shoplifting was a “youthful committed, an injury has been swered its own question in the error,” youth gangs, and random sustained, and protection against negative, extending to juveniles violence by juveniles are un- further acts by the perpetrator much the same right to adver- likely to be included in that are taken if and when the of- sarial-style due process as category. fender is apprehended … adults.248 greater utilization of juvenile A vigorous debate began as to records is warranted, so long as The following year the Court the extent to which the juvenile measures have been taken to went further, rejecting parens recordkeeping system should be guard against abuses.”253 patriae and extending to juve- integrated with that of the adult niles the four basic elements of system by either unifying the Although the solution to the due process: the right to notice, records or at least linking the problem is debatable, Judge the right to counsel, the right to adult and juvenile records.251 Walton’s assessment of public cross-examine witnesses, and Those arguing for the mainte- opinion and the public’s fear of the right against self- nance of separate record sys- crime, particularly juvenile incrimination.249 In that same tems believe the juvenile system crime, appears right on the case, In re Gault, the Court should continue to adhere to its mark. Anecdotal evidence of questioned the confidentiality of Progressive traditions with re- youth violence is plentiful, in- juvenile records, noting “the spect to juvenile justice records. cluding a recent string of school summary procedures of Juvenile As one commentator observed: shootings by juveniles. This Courts are sometimes defended “The juvenile justice system by a statement that it is the should open its records to the 253Reggie B. Walton, “Utilization of law’s policy ‘to hide youthful criminal justice system and the Juvenile Records in Adult Proceedings, errors from the full gaze of the public only if it is in the best A Judge’s Perspective,” in Juvenile and Adult Records, supra note 128, p. 43. public and bury them in the interest of the child, and I have Others, such as the National Council of graveyard of the forgotten past.’ serious doubts that it ever would Juvenile and Family Court Judges, have This claim of secrecy, however, be.”252 argued that the confidentiality sur- is more rhetoric than reality.”250 rounding juvenile justice proceedings should be “reexamined and relaxed to 251 See generally, Juvenile and Adult promote public confidence” in juvenile Records, supra note 128. 247Kent v. United States, 383 U.S. courts. See, Hon. Gordon A. Martin Jr., 252 541, 555 (1966). Howard N. Snyder, “Thoughts on “Open the Doors: A Judicial Call to the Development of and Access to an End Confidentiality in Delinquency 248Ibid. Automated Juvenile History System,” Proceedings,” 21 New England Journal 249 In re Gault, 387 U.S. 1 (1967). in Juvenile and Adult Records, supra on Criminal and Civil Confinement 250Ibid., at 24. note 128, p. 56. (Summer 1995) 393, 410.

Page 66 Report of the National Task Force on Privacy, Technology and Criminal Justice Information series of school shootings is a juveniles can be transferred for other adult records, a largely tragic, well-publicized mani- trial in the adult system, in- uncontroversial practice. festation of juvenile crime, creased centralization of juve- which rose significantly during nile records, increased Second, juvenile justice records the late 1980s and early 1990s availability of juvenile records are being maintained on an in- before beginning to decline. outside the juvenile system, increasingly centralized basis. creased fingerprinting, and, Juvenile justice records were Despite a series of high-profile most recently, DNA testing of traditionally maintained on a juvenile crimes, including the juveniles. dispersed and local basis; how- high school shootings, the “sub- ever, the centralization trend stantial growth in juvenile vio- First, the States have made it that reshaped the maintenance lent crime arrests that began in easier to transfer juveniles from of adult records in the 1960s the late 1980s peaked in the juvenile system to the adult and 1970s has had an increasing 1994.”254 In 1998, for the fourth system by establishing a system impact on juvenile records as year in a row, the total number of discretionary and mandatory well. In 1988, only 13 of the 50 of juvenile arrests for Violent circumstances under which State repositories for adult re- Crime Index offenses — mur- youth are transferred from the cords maintained juvenile re- der, forcible rape, robbery, and juvenile system to the adult cord information. By 1995, 27 aggravated assault — de- system to be “tried as adults.” A States had expressly authorized clined.255 Even with these de- 1995 GAO report found that a central repository for the col- clines, however, the number of since 1978, 44 States and the lection and maintenance of ju- juvenile Violent Crime Index District of Columbia had venile criminal history arrests remained higher than the amended their statutes address- information, either by the adult 1988 level.256 ing the circumstances under repository or a special juvenile which juveniles could be tried in repository.258 In addition, in — Recent legal trends criminal court. The GAO found 1992, the Attorney General that in 24 States, these changes authorized the FBI to begin ac- State legislatures took note of have increased the population of cepting State-reported data con- media and public concerns. Be- juveniles subject to transfer to cerning serious juvenile ginning in the late 1970s, they adult courts (primarily by de- offenses.259 The FBI decided to have instituted a number of re- creasing the age at which juve- disseminate this juvenile infor- forms that have radically im- niles may be transferred or by mation under the same stan- pacted the functioning of the increasing the number and types dards applicable to adult traditional juvenile justice sys- of offenses subject to transfer); records.260 tem, including revising the cir- in three States, these changes cumstances under which have decreased the population A third trend in recent years is of juveniles subject to transfer; the increasing availability of 254Howard N. Snyder, Juvenile Ar- and in 17 States, changes in the juvenile justice record informa- rests 1997, Juvenile Justice Bulletin law have neither increased nor tion outside of the juvenile sys- series, NCJ 173938 (Washington, D.C.: decreased the population subject tem. In contrast to the situation U.S. Department of Justice, Office of to transfer.257 The criminal his- in the early 1980s, by the end of Juvenile Justice and Delinquency Pre- tory records relating to an of- 1995 juvenile justice informa- vention, December 1998) p. 1. Hereaf- ter, Juvenile Arrests 1997. fense for which a juvenile is tion is almost fully available to 255Crime in the United States, 1998 charged as an adult typically are adult courts for sentencing and Uniform Crime Reports (Washington, maintained in the adult CHRI D.C.: U.S. Department of Justice, Fed- system and treated the same as 258 eral Bureau of Investigation, 1999) p. Ibid., p. 23. 259 209. 257Privacy and Juvenile Justice Re- Use and Management of CHRI, 256Juvenile Arrests 1997, supra note cords Status Report, supra note 243, supra note 22, p. 23. 254, p. 1. pp. 8-9. 260Ibid.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 67 most other purposes.261 “In take fingerprints when arresting These statutes typically, but not roughly one-half the States, a juvenile.265 Twenty-two States always, limit the collection of prosecutors have a statutory limited the fingerprinting to of- DNA samples to juveniles who right of access to juvenile record fenses that would have been a have committed specified of- information and a BJS survey felony if committed by an adult, fenses, typically sexual of- indicates that prosecutors, in five States authorized finger- fenses, violent crimes, and other most States, have little difficulty printing for offenses that would felonies.268 in obtaining access.”262 There be either felonies or misde- All of these recent trends have are also signs that juvenile re- meanors if committed by an seriously eroded the Progressive cords are becoming available adult, and 13 States made no Model for the juvenile justice outside the justice system. Ac- reference to the type of of- system. The turn of the century cording to a 1996 Navy survey, fense.266 With the advent of system, which still has substan- three States release the juvenile DNA testing in the late 1980s, tial support, envisioned its role records of applicants for enlist- State legislatures have rushed to as a firm hand that could pro- ment to the military.263 Access add new statutes authorizing the vide an errant child with reha- to these records is of interest to collection of DNA samples of bilitation and a fresh start, with the military because “juvenile juveniles, with at least 25 hav- sealed records being one means crime records are likely to be a ing done so by mid-1998.267 of meeting that goal.269 Other major source of criminal history information for the population targeted by military recruiters Supp. 1998); and WIS. STAT. ANN. § 265Privacy and Juvenile Justice Re- 165.76 (West 1997). — men and women generally 17 cords Status Report, supra note 243, p. 268 to 21 years old.”264 See, for example, MONT. CODE 28. ANN. § 44-6-103 (1997) (applies to 266Ibid. youth found to have “committed a sex- A fourth trend in the juvenile 267 See, for example, ALA. CODE § 12- ual or violent offense”); 35 PA. STAT. system that has privacy impli- 15-102 (Michie Supp. 1997); ALASKA ANN. § 7651.306 (Purdon Supp. 1998) cations is increased fingerprint- STAT. § 44.41.035 (Michie 1996); (applies to a “person who is convicted or adjudicated delinquent for a felony ing, photographing, and ARIZ. REV. STAT. ANN. § 13-4438 sex offense or other specified of- obtaining DNA samples from (West Supp. 1997); ARK. CODE ANN. § fense”); ALASKA STAT. § 44.41.035 juveniles. Traditionally, photo- 12-12-1109 (Michie Supp. 1997); CAL. PENAL CODE § 290.2 (West Supp. (Michie 1998) (applies to minors age graphs and fingerprinting were 1998); FLA. STAT. ANN. § 943.325 16 and above, “adjudicated as a delin- undertaken only for the most (West 1996 & Supp. 1998); IDAHO quent for an act that would be a crime serious of offenses likely to go CODE § 19-5506 (Michie 1997); KAN. against a person if committed by an adult”). before a juvenile judge; how- STAT. ANN. § 21-2511 (Supp. 1997); 269 ever, by 1995, 40 States had LA. REV. STAT. ANN. § 15:601 (West There are a number of initiatives Supp. 1998); ME. REV. STAT. ANN. tit. around the country, such as Juvenile expressly authorized police to 25, § 1573 (West Supp. 1997); MICH. Drug Courts, that attempt to rehabilitate COMP. LAWS ANN. § 28.173 (West youthful offenders, under the watchful Supp. 1998); MONT. CODE ANN. § 44- eye of a judge, through innovative, 261 Privacy and Juvenile Justice Re- 6-103 (1997); N.H. REV. STAT. ANN. § integrated social service programs for cords Status Report, supra note 243, p. 632-A:21 (Michie Supp. 1997); N.J. the offender and his or her family. See, 28. STAT. ANN. § 53:1-20.20 (West Supp. for example, Robin J. Kimbrough, 262Ibid. 1998); N.M. STAT. ANN. § 29-16-3 “Treating Juvenile Substance Abuse: (Michie 1997); OHIO REV. CODE ANN. The Promise of Juvenile Drug Courts,” 263Military Recruiting Report, supra § 2151.315 (West Supp. 1998); OR. Juvenile Justice Vol. V, No. 2 (Wash- note 221, p. 12. 18 U.S.C. § 5038 limits REV. STAT. § 181.085 (1997); 35 PA. ington, D.C.: U.S. Department of Jus- the disclosure of Federal juvenile re- STAT. ANN. § 7651.306 (Purdon Supp. tice, Office of Juvenile Justice and cords to judicial inquiries, law en- 1998); S.C. CODE ANN. § 23-3-620 Delinquency Prevention, December forcement needs, juvenile treatment (West Supp. 1997); TEX. GOV’T CODE 1998) pp. 11-19. Such programs may requirements, positions raising national § 411.150 (Vernon’s Supp. 1998); trigger additional privacy protections security concerns, and certain victim UTAH CODE ANN. § 53-5-212.1 (1998); depending on the entities involved and inquiries. Ibid. VA. CODE ANN. § 16.1-299.1 (1998); the subject matter. Certain substance 264 Ibid. WASH. REV. CODE § 43.43.754 (West abuse treatment records are subject to

Page 68 Report of the National Task Force on Privacy, Technology and Criminal Justice Information societal concerns have weighed Although the trend in recent individuals compiled in an ef- against that model and in favor years has been toward greater fort to anticipate, prevent, or of treating juveniles convicted access to juvenile records, the monitor possible criminal activ- of violent crimes the same as, or debate is ongoing and the cen- ity.”273 Criminal intelligence and more like, adults. First and tral policy questions surround- investigative systems may foremost was the rise in juvenile ing the juvenile recordkeeping gather the same types of infor- crime (now somewhat miti- system remain largely unre- mation about individuals; the gated), particularly violent solved. Final resolution of these principal difference is the pur- crimes. These crimes make it and other policy questions are pose for which information is difficult for the public to accept likely to be influenced by juve- gathered.274 Criminal intelli- the notion that the perpetrator nile crime statistics and the gence information-gathering should get a fresh start rather public’s reaction to the crimes efforts are frequently the more than life imprisonment. those statistics represent, as well controversial, as they involve as the success of rehabilitation collection of information not Some have argued that the ma- efforts directed at youthful of- about a person’s connection jority of those juveniles in the fenders. with an actual crime, but rather juvenile system desist from fu- a person’s possible connection ture criminal acts (or what to criminal activities. would be criminal acts if com- Criminal intelligence mitted by adults), and that per- information systems Both the importance and sensi- haps the test for access to the tivity of this information have juvenile’s records by the adult Innovations in the development long been recognized. Criminal system and the public should be and operation of criminal intel- intelligence information, for whether the juvenile offender ligence systems are another example, is an essential tool in comes within the purview of the change driver encouraging a controlling organized crime ac- adult system within a certain reexamination of privacy pro- tivity, as well as gang activity, number of years of having tections for criminal justice in- drug trafficking, and terrorism. reached the age of majority.270 formation. At the same time, the privacy Others have raised concerns that sensitivity of criminal intelli- it is unfair to a first-time adult The terms “criminal investiga- gence information and its po- offender with no juvenile record tive information” and “criminal tential impact on freedom of to be treated the same way as an intelligence information” are association rights has been rec- adult who had a juvenile record, often used interchangeably. ognized. The growth of criminal which is kept from the court so They relate, however, to two intelligence-gathering efforts that offender could get a “fresh distinct, although related, con- slowed during the 1970s fol- start.” cepts.271 Criminal investigative lowing a series of congressional information is defined to mean

“information on identifiable Federal confidentiality protections. See, 273Ibid. at Standard 2.1(e). Federal 42 C.F.R. Part 2. In addition, if educa- individuals compiled in the regulations define “criminal intelli- tional institutions are involved, privacy course of an investigation of gence information” to mean “data protections in the Family Educational specific criminal acts.”272 which has been evaluated to determine Rights and Privacy Act of 1974, Pub L. Criminal intelligence informa- that it: (i) Is relevant to the identifica- No. 93-380 (codified at 20 U.S.C. § tion, in contrast, is defined as tion of and the criminal activity en- 1232g), requires educational institu- gaged in by an individual who or tions to grant students or parents access “information on identifiable organization which is reasonably sus- to student records and establishes limits pected of involvement in criminal ac- on disclosure to third parties. tivity, and (ii) Meets criminal 271 270Mark H. Moore, “The Public Pol- Intelligence and Investigative Re- intelligence system submission crite- icy Considerations of A Merged Re- cords, supra note 26, p. 9. ria.” 28 C.F.R. § 23.3(b)(3). cord,” in Juvenile and Adult Records, 272Technical Report No. 13, 3rd ed., 274Intelligence and Investigative Re- supra note 128, p. 48. supra note 8, Standard 2.1(d). cords, supra note 26, p. 10.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 69 hearings chaired by then-U.S. turn, has encouraged the “horizontal sharing” be- Senator Frank Church (D-ID). establishment of more tween States and between These hearings exposed a num- criminal intelligence sys- local law enforcement orga- ber of criminal intelligence tems, with more data, about nizations. system abuses that occurred more people. during the civil unrest of the The Task Force recognizes that 2. Second, criminal intelli- 1960s and early 1970s, as well the analysis and structuring of gence systems have become as during the Watergate period. privacy policies for criminal far more textured and ro- In 1975, LEAA issued regula- intelligence data is complex and bust. Today there are a tions governing the gathering of raises issues that are substan- multitude of data sources, criminal intelligence informa- tially different than the privacy allowing intelligence files to tion that covered any criminal issues raised by changes in be compiled and supple- intelligence system receiving CHRI and other criminal justice mented using personal in- funding through the Omnibus information systems. Accord- formation obtained from Crime Control and Safe Streets ingly, the Task Force recom- other criminal intelligence Act of 1968.275 The LEAA mends that the U.S. DOJ information systems, news- criminal intelligence regulations sponsor an initiative exclusively papers, commercial ven- require that information be dedicated to the examination of dors, and other information “relevant” and that the individ- the privacy implications arising sources. This information ual or organization in question from a new generation of crimi- may include financial data, be “reasonably suspected of in- nal intelligence information medical information, family volvement in criminal activ- systems. data, and other very sensi- ity.”276 Since this congressional tive types of information. and regulatory activity, a number of salient developments 3. A third important change is have occurred with important the increased sharing of privacy implications: criminal intelligence information among jurisdictions. 1. First, criminal intelligence Traditionally, criminal in- and investigative informa- telligence information was tion systems have become maintained locally, with lit- automated. Traditionally, tle sharing of information criminal intelligence and outside of the host agency. investigative information During the late 1960s, at- systems consisted of little tempts to create regional more than notebooks and criminal intelligence infor- other manual files. In the mation compacts failed.277 past 25 years, however, the Today, fueled by automa- automation of this information and with increased tion has expanded at a rapid Federal funding, this infor- rate, so that today, virtually mation is increasingly all large and important shared between jurisdictions criminal intelligence sys- and agencies, both in terms tems are automated. This, in of “vertical sharing” between local police, State police, and the FBI, and

275 See, 28 C.F.R. Part 20. 277Intelligence and Investigative Re- 27628 C.F.R. § 23.3(b)(3)(i). cords, supra note 26, p. 20.

Page 70 Report of the National Task Force on Privacy, Technology and Criminal Justice Information VI. Task Force recommendations

Background issues associated with access to Action is necessary to ensure CHRI. Accordingly, the Task appropriate privacy protection The National Task Force on Force report does not address, in Privacy, Technology and any depth, the broad range of Recommendation I: The Criminal Justice Information other issues arising from the Task Force recommends that brought together representatives increasing demand for public from the academic community, access to other types of criminal a body be statutorily created State and Federal government, justice information, such as in- to consider and make policy law enforcement, the courts, telligence and investigative recommendations to the Fed- commercial compilers of crimi- data, and the accompanying pri- eral and State legislative, ex- nal justice information, the privacy risks associated with vacy advocacy community, and making that data more widely ecutive, and judicial branches others who have expertise in available. of government as they work criminal justice information and to balance the increasing de- privacy and who are national Task Force recommendations mand for all forms of crimi- leaders in the debate about comprise a range of proposals nal justice information and criminal justice information pri- for handling CHRI. Recom- vacy. Task Force members mendation I reflects the Task the privacy risks associated cover the privacy spectrum from Force’s conclusion that change with the collection and use of those favoring high levels of drivers are creating a pattern of such information. The Task privacy protection for criminal essentially making ad hoc pol- Force recommends that the justice information to those fa- icy at the local, State, and na- voring high levels of public use tional level. The Task Force body look at information and and disclosure. believes there is a need, at least privacy issues arising from in the short term, for an institu- all types of criminal justice As this report indicates, the tionalized entity responsible for information, including crimi- Task Force has identified a se- making considered public policy ries of “change drivers” that are recommendations with respect nal history record informa- profoundly changing the tradi- to all issues associated with the tion, intelligence and tional balance between criminal increasing demand for criminal investigative information, justice information access and justice information and the pri- victim and witness informa- privacy. Without intervention vacy risks associated with that tion, indexes and flagging by policymakers, those change demand. drivers inevitably will create an systems, wanted person in- environment favoring enhanced Recommendations and formation, and civil restrain- public access and use, with no commentary ing orders. The Task Force assurance that the resulting bal- further recommends that such ance between access and pri- The National Task Force on vacy will be satisfactory. Privacy, Technology and a body be comprised of pub- Criminal Justice Information lic and private stakeholders; Although constituted to examine adopts the following 14 recom- that the body be limited to an “privacy, technology, and mendations in three broad areas: advisory role; and that it have criminal justice information,” privacy protections, data quality the Task Force made an early and security, and data integra- neither rulemaking nor adju- determination to focus its time tion and amalgamation. dicatory authority. Finally, and resources on the complex the Task Force recommends

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 71 that the body sunset after not made a number of recom- eration of criminal justice more than 3 years, unless mendations, the Task Force information privacy laws, believes that additional, de- regulations, and policies. If statutorily reauthorized. tailed work is necessary, a longer period of time particularly when the dis- proves necessary, an exten- Commentary: cussion moves from general sion permitting the body to · The Task Force believes principles to more specific continue its work could be that without the establish- policy issues. considered. ment of a body to study and · The body would not have provide guidance on crimi- adjudicatory or rulemaking Recommendation II: The nal justice privacy issues on authority. The Task Force Task Force recommends the an ongoing basis, the envisions an advisory body, development of a new gen- change drivers identified in available to consult and ad- eration of criminal justice chapter V of this report will vise Federal, State, and lo- result, essentially, in a pat- cal officials, as well as the information and privacy law tern of ad hoc policymaking public, on criminal justice and policy, taking into ac- at the local, State, and na- privacy issues. The Task count public safety, privacy, tional level. Force believes this approach and government oversight respects the nature of our · The Task Force believes interests. This law and policy that the establishment of a Federal system, while pro- body dedicated to the de- viding a mechanism to pro- should be broad in scope, so tailed examination of issues vide guidance at all levels as to address the collection, relating to the privacy, con- of government. maintenance, use, and dis- fidentiality, and security of · The Task Force believes the semination of criminal justice criminal justice information new body should include record information by law is necessary to build upon representatives of public- enforcement agencies, in- the work of the Task Force and private-sector organiza- and provide advice and tions that create, use, com- cluding State central reposi- guidance to local, State, and pile, or sell criminal justice tories and the FBI, the courts, Federal agencies, courts, information. Examples of and commercial compilers and policymakers on the categories of entities that and resellers of criminal jus- many issues surrounding the the Task Force believes collection, use, mainte- should be represented in the tice record information. nance, and dissemination of new body include: law en- criminal justice information. forcement, the courts, Commentary: · The Task Force believes prosecutors, corrections, · When the first criminal there is a need, at least in criminal history reposito- history record privacy prin- the short term, for an insti- ries, academics, privacy ad- ciples were developed in the tutionalized entity responsi- vocates, commercial mid-1970s, they were de- ble for making considered compilers, and the media. signed to regulate the ac- public policy recommenda- Public-sector representation tions of a relatively limited tions with respect to all is- should include Federal, number of entities. Today, sues associated with the State, and local officials, as CHRI is collected, main- increasing demand for appropriate. tained, used, and disclosed criminal justice information · The Task Force believes by numerous types of enti- and the privacy risks associ- that a short-lived body will ties, including, in particular, ated with that demand. Al- be sufficient to guide the law enforcement agencies though the Task Force has formulation of a new gen- (local police, State central

Page 72 Report of the National Task Force on Privacy, Technology and Criminal Justice Information repositories, and the FBI); Commentary: Individuals disclosure law and policy for courts; and commercial who are aggrieved by privacy criminal history record in- compilers and resellers. violations arising from their ar- Thus, it makes little sense rest and/or conviction informa- formation, taking into ac- and achieves little purpose tion face substantial legal count the type of criminal to fashion privacy and con- hurdles if they are to obtain any history record information; fidentiality policy and law type of relief. The outcome of a the extent to which the data- that applies to only one of judicial privacy challenge pivots these sectors. on the nature of the privacy base contains other types of complaint (was the information criminal justice information · On the other hand, certainly incomplete or inaccurate? old or there can be differences in (victim and witness informa- otherwise not relevant? subject standards for collection, tion, or intelligence or inves- to a seal or purge order? used maintenance, use, and dis- tigative information) and without the individual’s knowl- closure based upon special edge or opportunity to re- sensitive personal informa- considerations pertaining to spond?); the identity or category tion (medical or financial in- each of these sectors. Not- of the defendant (was it a Fed- withstanding these differ- formation, and so on); the eral or State law enforcement ences, any law or policy purpose for the intended use agency? a court? the media? a should at least take into ac- commercial information bro- of the information; and the count and, where possible, ker?); as well as the nature of onward transfer of the infor- synthesize or rationalize the alleged harm (can the indi- standards among the various mation (the redissemination vidual/plaintiff demonstrate sectors that collect, main- of the criminal history infor- tangible harm or “merely” in- tain, use, and disclose tangible harm, such as stigma or mation by downstream us- CHRI. embarrassment?). These factors, ers). · Any standards established as well as the victim’s legal the- for private actors, such as ory (tort, statutory rights, or Commentary: the media and commercial constitutional rights) and the · In assessing the privacy risk compilers, should carefully interplay of these legal theories posed by CHRI, the source consider the first amend- with the defendant’s legal and of the information is un- ment interests of these enti- constitutional rights to obtain, likely to be a compelling ties. use, and disseminate CHRI, de- consideration. If the source termine the outcome of most is a central repository, for Recommendation III: The criminal history privacy claims. example, as opposed to a Task Force recommends that In the new information era court, why does this affect where CHRI — even aged or the adequacy of existing legal the privacy impact on the purged information — remains individual? remedies for invasions of pri- not just available, but easy and vacy arising from the use of inexpensive to use and dissemi- · On the other hand, the type of criminal history informa- criminal history record in- nate, the question arises whether traditional judicial remedies tion seems far more likely formation should be reex- remain meaningful. to create a privacy impact. amined by legal scholars, Arguments can be made, for State legislatures, Congress, Recommendation IV: The example, that: State and Federal agencies, Task Force recommends the — Juvenile justice record and the courts. development of a new gen- information should be treated differently than eration of confidentiality and adult CHRI.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 73 — Witness and victim in- dedicated exclusively to a intelligence and investiga- formation should be review of intelligence and tive information and infor- treated differently. mation systems, a separate investigative systems, and the Task Force or initiative ex- · Further, arguments can be law and privacy issues related amine both the privacy risks made that the purpose of the and the important public intended use should be a to those systems. safety interests relating to criterion for shaping privacy these systems. The sources, policy. Relevant questions Commentary: requirements for confirma- as to use include the fol- · Task Force members agree tion (accuracy) of data, re- lowing: that intelligence and inves- tention, dissemination, — Should the traditional tigative information systems purpose, and usage policies distinction between are growing in number and for criminal intelligence and criminal justice uses size. Moreover, these sys- investigative data are differ- and noncriminal justice tems sometimes contain ent than those policies as uses be retained? CHRI and other types of they relate to CHRI and sensitive personal informa- should be separately exam- — Should there be any 278 tion. The ubiquity and ined by a Task Force with distinctions among importance of these systems criminal justice uses? greater representation from appear to be having an im- the intelligence and investi- — Should governmental, pact upon the information gative community than was noncriminal justice be culture, and appear to pose present on this Task treated differently than privacy risks. Force.279 private, noncriminal · Task Force members also justice uses? agree that intelligence and — Should national security investigative information use continue to receive should be addressed as part a high priority? of any new generation of privacy policy. The Task 279It bears emphasis that criminal in- — Is there a meaningful Force recommends, how- telligence and investigative systems, while both different than criminal his- distinction between li- ever, that prior to crafting censing uses and em- tory systems, are also very different proposed law or policies for from each other: ployment uses? Criminal Intelligence Information vs. — Should the identity (as 278The RISS.NET (Regional Infor- Investigative Information opposed to the purpose) mation Sharing Systems) and its com- § Proactive vs. Reactive of the prospective user patible components — Western States § Prevention vs. Identification Information Network’s (WSIN) State- § Not intended for court vs. In- be a criterion for im- tended for court posing restrictions? wide Integrated Narcotic System (SINS), the California Bureau of In- § “Soft” information vs. “Hard” vestigation’s Automated Criminal In- information Recommendation V: The telligence File (ACII), and the § Not necessarily crime-related vs. Southwest Border States — are among Must be crime-related Task Force recommends that the most important criminal intelli- Organizations that have extensive expe- intelligence and investigative gence systems. Both the SINS and rience in these arenas, and which would information also be addressed ACII have developed integrated data need to be represented in any review of submission capabilities between inves- the privacy implications of intelligence by new privacy law and pol- tigations and criminal intelligence. and investigative systems, include: the icy, but that this process Each operates under file guidelines RISS, the Law Enforcement Intelli- (CFR 28, part 23 governs Federal sys- gence Unit (L.E.I.U.), and the Board of should begin with the estab- tems, and the ACII follows the Califor- Directors for the Association of State lishment of a Task Force nia Attorney General’s Criminal Criminal Investigative Agencies Intelligence File Guidelines). (ACIA).

Page 74 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Data quality and security are Commentary: · Mismatched information important (applying the wrong CHRI · Use of fingerprints when to the wrong person) is a conducting record checks is major privacy risk and is as- Recommendation VI: The a means of enhancing data sociated with name-only Task Force recommends that quality and data accuracy, checks. This also provides a by reducing the potential for legislators and criminal his- basis for the use of finger- identification errors that tory record information sys- printing. In some jurisdic- may result in a false positions a “name-only” check tem managers develop, tive or false negative re- is used as an initial screen implement, and use the best sponse to a background and is then followed by a check or other type of in- available technologies to fingerprint check only if the quiry. promote data quality and data name check indicates a po- security. · Requesting or requiring fin- tential record match. Al- gerprints to compare to ex- though this reduces the Commentary: Data security isting criminal history potential for a false positive, and data quality are fundamen- records gives the individual it does not reduce the po- tal fair information practices. notice and, if optional, the tential for a false negative. opportunity to consent to The Task Force believes that it · The use of aliases creates a the records check. Name- is vital that the system managers risk that name-only checks only checks, by contrast, in the criminal history informa- will not retrieve available can be conducted without tion community continue to criminal histories, thus cre- the individual’s knowledge promote the quality and security ating a public safety risk. or consent. On the other of data through the use of new This also provides a basis hand, several Task Force technology. for fingerprint-based members noted that obtain- searches. Recommendation VII: ing fingerprints is more in- trusive than a name-only · Commercial compilers and The Task Force recommends check. resellers of CHRI and their that criminal history record customers seldom have ac- · Changes in technology cess to fingerprints. Future information, whether held by (livescan and IAFIS) may changes in technology, the courts, by law enforce- soon make fingerprinting however, may make the use ment, or by commercial just as quick, convenient, of fingerprints more practi- and inexpensive as “name- compilers and resellers, cal and cost-effective. The only” checks. should, subject to appropriate Task Force encourages the safeguards, be supported by · Relying on “name-only” use of fingerprints when checks inevitably means and accessible by fingerprints practical. that requesters must collect · The collection and use of to the extent legally permis- and use more demographics, fingerprints should be ac- sible and to the extent that such as Social Security companied by appropriate numbers. This carries its technology, cost, and the safeguards to ensure the ac- own privacy risk and pro- availability of fingerprints to curacy, security, and confi- vides a further argument in dentiality of the fingerprints both database managers and favor of fingerprinting. users make this practicable. collected. In cases where fingerprints are requested (such as in the employment context) rather than required (such as in arrest context),

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 75 individuals should receive standards for a purge or seal serve important privacy in- notice prior to the collection order vary substantially terests and should be avail- of fingerprints of the col- among the States, but turn able to the courts and lecting entity’s information on the type of offense, the criminal justice agencies, practices, including whether number of previous of- particularly in the case of the fingerprints will be re- fenses, and the establish- individuals who have been tained or databased for fu- ment of a “clean record” falsely accused. ture use. period. The methods for · The Task Force recognizes obtaining a seal or purge that while it is inefficient order also vary substantially Recommendation VIII: for all levels of the criminal among the States and in- The Task Force recommends justice system to retain all clude statutory or automatic criminal history records in that criminal history record sealing or purging mecha- perpetuity, records should information should be sealed nisms, as well as record be retained permanently by subject-initiated and court- or expunged (purged) when at least one agency, such as ordered purging and sealing. the record no longer serves the FBI at the Federal level an important public safety or · Sealing standards should and the State repositories at other public policy interest. A apply not only to criminal the State level, unless ex- history records at the central pungement has been or- sealed record should be un- State repository, but also to dered by a competent court sealed and available for original records of entry and or authority. to commercially maintained criminal justice and/or public · The Task Force recommen- CHRI. use only when the record dation pertains to the crimi- subject has engaged in a sub- · Several Task Force mem- nal history record of living sequent offense or when bers supported the position persons. The Task Force that expunging a criminal does not believe all records other compelling public pol- history record from all lev- need to be retained or sealed icy considerations substan- els of the criminal justice in perpetuity. There may be tially outweigh the record system should not be done some records, however, that subject’s privacy interests. because it effectively “re- should be retained beyond During the period that a writes history” and creates the death of the record sub- the potential for confusion. ject for academic or gov- criminal history record is They argued that this confu- ernment oversight purposes. sealed, use and disclosure sion is exacerbated by the In addition, it may be ap- should be prohibited. fact that the media and propriate to unseal some re- commercial compilers of in- cords following the death of Commentary: formation increasingly re- the subject (or some reason- tain a record of the able duration thereafter) for · At present, laws in 40 States underlying event. Although academic or government provide for the purging of it may be advisable from a oversight purposes. nonconviction information privacy standpoint to regu- and in 26 States for the late future disclosures of a purging of conviction in- Recommendation IX: The particular record, the record Task Force recommends that formation. Also at present, itself should not be de- laws in 31 States provide stroyed. The Task Force as individuals who are the sub- for the sealing of noncon- a whole, however, declined ject of criminal history record viction information and in to adopt this position, not- information be told about the 30 States for the sealing of ing that expungement could conviction information. The practices, procedures, and

Page 76 Report of the National Task Force on Privacy, Technology and Criminal Justice Information policies for the collection, · Although individuals may Union, U.S. policymakers maintenance, use, and disclo- not have a choice about be- have recently taken a new ing arrested, once the indi- look at the availability and sure of criminal history in- vidual is arrested, he or she practicality of remedies for formation about them; be has some choice about the violation of privacy law and given a right of access to and disposition of the charges. regulations. Most States correction of this informa- This choice may affect the provide for both civil reme- type of information that be- dies and criminal penalties tion, including a right to see a comes a part of a criminal in the event of a violation of record of the disclosure of the history record. For example, their criminal history record information in most circum- if the individual enters a statute. It is not clear, how- stances; and enjoy effective drug court or into a par- ever, whether these reme- ticular type of diversion or dies are practicable or remedies for a violation of probation program, the con- convenient for record sub- any applicable privacy and sequences of that choice in- jects. Furthermore, there is information standards. In ad- clude different information reason to believe that these dition, the Task Force rec- consequences. remedies are seldom in- voked. Finally, these reme- ommends that States · At present, the law in 43 dies do not apply to courts States requires the creation establish meaningful over- or commercial compilers and maintenance of trans- sight mechanisms to ensure and resellers. action logs (records de- that these privacy protections scribing the use and · The Task Force noted, how- are properly implemented disclosure of criminal his- ever, that a number of laws and enforced. tory records), and requires provide at least some of the that record subjects be given types of protections called Commentary: access to the logs. These for by this recommendation. laws provide a significant The Fair Credit Reporting · This recommendation pro- privacy benefit. The Task Act, for example, provides motes transparency in the Force believes that courts individuals with rights re- collection, use, disclosure, and commercial providers garding the use of CHRI in and retention of CHRI. The of CHRI should be required the employment context. Task Force believes that re- to maintain these types of quiring the publication and logs, and provide access to distribution of notice of the Recommendation X: The record subjects as well. Ac- Task Force recommends that system’s data practices will cess to information con- promote a continued dia- tained in these logs may, where public safety consid- logue and review of privacy however, need to be re- erations so require, the record issues and policies. stricted in certain instances of a juvenile offender who · Increasingly, notice is a if disclosure would impli- commits an offense which, if fundamental part of every cate attorney-client privi- committed by an adult, would information privacy law and lege, attorney work product standard. In addition, pro- privilege, or where disclo- be a felony or a violent mis- viding record subjects with sure would interfere with demeanor, be treated in the a right of access is also a ongoing investigations ei- same manner that similar ther by law enforcement or means of improving data adult records are treated. accuracy. employers. Even if a State opts to retain · In part as a result of pres- stronger privacy and confi- sure from the European dentiality rules for these

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 77 types of juvenile records, · The Task Force discussed · The Task Force believes these records should be fin- the question of whether that in certain circum- there should be a minimum stances, juveniles deserve a gerprint-supported and age requirement incorpo- “second chance,” and, should be capable of being rated into this recommen- therefore, these juvenile re- captured in an automated, dation. Although most Task cords warrant greater pri- national system. Force members agreed that vacy protection than adult age is a relevant factor, a records. On the other hand, Commentary: consensus age was not the Task Force also believes reached. Broadly speaking, that juvenile adjudications · Juvenile justice record pol- Task Force members were for serious offenses should icy is currently the subject more comfortable applying be available for public of debate in the Congress the recommendation to safety purposes on the same and many State legislatures. older juveniles than to basis as adult adjudications. Legislation currently before younger juveniles. Several Public safety purposes in- Congress would grant Task Force members sug- clude law enforcement uses, greater access to juvenile gested 14, although others court uses, uses by the justice information arising found that age to be too military, uses for back- from offenses that would be low. Another Task Force ground checks for security considered a felony, or in member observed that fo- clearances, screening fire- some bills a violent felony, cusing on the age of the of- arms purchasers, and uses if committed by an adult. fender, rather than the crime for background checks for These bills would create in- committed, is a flawed ap- sensitive public and private centives for States to dis- proach, citing cases, par- employment positions. seminate information on ticularly in the narcotics juvenile violent felonies on trafficking context, where Data integration and amalga- the same basis as records adults and older juveniles mation issues are important relating to adult felonies. In use young children to com- most instances, however, mit crimes, knowing that Recommendation XI: The the legislation would restrict the child will face only lim- Task Force recommends that access to information about ited repercussions. juvenile offenses to the criminal justice record infor- courts, law enforcement · Even if States opt to retain a mation law and policy should agencies, and schools. juvenile justice record information policy that pro- restrict the combining of dif- · The Task Force recognizes vides more confidentiality ferent types of criminal jus- that State law and State and privacy protections than tice record information into practice with respect to the is provided for adult re- databases accessible to non- administration of juvenile cords, States should: require justice systems and record- fingerprinting so as to be criminal justice users and keeping varies substantially. able to reliably identify the should restrict the amalga- Implementing this recom- juvenile; and require that mation of criminal justice mendation will likely re- these records be captured in record information in data- quire greater cooperation a manner that at least cre- bases with other types of per- and coordination among the ates the capability to share States to ensure that the these records on a national sonal information, except type and quality of data basis. where necessary to satisfy collected are similar across public policy objectives. the States.

Page 78 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Commentary: policy need not be ex- Commentary: pressed in terms of legisla- · As a matter of law and cus- · Advances in information, tion, but may also result tom, CHRI has been limited identification, and commu- from judicial decisions or to subject identification in- nications technologies and executive branch policies. formation; a history of ar- related software pose chal- rests and dispositions; and, · This recommendation lenges to existing criminal occasionally, other types of would restrict the creation justice record privacy and information, such as juve- of profiling databases that information law and policy. nile record information, would combine CHRI with At the same time, advances special felony conviction other types of personal in- in these technologies create flags, or pretrial release information. This is a for- opportunities to use these formation. ward-looking technologies to improve the recommendation, as the accuracy of criminal justice · The law in over a dozen Task Force is unaware of record information; improve States restricts CHRI from the existence of any such the security of this informa- being integrated or com- database at present. What is tion; and improve the ability bined with intelligence and customary, and would re- of criminal record managers investigative information. main unchanged by this to distinguish among vary- Even more States have recommendation, is the ing types of criminal justice adopted law or standards ability of commercial com- information and manage that prohibit combining pilers and investigators to this information with differ- CHRI with juvenile record gather both CHRI and other ent policies for retention, information. types of personal informa- use, and disclosure. · In recent years, a number of tion from disparate sources · The Task Force gave strong studies and reports have as part of an investigation, emphasis to the role that in- called for expanding crimi- consumer report, back- formation, identification, nal history records to in- ground check, or similar in- and communications tech- clude information about quiry. nologies play as a change victims, witnesses, and cer- driver and as a threat to tra- tain other third parties. Recommendation XII: ditional privacy protections. Amalgamation, therefore, The Task Force recommends potentially implicates the · These technologies, how- privacy and safety interests that where public policy con- ever, can also be used to of those other than offend- siderations require amalga- enhance and protect pri- ers and arrestees. mation of information, vacy. New technologies, including, in particular, new · There are instances when systems be designed to rec- software technologies, are the amalgamation of various ognize and administer dif- both robust and nimble and types of criminal justice in- fering standards (including make it far easier, cheaper, formation or the amalgama- and faster to apply different tion of criminal justice dissemination policies and disclosure and other infor- information with other per- standards) based upon dif- mation policies to different sonally identifiable infor- fering levels of data sensitiv- types of criminal justice re- mation may be necessary to ity, and allow the flexibility cord information and other further public policy goals, personal information, even such as public safety. The necessary to revise those when the information is Task Force notes that public standards to reflect future maintained in the same da- changes in public policy. tabase or system. These technologies make it much

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 79 easier than it once was, for Commentary: Commentary: example, to distinguish · Privacy risks that arise from · The distinction between between conviction and integration should be man- conviction information and nonconviction data or to aged and minimized. nonconviction information combine juvenile justice in- (“nonconviction informa- formation with adult crimi- · Integration can serve a vari- tion” is customarily defined nal justice information, ety of socially beneficial to mean “an arrest which is while retaining the ability to purposes. Integration, for over 1 year old without a provide enhanced confiden- example, can help move ac- disposition, as well as ac- tiality protections for juve- cused offenders more quittals and other disposi- nile justice information. quickly, efficiently, and tions which do not involve a cost-effectively through the conviction”280 has long been criminal justice system, Recommendation XIII: a cornerstone of criminal thereby reducing the The Task Force recommends history record privacy pol- amount of time the accused icy. Conviction information that the integration of crimi- spends in jail awaiting trial is not only available to the nal justice information sys- and the amount of time vic- criminal justice system, but tims must wait to have their tems should be encouraged in is widely available to gov- day in court. recognition of the value of ernmental, noncriminal jus- integrated systems in im- · Some types of integration tice agencies and to many proving the utility, effective- — such as integrating types of employers and criminal history record sys- other noncriminal justice ness, and cost efficiency of tems with intelligence and users. Nonconviction in- information systems. Prior to investigative systems, or formation, even in the late establishing integrated sys- with systems that contain 1990s, remains largely un- tems, however, privacy im- medical, financial, or other available to the general very sensitive personal in- public (at least from State plications should be formation — are especially central repositories) and examined, and legal and pol- privacy-sensitive and should only partly available to pri- icy protections in place, to be subject to appropriately vate-sector employers and ensure that future public- and strong privacy protections. other users. private-sector uses of these · Valid arguments exist for Recommendation XIV: information systems remain States to treat nonconviction The Task Force recommends consistent with the purposes information with more con- that new criminal justice pri- fidentiality and privacy for which they were origi- vacy law and policy should protections than conviction nally created. In addition, information, given that non- continue to give weight to the once an integrated system is conviction information car- distinction between convic- created, any future uses or ries a presumption of tion information and noncon- innocence; that its dissemi- expansions of that system viction information. The Task nation frustrates efforts to should be evaluated to assess reintegrate arrestees into so- Force recognizes, however, the privacy implications. ciety; and that dissemina- that there are certain in- tion of nonconviction stances in which disclosure of information exacerbates the nonconviction information 280 may be appropriate. See glossary of criminal justice information terms included as Appendix 2.

Page 80 Report of the National Task Force on Privacy, Technology and Criminal Justice Information disproportionate impact that Martin Luther King, Jr., for CHRI oftentimes has upon loitering and an array of minorities. other offenses during the civil rights movement of the · The fact that a State re- 1960s is a valuable record pository may not have a illustrating improper gov- disposition within 1 year of ernment action. Information arrest, which is the tradi- concerning false arrests re- tional standard, should not sulting not from malice, but necessarily preclude the re- from error or negligence pository from disclosing also serves a valuable over- any information. In such sight function. circumstances, the State repository should be able to point a requestor to the court in question so the requestor can inquire as to the disposition status. In re- sponding to some inquiries, such as those made pursuant to the National Child Pro- tection Act, the State is af- firmatively required to track down dispositions. · Examples of appropriate disclosure of nonconviction information most frequently cited by Task Force members involved sex offenses against young children and rape arrests where the victim failed to testify. Several Task Force members pointed out that parents would want to know that a prospective child-care worker had been arrested for child molestation, even if this individual was never convicted. · Some Task Force members also noted that arrest information, regardless of disposition, is of historical and social interest and is a valuable government oversight tool. It was observed, for example, that information concerning the arrest of Dr.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 81 VII. Conclusion

This report and the Privacy Task more frequently seen to out- Force’s other efforts come at a weigh other interests, including critical juncture. Fundamental personal privacy, than is the reassessments and changes re- case in other information sec- garding the rules for the han- tors. dling of personal information are under way not only in the These differences between the criminal justice information collection and use of criminal community, but also in many justice information and other other information sectors, in- types of personal information do cluding medical information, not mean that changes in the financial information, the online safeguards afforded to criminal collection of information, and justice information are unneces- public record information of sary or that changes will not various types. take place. These differences suggest, however, that any Many of the same change driv- eventual changes will likely re- ers identified in this report (such quire a delicate and difficult-to- as the Information Culture, new achieve balance to preserve the technology, new Business Mod- robust use of criminal justice els, and so on) have also im- information for socially benefi- pacted other information sectors cial purposes while finding and have fueled the reassess- ways to protect personal pri- ments and changes under way. vacy. There are differences, however, between the criminal justice The recommendations of the sector and other sectors where Task Force are a first step — reassessments are under way. but only a first step — in the These differences could have an development of a new genera- impact on how change in the tion of criminal justice informa- criminal justice information tion law and policy that sector proceeds. First, as the achieves an important, nuanced public opinion survey data in balance between the use of the companion report indicate, criminal justice information and the criminal justice system may the privacy interests of those to benefit from a higher overall whom the information pertains. level of public trust than other sectors that use personal information. Second, the public safety value associated with access to, and disclosure of, criminal justice information is

Page 82 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Appendix 1:

Task Force participants

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 83 Page 84 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Task Force participants

Chair Robert R. Belair Mullenholz, Brimsek & Belair; SEARCH General Counsel

Members Kathy T. Albert Global Network Coordinator, Global Justice Information Network, U.S. Department of Justice

Dr. Ann Cavoukian Commissioner, Office of Information and Privacy Commissioner, Ontario, Canada

Hon. Thomas M. Cecil Judge, Sacramento Superior Court, California

Col. Timothy J. DaRosa Deputy Director, Division of Administration, Illinois State Police

James X. Dempsey Senior Staff Counsel, Center for Democracy and Technology

Dr. David H. Flaherty Principal Officer, David H. Flaherty Inc., Privacy and Information Consultants

Dr. Charles M. Friel Professor, College of Criminal Justice, Sam Houston State University, Texas

David Gavin Assistant Chief of Administration, Crime Records Service, Texas Department of Public Safety

Roger W. Ham Chief Information Officer, Los Angeles Police Department, California

Ronald P. Hawley Assistant Director, Division of Criminal Information, North Carolina State Bureau of Investigation*

Hon. Catherine D. “Kitty” Kimball Associate Justice, Supreme Court of Louisiana

Prof. Jane E. Kirtley Silha Professor of Media Law and Ethics, School of Journalism and Mass Communications, University of Minnesota

Linda Lightfoot Executive Editor, The Advocate

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 85 Anthony S. Lowe Senior Legislative Counsel, Subcommittee on Antitrust, Business Rights, and Competition, U.S. Senate Judiciary Committee

Dr. Barry Mahoney President, Justice Management Institute

Prof. Kent Markus Visiting Professor, Capital University Law School, Ohio

Hon. Gordon A. Martin, Jr. Associate Justice, District Court Department, Massachusetts Trial Court

Thomas R. McMahon General Counsel, Illinois Department of Human Services

Iris Morgan Senior Management Analyst II, Criminal Justice Information Services, Florida Department of Law Enforcement

Deirdre Mulligan Staff Counsel, Center for Democracy and Technology

Ron Oldroyd Assistant Juvenile Court Administrator, Utah

Lawrence F. Potts Director, Administrative Group, Boy Scouts of America

Jack H. Reed Chairman, I.R.S.C., Inc. and Confidential Business Resources, Inc; Vice President, DBT Online, Inc.

Jack Scheidegger Chief Executive Officer, Western Identification Network, Inc.

James F. Shea Assistant Director of Systems, New York State Division of Criminal Justice Services

Harold M. “Hal” Sklar Attorney-Advisor, Criminal Justice Information Services Division, Federal Bureau of Investigation

Prof. George B. Trubow** Director, Center for Information Technology and Privacy Law, The John Marshall Law School, Illinois

Page 86 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Donna M. Uzzell Director, Criminal Justice Information Services, Florida Department of Law Enforcement

William C. Vickrey Administrative Director of the Courts, Administrative Office of the California Courts

Dr. Alan F. Westin Professor Emeritus of Public Law and Government, Columbia University, New York

Dr. John Woulds Director of Operations, Office of the Data Protection Registrar, United Kingdom

Bureau of Justice Statistics, U.S. Department of Justice Dr. Jan M. Chaiken‡ Director

Carol G. Kaplan Chief, Criminal History Improvement Programs

General Counsel’s Office, Office of Justice Programs, U.S. Department of Justice Anne Gardner Attorney-Advisor

Paul F. Kendall General Counsel

SEARCH, The National Consortium for Justice Information and Statistics Sheila J. Barton Deputy Executive Director Law and Policy Division

Gary R. Cooper Executive Director

Eric C. Johnson Policy Research Analyst Law and Policy Division

* Mr. Hawley is now Chief Information Officer, North Carolina Office of Information Technology Services ** Prof. Trubow has since retired ‡ Dr. Chaiken’s tenure as BJS Director ended in January 2001

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 87 Participants’ biographies

Robert R. Belair Mr. Belair has served as Dr. Cavoukian speaks Robert R. Belair is a partner consultant to numerous Federal extensively on the importance with the Washington, D.C., law agencies and commissions on of privacy around the world. firm of Mullenholz, Brimsek & information policy and law. He Her published works include a Belair and is General Counsel to is former Deputy General book on privacy titled Who SEARCH, The National Counsel and Acting Counsel of Knows: Safeguarding Your Consortium for Justice the Domestic Council Privacy in a Networked World Information and Statistics. He Committee on the Right of (McGraw-Hill, 1997). also serves as Chief Executive Privacy, Office of the President. Officer of Privacy and Dr. Cavoukian received her Legislative Associates, a legal Mr. Belair is a graduate of M.A. and Ph.D. in psychology and policy consulting firm. The Kalamazoo College (Michigan) from the University of Toronto. principal emphasis of Mr. and Columbia University She specialized in criminology Belair’s practice is privacy and School of Law. and lectured on psychology and information law involving the criminal justice system. administrative, legislative, and Dr. Ann Cavoukian litigation activity. His practice In May 1997, Dr. Ann Hon. Thomas M. Cecil includes counseling in all Cavoukian was appointed Judge Thomas M. Cecil has aspects of privacy and Information and Privacy served on the Sacramento information law, including Commissioner, Ontario, (California) Superior and credit, financial, educational, Canada. As Commissioner, Dr. Municipal Courts since March criminal, juvenile, medical, and Cavoukian oversees the 1989. During his tenure on the employment records and operations of Ontario’s freedom bench, he has presided over telecommunications; of information and protection of each of the criminal defamation; intellectual privacy laws, which apply to departments in both the property, including software both provincial and municipal municipal and superior courts. copyright; constitutional law; government organizations. She For the past 4 years, Judge Cecil and criminal justice serves as an officer of the has conducted felony trials, the administration. legislature, independent of the vast majority of which involved government of the day. murders. As General Counsel to SEARCH, Mr. Belair has Dr. Cavoukian joined the For the 6 years prior to his participated in SEARCH’s Information and Privacy appointment to the bench, Judge privacy and security programs Commission in 1987, during its Cecil served as Chief Counsel and has authored many studies start-up phase, as its first and Deputy Director of the in the area of criminal justice Director of Compliance. She California Department of information law and policy. He was appointed Assistant Consumer Affairs. His was actively involved in the Commissioner in 1990. Prior to responsibilities included development of SEARCH’s her work at the Commission, lobbying the California revised standards of criminal Dr. Cavoukian headed the Legislature on issues impacting history record information, Research Services Branch of the consumers, press relations, Technical Report No. 13: Ministry of the Attorney consumer education, and Standards for the Security and General, where she was overseeing the legal staff of the Privacy of Criminal History responsible for conducting Department. As an attorney, Record Information (Third research on the administration Judge Cecil practiced in a Edition). of civil and criminal law. variety of areas, including

Page 88 Report of the National Task Force on Privacy, Technology and Criminal Justice Information bankruptcy, corporate law, and serves as the Illinois point- Security Archive, a family law, political law, and of-contact for firearms nongovernmental organization general business litigation. He transactions relative to the that uses the Freedom of also served as Special Counsel National Instant Criminal Information Act to gain the to the Joint Select Committee on Background Check System declassification of documents Municipal Liability Insurance (NICS). on U.S. foreign policy. with the California Legislature. Col. DaRosa currently serves as From 1985-94, Mr. Dempsey Judge Cecil previously served Chairman of the Illinois LEADS was Assistant Counsel to the as a member and Chair of the Advisory Policy Board and is a House Judiciary Subcommittee Pacific Bell Telecommunica- member of the Federal Brady on Civil and Constitutional tions Consumer Advisory Panel Act Task Force Working Group, Rights. His primary areas of (1988-91). He is now a member and the International responsibility for the and current Chair of the Association of Chiefs of Police Subcommittee were oversight of California Judicial Council’s (IACP) Criminal Justice the Federal Bureau of Advisory Committee on Court Information Systems Investigation (FBI), privacy, Technology. Committee. Col. DaRosa’s and civil liberties. He worked professional affiliations include on issues at the intersection of Col. Timothy J. DaRosa the National Criminal Justice national security and Col. Timothy J. DaRosa is a 22- Association, the Police constitutional rights, including year veteran of the Illinois State Executive Research Forum, the terrorism, counterintelligence, Police. In March 1991, he was Illinois Association of Chiefs of and electronic surveillance, as appointed Deputy Director of Police, and the IACP. In well as crime issues, including the Division of Administration. November 1998, he was the Federal death penalty, He is responsible for an annual appointed by Illinois’ governor remedies for racial bias in death budget in excess of $35 million to serve on the SEARCH sentencing, information privacy, and over 750 employees who Membership Group. and police brutality. Mr. serve in the Bureaus of Dempsey has traveled to Russia, Communications, Criminal Col. DaRosa holds a B.S. Poland, Hungary, Bulgaria, Identification, Personnel, degree in criminal justice Guatemala, Chile, and Information Services, and administration from Southern Argentina to speak on civil Logistics, and the Crime Studies Illinois University at liberties issues. Section. Carbondale, and is a veteran of the U.S. Army. From 1980-84, Mr. Dempsey In his capacity as Deputy was an Associate with the Director, Col. DaRosa is James X. Dempsey Washington, D.C., law firm of responsible for the James X. Dempsey is Senior Arnold & Porter, where he administration of the Staff Counsel at the Center for practiced in areas of Department's Automated Democracy and Technology government and commercial Fingerprint Identification (CDT) in Washington, D.C. He contracts, energy law, and anti- System (AFIS), voice and data joined CDT in 1997, where he trust. He also maintained an communications systems, and works on fourth amendment and extensive pro bono the Illinois State Police data electronic surveillance issues. representation of death row center that includes the Law Prior to joining CDT, Mr. inmates in Federal habeas Enforcement Agency Data Dempsey was Deputy Director proceedings. He clerked for the System (LEADS). Col. DaRosa of the Center for National Hon. Robert Braucher of the also oversees the operation of Security Studies. From 1995-96, Massachusetts Supreme Court. the Firearm Owners Mr. Dempsey also served as Identification (FOID) Program Special Counsel to the National

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 89 Mr. Dempsey graduated from and Ph.D. in history from policy. His major book, Harvard Law School in 1979 Columbia University in 1963 Protecting Privacy in and from Yale College in 1975. and 1967, respectively. He Surveillance Societies: The He is co-author of Terrorism & taught at Princeton University Federal Republic of Germany, the Constitution: Sacrificing from 1965-68 and the Sweden, France, Canada and Civil Liberties in the Name of University of Virginia from the United States (1989), National Security (with Prof. 1968-72. In 1972, Dr. Flaherty examines how privacy and data Davie Cole of Georgetown Law joined the faculty at the protection laws for the public School). University of Western Ontario, sector work in practice. In where he taught history and law addition, he also has been an Dr. David H. Flaherty until accepting the position of editor and co-editor of six Dr. David H. Flaherty is Commissioner. His research and publications relating to various Principal Officer of David H. teaching fields include aspects of Canadian and Flaherty, Inc., Privacy and American and Canadian legal American studies, including Information Consultants, in history, information law and Challenging Times: The Victoria, British Columbia, policy, and privacy and data Women’s Movement in Canada Canada. He became British protection in modern industrial and the United States (1992). Columbia’s first Information societies. Several of Dr. Flaherty’s current and Privacy Commissioner in writings emanate from his role 1993. Appointed by the From 1971-72, Dr. Flaherty was as Information and Privacy government of British a Fellow in law and history at Commissioner, and discuss the Columbia, Dr. Flaherty had a 6- Harvard Law School; a Visiting principles and practical year, nonrenewable term of Fellow at Magdalen College, application of information and office. In this position, he was Oxford, in 1978-79; a Visiting privacy law in British an independent Officer of the Scholar at Stanford Law School Columbia. Legislature of British Columbia, in 1985-86; a Fellow of the and his role was to Woodrow Wilson International Dr. Charles M. Friel independently monitor the Centre for Scholars in Dr. Charles M. Friel is a administration of British Washington, D.C., during the Professor in the College of Columbia’s Freedom of 1992-93 academic year; a Criminal Justice, Sam Houston Information and Protection of Canada-U.S. Fulbright Fellow State University (Texas), where Privacy Act. (Law); a Visiting Scholar at the he previously served as Dean. Georgetown National Law Dr. Flaherty has over 20 years Center; and a Fellow of the In 1978 and again in 1984, Dr. of experience with privacy Kennedy Institute for Ethics, at Friel received fellowships from protection and access to Georgetown University. From the Japanese Ministry of Justice information issues as an 1985-87, Dr. Flaherty served as to study that nation’s academic, a teacher, an advisor, a Consultant to the Standing correctional system. In 1988, he a consultant, and an advocate. Committee on Justice and served as a visiting lecturer in He is recognized as one of the Solicitor General of the various police colleges in the world’s leading experts on Canadian House of Commons People’s Republic of China. privacy and data protection. for its report on the functioning of Federal access to information Dr. Friel has lectured Since 1965, Dr. Flaherty has and privacy acts. extensively throughout the been a full-time academic in the United States and Canada. He is United States and Canada. He Dr. Flaherty has written and an At-large Member of received a B.A. (honors) degree published four books and edited SEARCH, as well as a member in history from McGill two international bibliographies of its Board of Directors. He University in 1962, and an M.A. on privacy and data protection was the 1988 recipient of

Page 90 Report of the National Task Force on Privacy, Technology and Criminal Justice Information SEARCH’s O.J. Hawkins His education includes a leading-edge technologies. He Award for Innovative master’s degree from the started his career working for Leadership and Outstanding University of Texas, Austin. Mobil Oil Corporation as a Contributions in Criminal project engineer managing Justice Information Systems, Roger W. Ham command and control of field Policy and Statistics in the Roger W. Ham is the first Chief operations through automated United States. Dr. Friel is also Information Officer (CIO) of systems. He was the Bureau the 1992 recipient of the Justice the Los Angeles (California) Commander, Communications Charles W. Barrow Award for Police Department (LAPD). He Administrator, and Information distinguished service to the serves the Department at the Systems Manager for the City of Texas judiciary. level of Deputy Chief and Huntington Beach Police commands five divisions, Department in California for Dr. Friel’s undergraduate including Emergency Command over 21 years. studies at Maryknoll College and Control Communications (New York) included Systems, Communications, Chief Ham has an M.B.A. from philosophy and Latin; he Information Resources, Crime the University of Southern received a Ph.D. in Analysis Section, and the California and a bachelor’s experimental psychology from Systems Development Task degree in electrical engineering the Catholic University of Force. Chief Ham manages a from California State America, Washington, D.C. professional and operational University, Long Beach. He has staff of over 900, including served on many professional David Gavin sworn commanding officers and and business organizations. David Gavin has worked for the civilian managers. As Texas Department of Public Commanding Officer, he is Ronald P. Hawley Safety for 21 years. Since 1991, responsible for the conduct of Ronald P. Hawley began his Mr. Gavin has served as operations and the efficient career with the North Carolina Assistant Chief of the utilization of the financial and State Bureau of Investigation Department’s Administration human resources in the (SBI) in August 1973. Since Division. He held prior Information and January 2001, he has served as positions with the Texas Crime Communications Services CIO of the North Carolina Information Center, the Texas Bureau. Chief Ham directs and Office of Information Uniform Crime Reporting manages an annual technology Technology Services. Previous Program, the Texas project budget of over $400 to that, he served as Assistant Computerized Criminal History million. Director for the SBI’s Division File, and the Texas Automated of Criminal Information, a Fingerprint Identification As CIO, Chief Ham is position he had held since July System. Mr. Gavin’s current developing information systems 1993. Mr. Hawley’s early duties include responsibilities divisions, which are centers of assignments with the SBI for all those programs. competency with speed, included Special Agent, maneuverability, Assistant District Supervisor, Within the FBI’s Criminal responsiveness, flexibility, and District Supervisor, and a tour Justice Information Services accountability. He has a focused of duty with Governor’s (CJIS) advisory process, he has synergistic approach so that all Security. served as Chair of the Western units under his command work Regional Working Group and together toward the shared Subsequent to his appointment the National Crime Information vision and goals of the LAPD. to the Division, Mr. Hawley Center Subcommittee. He became involved with several currently is Chair of the FBI Chief Ham has over 28 years of committees and working groups CJIS Advisory Policy Board. experience in developing related to criminal justice

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 91 information technology. These that capacity until being elected Committee to Evaluate New include Co-chair of the Criminal as Associate Justice of the Judgeships; Member, Orleans Justice Information Network Supreme Court of Louisiana in Criminal and Civil Court Study Committee, member of November 1992. Committee; Member, Supreme the Criminal Justice Information Court Committee on the Judicial Services (CJIS) Southern Justice Kimball’s current Electoral Process; Member, Regional Working Group, and professional responsibilities and Louisiana Task Force on member of the CJIS Ad Hoc associations include: Member, Women in the Courts. She also Task Force on Security, Privacy Louisiana State Bar has been inducted into the and Policy Matters. Mr. Hawley Association; Member, American Louisiana State University Law is an At-Large appointee to the Judicature Society; Member, School Hall of Fame. SEARCH Membership Group. National Association of Women He previously was the Judges; Member, State-Federal Prof. Jane E. Kirtley governor-appointed member of Judicial Council; Member, Wex Jane E. Kirtley is the Silha SEARCH representing North Malone American Inn of Court; Professor of Media Law and Carolina, and served on the Charter Member, Louisiana Ethics at the School of SEARCH Board of Directors Association of Elected Women; Journalism and Mass and as Vice Chair of the Chair, Louisiana Supreme Court Communication, University of SEARCH Law and Policy Case Management Information Minnesota. Prior to assuming Program Advisory Committee. System Task Force; Member, her position at the University of Governor’s Task Force on Minnesota in August 1999, Mr. Hawley is a graduate of Violent Crime and Homicide; Prof. Kirtley served as Campbell College and received Member, Automated Fingerprint Executive Director of The a master’s degree in education Identification Selection Reporters Committee for from the University of Maine. Committee; and Chair, Judicial Freedom of the Press, a Budgetary Control Board. voluntary unincorporated Hon. Catherine D. “Kitty” association of reporters and Kimball Justice Kimball has previously editors devoted to protecting the The Honorable Catherine D. served as Past President, first amendment and freedom of “Kitty” Kimball serves as Louisiana Legislative Wives information interests of the Associate Justice of the Auxiliary; First Vice-President news media. In that position, Louisiana Supreme Court. Her and Member, Executive she was responsible for previous work experience Committee of the Louisiana overseeing the legal defense and included Law Clerk, U.S. District Judges Association; publications efforts of the District Court, Western District President and Member, Reporters Committee, as well as of Louisiana; Special Counsel, Louisiana State University Law supervising the group’s Louisiana Attorney General’s Alumni Association; Member, fundraising activities. Prof. Office; General Counsel, Louisiana Juvenile Judges Kirtley also edited the Louisiana Commission on Law Association; Member, National Committee’s quarterly Enforcement and Conference of State Trial magazine, The News Media & Administration of Criminal Judges; Member, 18th Judicial The Law. Justice; private solo practice; District Bar Association; and Assistant District Attorney Member, American Trial Prof. Kirtley has prepared for the 18th Judicial District. Lawyers Association; Chief numerous friend-of-the-court Judge, 18th Judicial District briefs on behalf of the Reporters In December 1982, Justice Court; Member, Governor’s Committee and other news Kimball was elected District Commission on Child Support; media organizations, including Judge, Division A, for the 18th Member, Economic Justice for Reno v. ACLU, Hustler Judicial District. She served in All Task Force; Member, Magazine v. Falwell, The

Page 92 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Florida Star v. B.J.F., and Lawyers and Representatives of education; and was Assistant Department of Justice v. Tax the Media, the Libel Defense Executive Editor prior to her Analysts. She frequently writes Resource, the Student Press present appointment as and speaks on media law and Law Center, and the editorial Executive Editor in 1991. freedom of information issues in board of Government the United States and abroad, Information Quarterly. In 1993, Ms. Lightfoot has and continues including Russia, Mongolia, Prof. Kirtley received the to be involved in many Belarus, Bulgaria, Latvia, Distinguished Service Award professional and community Romania, Poland, the Czech from the Newspaper Division of activities, including the Republic, Japan, Chile, the the Association for Education in American Society of Newspaper United Kingdom, Ireland, and Journalism and Mass Editors (ASNE), currently Canada. Prof. Kirtley also Communication, and in 1994, serving on its Board of writes “The Press and the Law” the John Peter Zenger Award Directors; as a member of the column each month for for Freedom of the Press and the Freedom of Information American Journalism Review, People’s Right to Know from Committee; and as and has appeared on programs the University of Arizona. In representative of ASNE on the such as “Nightline,” “All Things 1996, she was one of 24 National Conference of Lawyers Considered,” “The Jim Lehrer individuals inducted into the and Representatives of the News Hour,” “Good Morning Freedom of Information Act News Media, which is a America,” “Today,” Hall of Fame, established to committee of the ABA. She has “Donahue!,” “Crossfire,” commemorate the 30th also served as a Nominating “Burden of Proof,” “CNN & anniversary of the signing of the Juror for the Pulitzer Prize for Co.,” and the British Act. 1997 and 1998. She currently is Broadcasting Corp.’s “Law in on the Visiting Committee for Action.” She also has served as Prof. Kirtley obtained her J.D. the School of Communications, an Adjunct Professor with the degree in 1979 from Vanderbilt Loyola University; a member of American University School of University School of Law, the Society of Professional Communications Graduate where she served as Executive Journalists; a member of the Program. Articles Editor of the Vanderbilt Board of Directors of the Press Journal of Transnational Law. Club of Baton Rouge; a member Prior to her tenure at the She received bachelor’s and of the Louisiana Press Reporters Committee, Prof. master’s degrees from Association’s Legislative Kirtley was associated with the Northwestern University’s Committee; and a member of law firm of Nixon, Hargrave, Medill School of Journalism in the Louisiana Leadership Devans & Doyle. She is a 1975 and 1976. Alumni, a program of the member of the New York, Council for a Better Louisiana. District of Columbia, and Linda Lightfoot Virginia bars. Prof. Kirtley Linda Lightfoot is Executive In 1993-94, Ms. Lightfoot worked as a reporter of the Editor of The Advocate in Baton served on the Task Force to Evansville Press, the Oak Rouge, Louisiana. Ms. Study Cameras in the Trial Ridger, and the Nashville Lightfoot has been employed by Courts of Louisiana. She was Banner. Capital City Press, the publisher appointed by the Supreme Court of The Advocate, since 1965. of Louisiana to represent She serves on many advisory She started as a “society” writer, newspapers on the Task Force boards and committees, and has been a Reporter in the and authored the majority of the including the Freedom Forum’s areas of courts and education; report in favor of cameras. First Amendment Center, the headed the Capitol News American Bar Association’s Bureau, covering State Ms. Lightfoot received a (ABA) National Conference of government and higher bachelor’s degree in political

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 93 science and journalism from the as Senior Trade Intern, Dr. Mahoney's prior University of Mississippi, and International Trade professional work includes has studied at the Institute of Administration, Foreign and extensive experience in Politics, Loyola University, and Commercial Service, U.S. litigation as an Assistant the Louisiana State University Department of Commerce. Attorney General for the State Executive Program. of New York in 1962-67, and as Mr. Lowe received his B.A. a lawyer in private practice in Anthony S. Lowe (cum laude) degree in New York City in 1967-71. Anthony S. Lowe is Senior international political science During 1971-73, he was First Legislative Counsel to the U.S. from the University of Assistant Counsel for the New Senate Judiciary Committee’s Washington and his J.D. from York State Division of Criminal Subcommittee on Antitrust, the University of Santa Clara Justice Services. From 1973-78, Business Rights, and (California). He also studied at he was with the National Center Competition, a position he has the National University of for State Courts (NCSC), where held since 1997. He is Singapore Law School and the he was the Associate Director responsible for the development East China Institute of Politics responsible for all of the and introduction of crime- and Law. He is a member of the organization’s national-scope related legislation and handles Bars of Pennsylvania, research and technical all crime-related issues before Washington State, U.S. Court of assistance programs. In 1978-79 the full committee for the Appeals for the Ninth Circuit, and 1982-83, Dr. Mahoney was subcommittee chair. U.S. Court of International the Director of the London Trade, U.S. District Court for Office of the Vera Institute of Mr. Lowe’s prior experience the Western District of Justice. During 1979-82 and includes Legislative Assistant to Washington, and Washington, 1983-92, he was with the U.S. Sen. Slade Gorton (R-WA) D.C. NCSC’s Institute for Court from 1988-90, during which Management, where he led a time he was assigned to the Dr. Barry Mahoney number of national-scope these committees: Judiciary; Since 1993, Dr. Barry Mahoney research and technical Rules; Commerce, State, Justice has been President of The assistance projects focused on Appropriations; Government Justice Management Institute court delay reduction, Affairs; Impeachment Trial; and (JMI), a Denver-based, intermediate sanctions, and fine Indian Affairs. He also served nonprofit organization engaged use and collection. as Legal Counsel to the in education, research, and Washington State Senate, technical assistance focused on Dr. Mahoney has served as a Majority Office of Legal the operations of courts and lead faculty member for Counsel and Policy other organizations involved in educational programs conducted Development from 1991-92; as the administration of justice. He by the National Judicial Deputy Prosecutor in the King is responsible for overall College, the National County, Washington, management and program Association for Court Prosecutor’s Office; as Judicial development for JMI, and Management, and many other Extern for the U.S. Court of during 1998-99 he directed JMI national-, State-, and local-level Appeals for the Ninth Circuit, projects on reduction of organizations. Dr. Mahoney Judge Robert R. Beezer; as litigation cost and delay, drug served as a member of the Associate Director, International court planning and Advisory Panel for the Center for Economic Growth implementation, and court- Assessment of Alternatives for a and International Center for linked community justice National Computerized Self-Governance Programs of innovations. Criminal History System the Institute for Contemporary conducted by the Office of Studies, Washington, D.C.; and Technology Assessment of the

Page 94 Report of the National Task Force on Privacy, Technology and Criminal Justice Information U.S. Congress in 1979-82, and attention to juvenile crime, gun the State, and now operates a since 1997 has been a member violence, and criminal record special assignment session for of the SEARCH/Bureau of systems. cases from various Eastern Justice Assistance National Massachusetts courts. Task Force on Court Prior to his service at the DOJ, Judge Martin was a Trial Automation and Integration. Prof. Markus was the Chief of Attorney with the Civil Rights Staff at the Democratic National Division of the U.S. DOJ during Dr. Mahoney is a graduate of Committee. He also previously the Kennedy Administration and Dartmouth College and the served as Chief of Staff for thereafter First Assistant U.S. Harvard Law School, and holds former Ohio Attorney General Attorney for the District of a Ph.D. in political science from Lee Fisher. Earlier in his career, Massachusetts. He was Columbia University. Prof. Markus, a Cleveland subsequently a Commissioner of native, worked at law firms in the Massachusetts Commission Prof. Kent Markus Australia, Alaska, and Against Discrimination before Kent Markus is a visiting Washington, D.C., before organizing the firm in which he Professor at Capital University heading back home to clerk for was a partner until becoming a Law School in Columbus, Ohio, U.S. District Judge Alvin I. judge. and Director of Capital’s new “Buddy” Krenzer, practice law, Dave Thomas Center for and teach at Cleveland State In 1994, he was honored by Adoption Law, the first law Law School. On Capitol Hill, New England’s largest program school-based institution focused Prof. Markus worked for former for battered women, Casa on adoption law in the United U.S. House Speakers Carl Myrna Vasquez, for his work on States. Albert and Thomas P. “Tip” behalf of abused women. That O’Neill, and former House same year, Judge Martin was Before heading to Capital in the Rules Committee Chairman designated one of the three fall of 1998, Prof. Markus Richard Bolling. initial U.S. House of served as the Deputy Chief of Representatives “practitioner” Staff at the U.S. Department of Prof. Markus teaches appointees to the Federal Justice (DOJ) and as the Administrative Law, Remedies, Coordinating Council on highest-ranking advisor — and a seminar on the Role of the Juvenile Justice and Counselor — to Attorney Prosecutor at Capital Delinquency Prevention, General Janet Reno. During his University. He is a 1981 chaired by Attorney General approximately 5 years at the graduate of Northwestern Janet Reno. In that capacity, he DOJ, Prof. Markus, at various University’s School of Speech, participated in the preparation points in time, was responsible a 1984 honors graduate of of Combating Violence and for the national implementation Harvard Law School, and a Delinquency: The National of the Brady Handgun Violence graduate of the Kennedy Juvenile Justice Action Plan. He Prevention Act and the 1994 School’s Program for Senior was re-appointed to the Council Crime Act; established and was Executives in State and Local in 1998. Judge Martin also is the first director of the Government. completing his second term as a Community Oriented Policing trustee of the National Council Services (COPS) Office Hon. Gordon A. Martin, Jr. of Juvenile and Family Court (responsible for putting 100,000 Judge Gordon A. Martin, Jr., Judges. He spoke at the new community policing was appointed to the SEARCH/Bureau of Justice officers on America’s streets); Massachusetts Trial Court in Statistics National Conference managed the DOJ’s dealings 1983. He headed one of the on Juvenile Justice Records in with the Congress; and was the country’s frontline urban district 1996. DOJ’s point person on crime courts with the most gun, drug, policy in general, with special and domestic violence cases in

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 95 Judge Martin co-authored Civil individuals with developmental National Fingerprint File Rights Litigation: Cases and disabilities. Program, Uniform Crime Perspectives (Carolina Press Reports Program, and Criminal 1995), and has written law Mr. McMahon received his Justice Data Element review articles on a wide range undergraduate degree from the Dictionary, as well as redesign of topics, including juvenile University of Illinois and his of the Computerized Criminal justice articles in the J.D. from The John Marshall History file. Connecticut Law Review and Law School. Mr. McMahon is the New England Journal on an adjunct faculty member at Deirdre Mulligan Criminal and Civil DePaul University School of Deirdre Mulligan is Staff Confinement. Law (Illinois). Counsel at the Center for Democracy and Technology, a Judge Martin is a graduate of Iris Morgan public interest organization Harvard College and the New Iris Morgan is a Senior based in Washington, D.C., York University School of Law. Management Analyst II for the dedicated to preserving and Criminal Justice Information enhancing democratic values Thomas R. McMahon Services (CJIS) Program in the and civil liberties on the Internet Thomas R. McMahon is Florida Department of Law and other interactive General Counsel of the Illinois Enforcement (FDLE). She is communications media. As Department of Human Services. currently serving as the Staff Counsel, Ms. Mulligan The Department is comprised of coordinator for delivery of evaluates the impact of the former Departments of information services statewide, technology on individual Mental Health and supervisor of the CJIS Help privacy. She works with other Developmental Disabilities; Desk, and project leader for the privacy and civil liberties Alcohol and Substance Abuse; development and installation of advocates, the communications Rehabilitation Services; and the Florida Crime Information and computer industries, and portions of the Departments of Center (FCIC) II Workstation public policy makers to Public Aid, Public Health, and Software Project. Prior to strengthen fair information Children and Family Services. assuming that role, she was practices and enhance individual He administers the Division of responsible for conducting control over personal Legal Services and provides FCIC/National Crime information through the counsel to the Department on a Information System (NCIC) development of individual wide range of administrative, audits of criminal justice empowering policies and policy, and regulatory matters. agencies accessing the technologies. Currently Ms. FCIC/NCIC systems. Mulligan is shepherding the Prior to his employment with Internet Privacy Working Group the Department, Mr. McMahon Ms. Morgan has over 19 years — a collaborative public was associated with the firm of experience with FDLE and the interest/private-sector working Cappetta & Shadle, Ltd., and CJIS Program Area. During this group — developing a served as an Assistant States time she has served in a variety framework for privacy on the Attorney in Lake County, of technical, analytical, and Internet. Illinois. Before entering the supervisory positions. She has legal profession, Mr. McMahon also been instrumental in Prior to joining the Center, Ms. was employed by the Ray designing several major Mulligan worked on Graham Association for the criminal justice information information privacy issues in Handicapped in various system enhancements, emerging technologies at the capacities, including the including: the Offender-Based Electronic Frontier Foundation administration of sheltered Transaction System, Uniform (EFF). While at EFF, Ms. workshop programming for Offense and Arrest Reports, Mulligan staffed the National

Page 96 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Information Infrastructure Lawrence F. Potts Through the Boy Scouts of Advisory Council’s Lawrence F. Potts has served as America, Mr. Potts is able to Megaproject III on Privacy, Treasury Division Director and communicate with more than Security and Intellectual currently as Director of the 4.4 million youth and 1.1 Property for Co-chair Ester Administrative Group of the million adults of mixed ethnic Dyson. Boy Scouts of America. In his and racial backgrounds, and present position, he directs many others throughout society. Ms. Mulligan received her Information Systems, Currently, he holds the positions undergraduate degree from Properties, and Treasury. of Chairman, Boy Scouts of Smith College. She received her America Youth Protection Task law degree from Georgetown Mr. Potts has served with the Force; Chairman, Child Abuse University. National Council of the Boy Expert Advisory Panel; Scouts since 1982, and in his Chairman, National Ron Oldroyd current position since 1992. Collaboration for Youth Child Ron Oldroyd is the Assistant Prior to joining the National Sexual Abuse Task Force; and Juvenile Court Administrator Council, he had extensive Member, National Child Abuse for Utah. He began his career experience in the causality Coalition. He was a member of with the Juvenile Court in 1973 insurance industry, holding the U.S. Advisory Board on as a Deputy Probation Officer. positions of controller and Child Abuse and Neglect from Since then he has held a number treasurer and serving as a 1992-96. of positions within the Juvenile member of several boards of Court. He received his B.S. and directors. He also served with Mr. Potts is a Certified Public M.S. degrees from the the U.S. Armed Forces with the Accountant and, as such, a University of Utah. After rank of Captain. member of the American and receiving his M.S. degree in Texas Institutes of CPAs. He School Counseling, he left the Mr. Potts was an original also is a member of the court to work as an elementary member of the Boy Scouts of Association of Investment school counselor for 4 years America Youth Protection Task Analysts, the Southwest Pension prior to returning to the court as Force. In this capacity, he was Conference, and the Sentinel the Chief of Probation in Salt instrumental in creating several Institute. Lake City. tools for the prevention of child abuse in society and Scouting. Mr. Potts is a graduate of the During his tenure with the University of Texas, Austin, and courts, Mr. Oldroyd has been He also was an original member is a member of Beta Alpha Psi very involved with of the National Collaboration and Phi Kappa Phi programming for delinquent for Youth Sexual Abuse Task organizations. youth and Utah’s Juvenile Force. This is an association of Justice Management 16 not-for-profit youth-serving Jack H. Reed Information System. He is organizations interested in the Jack H. Reed is Chairman of currently chairing the re- prevention of child sexual I.R.S.C., Inc., an information engineering of this system, an abuse. This group pioneered provider company, and effort that is expected to take 3 efforts in information-sharing Confidential Business years. Mr. Oldroyd was also a and education about sexual Resources, Inc., a corporation participant in an initiative of the abuse among youth-serving recently formed by the merger U.S. DOJ’s Office of Juvenile agencies. Mr. Potts is the author of nine companies representing Justice and Delinquency of a paper on a model program’s all facets of the information Prevention to define juvenile efforts in the child abuse area. industry. probation and its expectations on a national level.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 97 Mr. Reed began his career in the which involved overseeing resulted in a recommendation personal finance business, Federal legislation issues in from the FTC in its “Report to where he spent 9 years, serving 1997-98. He is an active Congress” that no new in various management member of various other State, legislation was needed to positions. He has been a national, and international regulate the information licensed Private Investigator professional associations, and industry. since 1964, at which time he serves on various committees founded J.H.R.I., Inc., a private within these organizations. Jack Scheidegger investigation firm. Mr. Reed Jack Scheidegger is Chief founded I.R.S.C., Inc., in 1979 Mr. Reed has been appointed by Executive Officer of the and began selling public record the Software/Information Western Identification Network, and nonpublic information to Industry Association (SIIA) Inc., a position he has held since private investigators, Board of Directors to serve on 1996. Prior to his current corporations, insurance the Executive Committee of the appointment, Mr. Scheidegger companies, and financial Public Policy and Government was Chief of the Bureau of institutions in 1983. Relations Council. He also Criminal Identification and serves on the SIIA Committee Information in the California Mr. Reed entered Western State on Privacy and Information DOJ. University, College of Law in Regulation and chairs the State 1966. His graduation was Issues Working Group and He also has previously held the delayed until 1972 due to a Government Information Policy positions of Chief, Bureau of serious injury that left him Committee. Additionally, Mr. Forensic Services, California quadriplegic. During his Reed served on the privacy task DOJ; Director, Bureau of Medi- recovery period, J.H.R.I. force spearheaded by California Cal Fraud and Patient Abuse, continued to grow with Mr. State Sen. Steve Peace of California DOJ; and Legislative Reed at the helm. California (D-El Cajon). Advocate for the California Attorney General’s Office. As a member of the California In June 1997, Mr. Reed was Association of Licensed invited to attend the Federal Mr. Scheidegger previously Investigators, Mr. Reed has Trade Commission (FTC) served as California’s governor- served as President, and on the hearings, representing NCISS appointed Member to the Board of Directors as Vice and the Individual Reference SEARCH Membership Group. President of Investigations, Services Group (IRSG). Mr. As a SEARCH Member, he District Director, and Director at Reed is also a founding member served on its Board of Directors, Large. He served on the of the IRSG, which is based in as Chair of its Law and Policy Legislative Committee for over Washington, D.C., and is Program Advisory Committee, 20 years and re-engineered this comprised of representatives and as Chair of the Bureau of committee into a formidable from leading companies within Justice Statistics/SEARCH entity, which, since its the information industry who National Task Force on inception, has prevented any are addressing privacy concerns. Increasing the Utility of the negative legislation affecting the Mr. Reed was recently elected Criminal History Record. He private investigation and Vice Chair and Secretary- also has been a member of the security industry. Treasurer of the IRSG. This California Peace Officers group has compiled “Privacy Association, American Society Mr. Reed was President of the Principles,” which are intended of Crime Laboratory Directors, National Council of to serve as the industry model and the FBI/NCIC Western Investigation and Security for ethical and privacy Regional Working Group Services (NCISS), as well as its standards. These Principles (Control Terminal Officer). Legislative Committee Chair, were approved by the FTC, and

Page 98 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Mr. Scheidegger received his Mr. Shea holds a B.S. degree awarded a Congressional B.A. degree in public from Holy Cross College, an Fellowship with the American administration from California M.B.A. from Union College, Political Science Association in State University at Sacramento, and has participated in Washington, D.C. From 1966- and his master’s degree in Executive Training Programs at 68, Prof. Trubow was Deputy public administration from the Harvard’s Kennedy School of Counsel to the U.S. Senate University of Southern Government. Judiciary Subcommittee on California. Judicial Machinery. In 1968, he Harold M. “Hal” Sklar became Executive Director of James F. Shea Harold M. “Hal” Sklar is an the Maryland Governor’s James F. Shea is Assistant Attorney-Advisor to the Commission on the Director of Systems at the New Criminal Justice Information Administration of Justice, and York State Division of Criminal Services Division of the FBI, he served on the U.S. Attorney Justice Services. In this having been appointed to that General’s Advisory Council on position, he manages a broad position in September 1997. He Law Enforcement Education range of projects, including the received his J.D. and L.L.M. from 1968-70. State Automated Fingerprint from the Temple University Identification System, Store and School of Law (Pennsylvania) In 1970, Prof. Trubow joined Forward, and the development and the Georgetown University the Law Enforcement and support of systems Law Center, respectively. Half Assistance Administration developed for local agencies, of his 16 years of practice has (LEAA), U.S. DOJ, where he including law enforcement, been in government service, served as Deputy Director of prosecution, jails, and most notably as a Trial Attorney Law Enforcement Programs and probation. pursuing Employee Retirement Director of Inspection and Income Security Act (ERISA) Review, in charge of grant Mr. Shea manages the State’s fraud for the U.S. Department of programs to the States and federally funded National Labor, abusive tax shelter planning and program Criminal History Improvement promotion for the U.S. DOJ, development for LEAA. Program and Criminal Justice and savings and loan defalcation Records Improvement Program, (Resolution Trust Corporation). In 1974, Prof. Trubow became as well as automation projects General Counsel to the supported by the National Prof. George B. Trubow Committee on the Right to Institute of Justice and the From 1976 until his retirement Privacy, Executive Office of the Office of Juvenile Justice and in 2001, Prof. George B. President, during the Ford Delinquency Prevention, U.S. Trubow was a Professor of Law Administration. The Committee DOJ. He heads up the State at The John Marshall Law was concerned with the analysis criminal justice data School in Chicago, Illinois, and development of Federal standardization project, serves where he taught Information information and privacy law and on the Executive Board that Law and Policy, Cyberspace policy. Prof. Trubow returned to oversees data standardization Law, Privacy Law, and John Marshall in 1976. for all State departments, and Computer Law and directed the directs a statewide initiative to Center for Information Prof. Trubow is active in the re-examine record sealing and Technology and Privacy Law. ABA Section of Science and information dissemination. Mr. Technology; he was advisor to Shea previously served on the Prof. Trubow practiced law in the National Commission on Governor’s Task Force to Kansas and Missouri from Uniform State Laws in drafting improve information systems in 1958-61, and in 1961 became the Uniform State Information New York State. assistant at The John Marshall Practices Code; and was Law School. In 1965, he was Reporter for the Uniform

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 99 Criminal History Records Act. capabilities for law enforcement her work in the area of child He was Chair of the 1994 throughout the State; criminal safety, including a Law International Conference on justice information storage and Enforcement Officer of the Year Computers, Freedom and retrieval capabilities in Florida award. She has served on Privacy and was a longtime and over the entire Nation; several statewide task forces on member of the Board of criminal identification services; school and child safety and Directors of SEARCH. He has the ability to document and juvenile justice issues. In 1993, been an advisor to the Office of analyze criminal activity for the she completed a 4-month Technology Assessment of the entire State; statistical and crime special assignment to the U.S. Congress and to the trend analysis; criminal record Commissioner of Education on National Research Council in inquiry services for law enforcement and education Fraud Institute, and a member governmental, private, and collaborative relationships. In of the Federal Computer public record requests; 1993, she spent 5 months on Systems Security and Privacy improved system integrity special assignment to the Advisory Board. through biennial terminal audits; Florida Attorney General’s and a statewide training Office developing and Prof. Trubow has written and program for law enforcement. implementing the Florida spoken widely on the law of Prior to her appointment at Community Juvenile Justice information technology, FDLE, she was a Sergeant with Partnership Grant Program. “cyberspace,” and privacy. He the Tallahassee Police was law editor of IEEE’s Department and a member of William C. Vickrey Software magazine, and his that agency for 13 years. William C. Vickrey is Center for Information Administrative Director of the Technology and Privacy Law In 1988, Ms. Uzzell was elected Courts of the Administrative publishes a quarterly law to the Leon County (Florida) Office of the California Courts, review, The Journal of School Board and completed managing its legal, court Computer and Information Law. her 8 years in office, serving 2 services, fiscal, and other He is editor-in-chief of the years as Board Chair. During operations that support the three-volume treatise, Privacy the past 8 years, she has worked California judicial system. As Law and Practice (1987), and on safe school policy and Administrative Director of the co-author of the casebook, procedures and has conducted Courts, Mr. Vickrey also serves Privacy Law (1992). training throughout the State on as Secretary of the Judicial crisis intervention, safe school Council of California and the Prof. Trubow is a graduate of planning, interagency Commission on Judicial the University of Michigan, collaboration, and Serious Appointment, both of which are earning both bachelor’s and law Habitual Offender chaired by the Chief Justice of degrees. Comprehensive Action Program the California Supreme Court. (SHOCAP). She currently is an Donna M. Uzzell adjunct professor at Florida Appointed to the position in Donna M. Uzzell was appointed State University, teaching in the 1992, Mr. Vickrey has been Director of Criminal Justice School of Criminology, and is a responsible for many Information Services (CJIS) for consultant for Fox Valley improvements in the State the Florida Department of Law Technical College in Wisconsin. judicial system, including the Enforcement (FDLE) in development of a long-range November 1996, after serving as Ms. Uzzell is a certified crime planning process for State Special Agent in Charge of the prevention practitioner and courts, implementation of a Investigative Support Bureau. former Drug Abuse Resistance statewide budgeting system, and The CJIS program provides Education (D.A.R.E.) officer. coordination of trial court instant telecommunications She has received recognition for resources.

Page 100 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Prior to coming to the Dr. Alan F. Westin foundations. He also has Administrative Office of the Dr. Alan F. Westin is Professor consulted on privacy for over California Courts, Mr. Vickrey Emeritus of Public Law and 100 major and start-up was the State Court Government at Columbia companies, including IBM, Administrator for the Utah University; publisher of Privacy Security Pacific National Bank, Administrative Office of the & American Business; and Equifax, American Express, Courts. He also previously President of the Center for Citicorp, Bell, Prudential, Bank served as Executive Director for Social & Legal Research. He is of America, Chrysler, AT&T, the Utah Department of the author or editor of 26 books SmithKline Beecham, News Corrections, and Director for the on constitutional law, civil Corporation, Visa, and Glaxo Utah State Division of Youth liberties and civil rights, and Wellcome. Corrections. American politics. He also has spoken at more than Mr. Vickrey received the Dr. Westin’s major books on 500 national and international Warren E. Burger Award from privacy — Privacy and business and government the National Center for State Freedom (1967) and Databanks meetings on privacy issues since Courts in 1995. He previously in a Free Society (1972) — the early 1960s, as well as served as President of the were pioneering works in the appearing on all the national Conference of State Court field of privacy and data U.S. television networks to Administrators. protection, as were his field discuss current privacy studies for the U.S. National developments in business or Mr. Vickrey also co-authored Bureau of Standards, government. Managing Transition in a Youth Computers, Health Records, Corrections System (University and Citizen Rights (1976), and Between 1978-98, he has been of Chicago Press); drafted Computers, Personnel the academic advisor to Louis legislation to establish the Administration, and Citizen Harris & Associates for 20 Commission on Criminal and Rights (1979). national surveys of public and Juvenile Justice; and received leadership attitudes toward the 1984 James Larson Award Over the past 40 years, Dr. consumer, employee, and for Outstanding Contributions to Westin has been a member of citizen privacy issues in the Corrections. During 1985, he Federal and State government United States and Canada. He served as staff to the Governor’s privacy commissions and an also has worked with Opinion Judicial Article Task Force in expert witness before many Research Corporation on a Utah. This resulted in the State and Federal legislative dozen proprietary privacy passage of HB 100, which committees and regulatory surveys for companies and established the Court of agencies. These activities have industry associations. Appeals, among other reforms covered privacy issues in such of the judiciary. He also co- fields as financial services, In 1993, with Robert Belair, he authored “Utah Court of credit- and consumer-reporting, founded a national newsletter Appeals: Blueprint for Judicial direct marketing, medical and and information service, Reform” for the Utah Bar health, telecommunications, Privacy & American Business, Journal. employment, law enforcement, to provide expert analysis and a online and interactive services, balanced voice on business- Mr. Vickrey received his and social services. privacy issues. P&AB also bachelor’s degree from the conducts an annual national University of Utah. Dr. Westin has been a privacy conference in Washington on consultant to many Federal, “Managing the Privacy State, and local government Revolution,” attended by 250 agencies and private business, government,

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 101 academic, and public interest Staff biographies Dr. Chaiken and his wife, Dr. group representatives. P&AB Marcia Chaiken, who is now also conducts the Corporate — Bureau of Justice Director of Research at LINC in Privacy Leadership Program, Statistics, Alexandria, Virginia, and a Global Business Privacy U.S. Department of collaborated on numerous Policies Project. Justice research topics, such as varieties Dr. Westin earned his of criminal behavior, identifying bachelor’s degree from the Dr. Jan M. Chaiken career criminals for priority University of Florida, an L.L.B. Dr. Jan M. Chaiken was prosecution, drugs and crime, from Harvard Law School, and Director of the Bureau of Justice multijurisdictional drug task his Ph.D. in political science Statistics (BJS), U.S. DOJ, until forces, improving sample from Harvard University. He is January 2001. His appointment designs for learning about drug a member of the District of to this position by President use of arrestees, and private Columbia Bar and has been Clinton was confirmed in policing. listed in Who's Who in America September 1994. for three decades. During his tenure as BJS Dr. Chaiken earned his Ph.D. in Director, Dr. Chaiken has Dr. John Woulds mathematics at the focused on the use of modern Dr. John Woulds is Director of Massachusetts Institute of technologies, such as the World Operations at the Office of the Technology (MIT). He was an Wide Web, to provide the Data Protection Registrar, the Assistant Professor in the public with accurate, up-to-date supervisory authority mathematics department of statistics, to allow the rapid established in the United Cornell University; a Research interstate exchange of criminal Kingdom under the 1984 Data Associate at MIT; a Senior histories and information about Protection Act. Dr. Woulds has Mathematician at the Rand registries of sex offenders, to been in the Office of the Data Corporation in Santa Monica, facilitate the implementation of Protection Registrar since California, from 1972-84; an the FBI’s National Incident- March 1985. As Director of Adjunct Associate Professor in Based Reporting System, and to Operations, he is a member of the system sciences department develop improved computerized the Registrar’s Management of the University of California, tracking of Federal arrestees and Board and has responsibility for Los Angeles; and a Principal defendants through the criminal all operational aspects of the Scientist in the law and justice justice process. work of the office. This includes area at Abt Associates, Inc., in registration, complaints, Cambridge, Massachusetts, Carol G. Kaplan casework, investigations, from 1984 until his nomination Carol G. Kaplan is currently compliance casework, and as BJS Director. Chief, Criminal History policy advisory work in all Improvement Programs, BJS, sectors. Dr. Chaiken’s research has U.S. DOJ. In this capacity, she focused on developing and is responsible for managing all Prior to his appointment with applying methods for improving BJS programs that focus on the Data Protection Registrar, he operations of criminal justice improving the quality and worked for several years in agencies, including studies of accessibility of criminal history computer management in the criminal investigation records and the establishment of scientific computing centers. process, police patrol allocation, the national criminal record Before that, he was an active predicting prison populations, system. Ms. Kaplan is also research scientist in the field of models of the criminal justice responsible for all BJS activities high-energy particle physics. system, and statistical analyses to ensure the privacy of criminal of the Federal criminal justice record data and to support system. implementation of the Brady

Page 102 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Handgun Violence Prevention — Office of Justice information sharing. Prior to his Act and the National Child Programs, appointment as General Protection Act of 1993. U.S. Department of Counsel, Mr. Kendall held Justice positions of Senior Counsel at Previously, Ms. Kaplan served the Federal Mine Safety Board, as the Assistant Deputy Anne Gardner and Assistant General Counsel Director, BJS, overseeing Anne Gardner is an Attorney- of the Legal Services programs relating to criminal Advisor for the Office of Justice Corporation, as well as other justice information policy, Programs (OJP), U.S. DOJ, positions in public and private privacy policy development, under the Attorney General’s practice. and Federal justice statistics. In Honors Program. Ms. Gardner this position, she was is a member of OJP’s Mr. Kendall received his B.A. responsible for all BJS Intergovernmental Information degree from Columbia College publications, conferences, and Sharing Working Group, of Columbia University, his technical assistance dealing with Intelligence Systems Policy M.B.A. from the University of criminal history record issues, Review Board, and Privacy Maryland, and his J.D. from privacy policy, and Federal Task Force. The Catholic University of justice statistics. America, Columbus School of Ms. Gardner received her B.S. Law. His publications include Ms. Kaplan has been involved degree from the University of “Legislation: A New Design for in Federal activities relating to Wisconsin – Madison, and her Justice Integration,” 30 the development of privacy J.D. from The Catholic McGeorge Law Review 9 policy throughout her career, University of America, (1998). and participated in drafting the Columbus School of Law, cum initial landmark Federal laude. Her publications include — SEARCH, The National regulations ensuring the “Legislation: A New Design for Consortium for privacy, accuracy, and Justice Integration,” 30 Justice Information and completeness of criminal McGeorge Law Review 9 Statistics records and the confidentiality (1998). of federally supported research Sheila J. Barton data. She has served on Paul F. Kendall As a Deputy Executive Director numerous interagency task Paul F. Kendall, General of SEARCH, Sheila J. Barton is forces to develop policies and Counsel for OJP, is the responsible for the development standards applicable to record Executive Chairman of OJP’s and implementation of a usage and was a charter member Information Technology multifaceted program of public of the Office of Justice Executive Council, as well as policy analysis, documentation Programs’ Intelligence Systems Chairman of the Executive of State and Federal information Policy Review Board. Council’s Inter-governmental policy development, education, Information Sharing Working and assistance to State and local Ms. Kaplan was formerly an Group, the Intelligence Systems policymakers; the conduct of Attorney with the Department Policy Review Board, and the national conferences and of Health, Education and Privacy Task Force. Mr. workshops on justice Welfare and the Federal Kendall is leading a variety of information policy issues; and Communications Commission. efforts in developing State and the publication of timely studies local coordinated information on justice information policy. Ms. Kaplan is a graduate of technology programs, and is She is also In-house Counsel Columbia University Law leading the Review Board’s and staff to the SEARCH Law School and Radcliffe College. examination of legal and public and Policy Program Advisory policy issues associated with

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 103 Committee and Board of National Crime Information Communications staff in July Directors. Center, and currently chairs the 1997 as a Writer/Researcher. He FBI’s Evaluation Group for the contributed to SEARCH Prior to joining SEARCH, Ms. National Fingerprint File Pilot publications, including Barton was a Municipal Judge Project. Interface, SEARCH Update, and in Cheyenne, Wyoming, and SEARCHLite, and also worked also was engaged in the private In 1981, Mr. Cooper was on other communications and practice of law. She also has appointed by California’s program-related projects held the positions of Public Governor to the California involving writing, editing, and Defender for Cheyenne, and Commission on Personal design. Staff Attorney to the Wyoming Privacy. He currently serves on Supreme Court. She previously the Board of Directors for the Mr. Johnson authored two of served in the New York State National Foundation for Law SEARCH’s Technical Bulletins: Department of Correctional and Technology. With “Court Automation and Services, Office of the Special SEARCH for 26 years, Mr. Integration: Issues and Legal Assistant to the Cooper also has served as the Technologies,” and “From the Commissioner, and Legal Deputy Director and the Inkpad to the Mousepad: IAFIS Specialist for the Department’s Director of the Law and Policy and Fingerprint Technology at Division of Health Services. Program. the Dawn of the 21st Century.” Prior to her service in New The latter, which focused on the York, she was Associate County Mr. Cooper’s law enforcement FBI’s Integrated Automated Judge for Lincoln County, career began as a Patrolman for Fingerprint Identification Nebraska. the City of Sacramento, and he System, was reprinted in the has held various research and April 1999 issue of Government Ms. Barton holds a B.A. degree planning positions with the Technology magazine. from Augustana College (South California Council on Criminal Dakota) and a J.D. from the Justice and the California Crime Before joining SEARCH, Mr. University of Nebraska College Technological Research Johnson served for 7 years as of Law. She is a member of the Foundation. He has written Editor of the Northern Bars of California, Nebraska, extensively in all areas of California Teamster newspaper, and Wyoming. information law and policy, with a circulation of 65,000 in with an emphasis on the privacy the greater San Francisco Bay Gary R. Cooper and security of criminal history area. He has worked in the Since 1983, Gary R. Cooper has records. mainstream press as a Reporter served as the Executive Director and Assignment Editor, and also of SEARCH. In his role as Mr. Cooper received his B.A. in government and in public Executive Director, Mr. Cooper degree in political science from relations, where his writing was is called upon to represent the University of California, honored with a Bay Area SEARCH before the various Davis. Publicity Club Award. He holds branches and levels of a Bachelor of Arts degree in government, including the U.S. Eric C. Johnson Journalism from San Francisco Congress and the U. S. DOJ; Eric C. Johnson is a Policy State University. criminal justice associations; Research Analyst in SEARCH’s and the private sector. He has Law and Policy Division, where Mr. Johnson joined SEARCH’s twice chaired the Evaluation he researches and writes on Law and Policy staff on May 1, Committee for tests of the issues relating to criminal 1999. Interstate Identification Index, a justice information management committee of the Advisory and policy. Mr. Johnson joined Policy Board to the FBI’s SEARCH’s Corporate

Page 104 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Appendix 2:

Glossary of criminal justice information terms

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 105 Page 106 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Confidentiality refers to infor- piled in the course of an investi- nolle prosequi, no paper, nolo mation itself, and means that gation of specific criminal acts.4 contendere plea, convicted, only certain persons under youthful offender determination, specified circumstances are Criminal Justice Agency means deceased, deferred disposition, authorized to have access to (1) Courts; (2) A government dismissed defendant discharged particular information.1 agency or any subunit thereof (civil action, pardoned, proba- that performs the administration tion before conviction, sentence Criminal History Record In- of criminal justice pursuant to a commuted, adjudication with- formation (CHRI) means in- statute or executive order, and held, mistrial), executive clem- formation collected by criminal which allocates a substantial ency, placed on probation, justice agencies on individuals part of its annual budget to the paroled, or released from cor- consisting of identifiable de- administration of criminal jus- rectional supervision.7 scriptions and notations of ar- tice.5 rests, detentions, indictments, Nonconviction information informations or other formal Criminal Justice Information means arrest information with- criminal charges (and any dis- includes CHRI, criminal intelli- out disposition if an interval of position arising therefrom), gence information, criminal in- 1 year has elapsed from the date sentencing, correctional super- vestigative information, of arrest and no active prosecu- vision, and release. The term disposition information, identi- tion of the charge is pending; or does not include identification fication record information, information disclosing that the information such as fingerprint nonconviction information, and police have elected not to refer a records to the extent that such wanted person information.6 matter to a prosecutor; or infor- information does not indicate mation disclosing that a prose- involvement of the individual in Disposition means information cutor has elected not to the criminal justice system. disclosing that criminal pro- commence criminal proceed- State and Federal Inspector ceedings have been concluded, ings; or information disclosing General Offices are included.2 including information disclosing that proceedings have been in- that the police have elected not definitely postponed, as well as Criminal Intelligence Infor- to refer a matter to a prosecutor all acquittals and all dismissals.8 mation means information on or that a prosecutor has elected identifiable individuals com- not to commence criminal pro- Privacy is “the claim of indi- piled in an effort to anticipate, ceedings, and also disclosing the viduals, groups, or institutions prevent, or monitor possible nature of the termination in the to determine for themselves criminal activity.3 proceedings; or information dis- when, how, and to what extent closing that proceedings have information about them is Criminal Investigative Infor- been indefinitely postponed and communicated to others.”9 mation means information on also disclosing the reason for identifiable individuals com- such postponement. Examples of dispositions include (but are not limited to), acquittal, dis- 1George B. Trubow, “Information missal, case continued without Law Overview,” 18 J. Marshall L. Rev. finding, charge dismissed, 815, 817 (1985). charge still pending, guilty plea, 228 C.F.R. § 20.23(b). 3Technical Report No. 13: Standards for the Security and Privacy of Crimi- 4Technical Report No. 13, Standard 728 C.F.R. § 20.23(e). nal History Record Information, 3rd ed. 2.1(e). 828 C.F.R. § 20.23(k). (Sacramento: SEARCH Group, Inc., 528 C.F.R. § 20.23(c). 9Alan F. Westin, Privacy and Free- 1988) Standard 2.1(d). Hereafter, 6Technical Report No. 13, Standard dom (New York: Atheneum, 1967) p. Technical Report No. 13. 2.1. 7.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 107 Page 108 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Appendix 3:

Comparison of criminal history and other privacy measures

§ Notice § Choice § Onward transfer § Security § Data integrity § Access § Enforcement

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 109 Page 110 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Comparison of criminal history and other privacy measures1 Notice Federal justice information None. system regulations2 Safe Harbor Privacy An organization must inform individuals about: Principles3 · The purposes for which it collects and uses PII. · How to contact the organization with any inquiries or complaints. · The types of third parties to which it discloses the information. · The choices and means offered to individuals for limiting its use and disclosure.

This notice must be provided in clear and conspicuous language that is readily understood; and the notice must be made available when individuals are first asked to provide personal information to the organization or as soon thereafter as is practicable. In any event, notice must be provided before the organization uses such information for a purpose other than that for which it was originally collected or processed by the transferring organization, or before the organization discloses it for the first time to a third party. Online Privacy Alliance The policy must state clearly: Principles · What PII is collected. · The use of that information. · Possible third-party distribution. · The choices available to an individual. · The company’s commitment to data security. · What steps the organization takes to ensure data quality and access.

The policy should: · Disclose any consequences of a refusal to provide PII. · Include a statement of enforcement mechanisms and how to contact the organization.

A privacy policy must be easy to find, read, and understand. The policy must be available prior to or at the time that the PII is collected or requested.

1The measures reviewed here use various terms to identify and, in some cases, to define the personal information covered by the measure. Examples include personal information and data, protected health information, individually identifiable information, and so on. For ease of comparison, this chart uses the abbreviation “PII” (personally identifiable information), or simply “information” or “data.” 228 C.F.R. Part 20. (Also known as the “DOJ regulations.”) 365 Federal Register 45666 (July 24, 2000).

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 111 Notice (cont.) Fair Credit Reporting Act Upon request, notice, substantially similar to the model promulgated by the Federal Trade Commission (FTC), must be provided to consumers; those who regularly supply the credit-reporting agency with information; and those who receive reports.4

A consumer-reporting agency that furnishes a consumer report for employment purposes containing public record information, including criminal history records, which is “likely to have an adverse effect upon a consumer’s ability to obtain employment,” must either provide the consumer with notice at the same time that the information is reported to the potential employer or “must maintain strict procedures” to ensure that the information is complete and up-to-date.5

Consumers also must be notified if a credit report provided the basis for an adverse determination.6 Individual Reference Each individual reference service (Service) shall have an information practices policy Services Group Principles statement that is available upon request that describes: · What types of PII it has. · From what types of sources. · How it is collected. · The type of entities to whom it may be disclosed. · The type of uses to which it is put.7 European Union Directive Requires disclosure of information, such as: · The identity of the controller. · The purposes of the processing for which the data are intended.

Notice should also include any further information necessary to guarantee fair processing, such as: · The recipients or categories of recipients of the data. · Whether replies to questions are obligatory or voluntary, and possible consequences for failing to reply. · The existence of the right of access and the right to rectify data.8 Comments Notice of potential uses of criminal justice information traditionally has not been viewed as necessary, in part because the notice will not influence subject behavior and it is unlikely that the individual will be interested in the contents of a privacy notice at the time of arrest, conviction, or imprisonment.

415 U.S.C. § 1681e(d). 515 U.S.C. § 1681k. 615 U.S.C. § 1681b(b)(3). 7Individual Reference Services Group, “Individual Reference Service Industry Principles” (December 15, 1997) Article VII. Available at http://www.dbtonline.com/irsg-principles.asp. Hereafter, IRSG Principles. 8 Directive 95/46/EC, Articles 10, 11. Hereafter, Directive.

Page 112 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Comparison of criminal history and other privacy measures Choice Federal justice information None. system regulations Safe Harbor Privacy Organization must: Principles · Offer the opportunity to choose whether PII they provide is disclosed to third parties or used (where such use is incompatible with the purpose for which it was originally collected or subsequently authorized). · Provide clear, conspicuous, readily available, and affordable mechanisms. · Require opt-in choice for sensitive types of information. Online Privacy Alliance Individuals must be given the opportunity to exercise choice regarding how PII collected Principles from them online may be used when such use is unrelated to the purpose for which the information was collected. At a minimum, individuals should be given the opportunity to opt out of such use. Fair Credit Reporting Act With certain exceptions, consumer consent is required before a consumer report may be furnished.9

Consumers may elect to be excluded from certain lists relating to offers of insurance or credit not initiated by the consumer.10

Consumer-reporting agencies may not provide reports containing medical information for certain purposes without the consent of the consumer.11 Individual Reference Each Service shall, upon request, inform individuals of the choices, if any, available to Services Group Principles limit access or use of information about them in its database, provided, however, that in the case of nonpublic information distributed to the general public, a Service shall provide an opportunity for an individual to limit the general public’s access or use of such information.12 European Union Directive Individual consent for processing is frequently required; however, certain nonconsensual processing is also permitted.13

Provides individual with the right to object, in certain circumstances, to certain processing of data about the individual.14 Comments Record subjects have never been able to choose to consent or opt-out of the criminal history record regime. Participants in the criminal justice process are not voluntary participants; given the potential for adverse consequences resulting from disclosure, it is assumed that all record subjects would opt-out.

915 U.S.C. § 1681b(b)(2), (c)(1). 1015 U.S.C. § 1681b(e). 1115 U.S.C. § 1681b(g). 12IRSG Principles, Article VIII. 13 See, for example, Directive, Articles 7, 9, and 13. 14Directive, Article 14.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 113 Comparison of criminal history and other privacy measures Onward transfer Federal justice information Dissemination of nonconviction data must be limited to: system regulations · Criminal justice agencies for administration of the justice system and justice agency employment. · Individuals or agencies as authorized by statute, executive order, ordinance, or court action. · Agents and contractors of criminal justice agencies. · Individuals and agencies for the express purpose of research, evaluative, or statistical activities, provided safeguards are in place.15 Safe Harbor Privacy · An organization may only disclose PII to a third party for the third party’s own use Principles consistent with the principles of notice and choice. · PII may be transferred to a third party acting as the organization’s agent, provided that the third party has adopted the Safe Harbor Principles, is subject to another “adequate” privacy regime, or has provided suitable contractual assurances regarding the third party’s privacy practices. Online Privacy Alliance · In most circumstances, where there is third-party distribution of PII, collected online Principles from the individual, unrelated to the purpose for which it was collected, the individual should be given the opportunity to opt-out. · Consent for such use or third-party distribution may also be obtained through technological tools or opt-in.

Organizations should ensure that third parties to which they transfer PII are aware of these security practices, and take reasonable precautions to protect any transferred PII. Fair Credit Reporting Act Consumer reports may be only used for permissible purposes.

Information may be provided to consumer-reporting agencies without individual consent. Consent is required for most disclosures of consumer report information. Individual Reference See Choice section. Services Group Principles European Union Directive Individual consent for processing is frequently required; however, certain nonconsensual processing is also permitted.16

Restricts onward transfers to countries without “adequate” privacy protections.17

Contractors “must provide sufficient guarantees,” by contract, which obligate the contractor to the required security measures.18 Comments Under the DOJ regulations, conviction information may be disseminated without restriction while nonconviction information is unavailable unless specifically authorized by State law, regulation, or policy.

The DOJ regulations are detailed and relatively privacy-protective of the criminal history information covered.

1528 C.F.R. § 20.21(b). 16See, for example, Directive, Articles 7, 9, and 13. 17Directive, Articles 25, 26. 18Directive, Article 17(2) and (3).

Page 114 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Comparison of criminal history and other privacy measures Security Federal justice information Wherever criminal history record information is collected, stored, or disseminated, each system regulations State shall ensure that technical, physical, or administrative actions are taken to ensure the security of the information.19 Safe Harbor Privacy Organizations creating, maintaining, using, or disseminating records of PII must Principles take reasonable precautions to protect it from loss, misuse, unauthorized access, or disclosure, alteration, and destruction. Online Privacy Alliance Organizations creating, maintaining, using, or disseminating PII should take: Principles · Appropriate measures to ensure its reliability. · Reasonable precautions to protect it from loss, misuse, or alteration. Fair Credit Reporting Act Consumer-reporting agencies are required to “maintain reasonable procedures” to avoid violations of key provisions of the Act.20 Individual Reference Services shall maintain facilities and systems to protect information from unauthorized Services Group Principles access and persons who may exceed their authorization. In addition to physical and electronic security, Services shall reasonably implement employee and contractor supervision and system reviews at appropriate intervals.21 European Union Directive Requires “appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves transmission of data over a network, and against all other unlawful forms of processing.”22 Comments The DOJ regulations compare favorably with those found in other privacy measures. The DOJ regulations require a wide range of security measures to guard against unauthorized access or disclosure, as well as natural disasters.

1928 C.F.R. § 20.21(f). 2015 U.S.C. § 1681e(a). 21IRSG Principles, Article VI. 22Directive, Article 17(1).

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 115 Comparison of criminal history and other privacy measures Data integrity Federal justice information Complete records should be maintained at a central State repository. To be “complete” system regulations means that the State repository must record a disposition within 90 days of the date of disposition.

To be “accurate” means that no record containing criminal history record information shall contain erroneous information. Criminal justice agencies shall institute processes that will minimize the possibility of recording and storing information of an inaccurate nature.23 Safe Harbor Privacy Consistent with the other principles, PII must be relevant to the purposes for which it is to Principles be used. An organization may not process personal information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the individual. To the extent necessary for those purposes, an organization should take reasonable steps to ensure that data are accurate, complete, and current. Online Privacy Alliance Organizations creating, maintaining, using, or disseminating PII should take reasonable Principles steps to ensure that the data are accurate, complete, and timely for the purposes for which they are to be used. Fair Credit Reporting Act Consumer-reporting agencies may disclose a consumer report only for specified permissible purposes.24

The Act prohibits certain information from inclusion in most consumer reports.25 Individual Reference Reasonable steps shall be taken to help ensure the accuracy of the information in Services Group Principles Services.

When contacted about alleged inaccuracies, Services shall either correct any inaccuracy or direct the individual to the source of the information.26 European Union Directive PII must be “collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical, or scientific purposes shall not be considered as incompatible, provided that Member States provide appropriate safeguards.”27 Comments The DOJ regulations are at least comparable to the other measures examined here. In some cases, such as the OPA and IRSG Principles, the DOJ standards may actually be more stringent because they appear to require more than “reasonable” efforts.

2328 C.F.R. § 20.21(a). 2415 U.S.C. § 1681(b). 2515 U.S.C. § 1681(c). 26IRSG Principles, Article III. 27Directive, Article 6(1)(b).

Page 116 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Comparison of criminal history and other privacy measures Access Federal justice information Requires that States grant access to record subjects upon satisfactory verification of system regulations identity.

Record subjects are permitted to obtain copies of records (excluding intelligence, investigative, and related files) when necessary for challenge or correction.

States are required to establish administrative review and appeal procedures for record subjects who challenge the accuracy of information.28 Safe Harbor Privacy Individuals must have access to PII about them that an organization holds and be able to Principles correct, amend, or delete that information where it is inaccurate, except where the burden or expense of providing access would be disproportionate to the risks to the individual’s privacy in the case in question, or where the rights of persons other than the individual would be violated. Online Privacy Alliance Organizations should establish appropriate processes or mechanisms so that inaccuracies Principles in material PII, such as account or contact information, may be corrected.

These procedures and mechanisms should be simple and easy to use, and provide assurance that inaccuracies have been corrected.

Other procedures to ensure data quality may include use of reliable sources and collection methods; reasonable and appropriate consumer access and correction; and protections against accidental or unauthorized alteration. Fair Credit Reporting Act Consumer-reporting agencies are required to disclose, upon the consumer’s request, specified information that the credit-reporting agency possesses about the consumer, as well as a summary of the individual’s rights under FCRA and contact information. (Summary of rights must be substantially similar to FTC model.)29

Consumer has the ability to dispute information believed to be inaccurate and to request reinvestigation of such information.30 Individual Reference Upon request and reasonable terms, Services shall: Services Group Principles · Inform individuals about the nature of public record and publicly available information it makes available in its products. · Provide individuals with nonpublic information contained in products or services that specifically identify the individual. · Direct individuals to a consumer-reporting agency when such agency is the source of the PII.31

2828 C.F.R. § 20.21(g). 2915 U.S.C. § 1681g. 3015 U.S.C. § 1681I. 31IRSG Principles, Article IX.

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 117 Access (cont.) European Union Directive Requires, with certain exceptions, that inquiries be acted upon “without constraint at reasonable intervals and without excessive delay or expense.”32

Requires Member States to guarantee a data subject’s right to determine if personal data are being processed and what data are being processed.33

“Member States may, in the interest of the data subject or so as to protect the rights and freedoms of others, restrict rights of access and information.”34

Requires that data subjects be given the rights of “rectification, erasure, or blocking,” as appropriate.35 Comments The DOJ standards are largely comparable concerning individual rights of access and correction.

The DOJ regulations are more favorable than some of the other measures in that they guarantee administrative procedures and appeals in the event of disagreements between the record subject and agency over record correction requests.

The DOJ regulations are less protective insofar as they only guarantee record subjects the right to obtain copies of their records if necessary for purposes of challenge or correction.

32Directive, Article 12(a). 33Ibid. 34Recital 42. 35Directive, Article 12(b).

Page 118 Report of the National Task Force on Privacy, Technology and Criminal Justice Information Comparison of criminal history and other privacy measures Enforcement Federal justice information Any agency or individual in violation may be fined up to $10,000. In addition, agencies system regulations may be subject to loss of Federal funding.36

States must establish administrative and appeals processes for record subject challenges to record accuracy.37 Safe Harbor Privacy At a minimum, mechanisms must include: Principles · Readily available and affordable independent recourse by which an individual’s complaints and disputes can be investigated and resolved and damages awarded where provided by applicable law or private initiative. · Procedures for verifying that the attestations and assertions businesses make about their privacy practices are true and that practices are implemented as presented. · Obligations to remedy problems arising out of noncompliance by companies adopting the principles. · Sufficiently rigorous sanctions to ensure compliance. Online Privacy Alliance Whether administered by a third-party seal program, licensing program, or membership Principles association, the effective enforcement of self-regulation requires: · Verification and monitoring. · Complaint resolution. · Education and outreach.

OPA believes the best way to create public trust is for organizations to alert consumers and other individuals to the organization’s practices and procedures through participation in a program that has an easy-to-recognize symbol or seal. Fair Credit Reporting Act Authorizes private right of action by consumers.38

Administrative enforcement by the FTC is authorized and the FTC may initiate civil court actions. States and other Federal agencies may bring actions in specified circumstances.39 Individual Reference Periodic compliance audits by outside auditors are required. A summary of results must Services Group Principles be made publicly available.40 European Union Directive Member States are required to provide judicial remedies for a data subject whose rights are provided under national law.41

Data subjects are to be entitled to “compensation from the controller for the damage suffered.”42 Comments The DOJ regulations authorize fines against both agencies and individuals for violations of the regulations. In addition, agencies run the risk of losing Federal funding if they fail to comply with the regulations.

3628 C.F.R. § 20.25. 3728 C.F.R. § 20.21(g). 3815 U.S.C. § 1681n. 3915 U.S.C. §1681s. 40IRSG Principles, Article XI. 41Directive, Article 22. 42Directive, Article 21(1).

Report of the National Task Force on Privacy, Technology and Criminal Justice Information Page 119