CFR Part 22

CFR Part 22
in effect

28 C.F.R. § 22.1 Purpose.

The purpose of these regulations is to: (a) Protect privacy of individuals by requiring that information identifiable to a private person obtained in a research or statistical program may only be used and/or revealed for the purpose for which obtained; (b) Insure that copies of such information shall not, without the consent of the person to whom the information pertains, be admitted as evidence or used for any purpose in any judicial or administrative proceedings; (c) Increase the credibility and reliability of federally-supported research and statistical findings by minimizing subject concern over subsequent uses of identifiable information; (d) Provide needed guidance to persons engaged in research and statistical activities by clarifying the purposes for which identifiable information may be used or revealed; and (e) Insure appropriate balance between individual privacy and essential needs of the research community for data to advance the state of knowledge in the area of criminal justice. (f) Insure the confidentiality of information provided by crime victims to crisis intervention counselors working for victim services programs receiving funds provided under the Crime Control Act, and Juvenile Justice Act, and the Victims of Crime Act.

28 C.F.R. § 22.2 Definitions.

(a) Person means any individual, partnership, corporation, association, public or private organization or governmental entity, or combination thereof. (b) Private person means any person defined in § 22.2(a) other than an agency, or department of Federal, State, or local government, or any component or combination thereof. Included as a private person is an individual acting in his or her official capacity. (c) Research or statistical project means any program, project, or component thereof which is supported in whole or in part with funds appropriated under the Act and whose purpose is to develop, measure, evaluate, or otherwise advance the state of knowledge in a particular area. The term does not include “intelligence” or other information-gathering activities in which information pertaining to specific individuals is obtained for purposes directly related to enforcement of the criminal laws. (d) Research or statistical information means any information which is collected during the conduct of a research or statistical project and which is intended to be utilized for research or statistical purposes. The term includes information which is collected directly from the individual or obtained from any agency or individual having possession, knowledge, or control thereof. (e) Information identifiable to a private person means information which either— (1) Is labelled by name or other personal identifiers, or (2) Can, by virtue of sample size or other factors, be reasonably interpreted as referring to a particular private person. (f) Recipient of assistance means any recipient of a grant, contract, interagency agreement, subgrant, or subcontract under the Act and any person, including subcontractors, employed by such recipient in connection with performances of the grant, contract, or interagency agreement. (g) Officer or employee of the Federal Government means any person employed as a regular or special employee of the U.S. (including experts, consultants, and advisory board members) as of July 1, 1973, or at any time thereafter. (h) The act means the Omnibus Crime Control and Safe Streets Act of 1968, as amended. (i) Applicant means any person who applies for a grant, contract, or subgrant to be funded pursuant to the Act. (j) The Juvenile Justice Act means the “Juvenile Justice and Delinquency Prevention Act of 1974, as amended.” (k) The Victims of Crime Act means the Victims of Crime Act of 1984.

28 C.F.R. § 22.20 Applicability.

(a) These regulations govern use and revelation of research and statistical information obtained, collected, or produced either directly by BJA, OJJDP, BJS, NIJ, or OJP or under any interagency agreement, grant, contract, or subgrant awarded under the Crime Control Act, the Juvenile Justice Act, and the Victims of Crime Act. (b) The regulations do not apply to any records from which identifiable research or statistical information was originally obtained; or to any records which are designated under existing statutes as public; or to any information extracted from any records designated as public. (c) The regulations do not apply to information gained regarding future criminal conduct.

28 C.F.R. § 22.21 Use of identifiable data.

Research or statistical information identifiable to a private person may be used only for research or statistical purposes.

28 C.F.R. § 22.22 Revelation of identifiable data.

(a) Except as noted in paragraph (b) of this section, research and statistical information relating to a private person may be revealed in identifiable form on a need-to-know basis only to— (1) Officers, employees, and subcontractors of the recipient of assistance; (2) Such individuals as needed to implement sections 202(c)(3), 801, and 811(b) of the Act; and sections 223(a)(12)(A), 223(a)(13), 223(a)(14), and 243 of the Juvenile Justice and Delinquency Prevention Act. (3) Persons or organizations for research or statistical purposes. Information may only be transferred for such purposes upon a clear demonstration that the standards of § 22.26 have been met and that, except where information is transferred under paragraphs (a) (1) and (2) of this section, such transfers shall be conditioned on compliance with a § 22.24 agreement. (b) Information may be revealed in identifiable form where prior consent is obtained from an individual or where the individual has agreed to participate in a project with knowledge that the findings cannot, by virtue of sample size, or uniqueness of subject, be expected to totally conceal subject identity.

28 C.F.R. § 22.23 Privacy certification.

(a) Each applicant for BJA, OJJDP, BJS, NIJ, or OJP support either directly or under a State plan shall submit a Privacy Certificate as a condition of approval of a grant application or contract proposal which has a research or statistical project component under which information identifiable to a private person will be collected. (b) The Privacy Certificate shall briefly describe the project and shall contain assurance by the applicant that: (1) Data identifiable to a private person will not be used or revealed, except as authorized under §§ 22.21, 22.22. (2) Access to data will be limited to those employees having a need therefore and that such persons shall be advised of and agree in writing to comply with these regulations. (3) All subcontracts which require access to identifiable data will contain conditions meeting the requirements of § 22.24. (4) To the extent required by § 22.27 any private persons from whom identifiable data are collected or obtained, either orally or by means of written questionnaire, shall be advised that the data will only be used or revealed for research or statistical purposes and that compliance with requests for information is not mandatory. Where the notification requirement is to be waived, pursuant to § 22.27(c), a justification must be included in the Privacy Certificate. (5) Adequate precautions will be taken to insure administrative and physical security of identifiable data. (6) A log will be maintained indicating that identifiable data have been transmitted to persons other than BJA, OJJDP, BJS, NIJ, or OJP or grantee/contractor staff or subcontractors, that such data have been returned, or that alternative arrangements have been agreed upon for future maintenance of such data. (7) Project plans will be designed to preserve anonymity of private persons to whom information relates, including, where appropriate, name-stripping, coding of data, or other similar procedures. (8) Project findings and reports prepared for dissemination will not contain information which can reasonably be expected to be identifiable to a private person except as authorized under § 22.22. (c) The applicant shall attach to the Privacy Certification a description of physical and/or administrative procedures to be followed to insure the security of the data to meet the requirements of § 22.25.

28 C.F.R. § 22.24 Information transfer agreement.

Prior to the transfer of any identifiable information to persons other than BJA, OJJDP, BJS, NIJ, or OJP or project staff, an agreement shall be entered into which shall provide, as a minimum, that the recipient of data agrees that: (a) Information identifiable to a private person will be used only for research and statistical purposes. (b) Information identifiable to a private person will not be revealed to any person for any purpose except where the information has already been included in research findings (and/or data bases) and is revealed on a need-to-know basis for research or statistical purposes, provided that such transfer is approved by the person providing information under the agreement, or authorized under § 22.24(e). (c) Knowingly and willfully using or disseminating information contrary to the provisions of the agreement shall constitute a violation of these regulations, punishable in accordance with the Act. (d) Adequate administrative and physical precautions will be taken to assure security of information obtained for such purpose. (e) Access to information will be limited to those employees or subcontractors having a need therefore in connection with performance of the activity for which obtained, and that such persons shall be advised of, and agree to comply with, these regulations. (f) Project plans will be designed to preserve anonymity of private persons to whom information relates, including, where appropriate, required name-stripping and/or coding of data or other similar procedures. (g) Project findings and reports prepared for dissemination will not contain information which can reasonably be expected to be identifiable to a private person. (h) Information identifiable to a private person (obtained in accordance with this agreement) will, unless otherwise agreed upon, be returned upon completion of the project for which obtained and no copies of that information retained.

28 C.F.R. § 22.25 Final disposition of identifiable materials.

Upon completion of a research or statistical project the security of identifiable research or statistical information shall be protected by: (a) Complete physical destruction of all copies of the materials or the identifiable portion of such materials after a three-year required recipient retention period or as soon as authorized by law, or (b) Removal of identifiers from data and separate maintenance of a name-code index in a secure location.

28 C.F.R. § 22.26 Requests for transfer of information.

(a) Requests for transfer of information identifiable to an individual shall be submitted to the person submitting the Privacy Certificate pursuant to § 22.23. (b) Except where information is requested by BJA, OJJDP, BJS, NIJ, or OJP, the request shall describe the general objectives of the project for which information is requested, and specifically justify the need for such information in identifiable form. The request shall also indicate, and provide justification for the conclusion that conduct of the project will not, either directly or indirectly, cause legal, economic, physical, or social harm to individuals whose identification is revealed in the transfer of information. (c) Data may not be transferred pursuant to this section where a clear showing of the criteria set forth above is not made by the person requesting the data.

28 C.F.R. § 22.27 Notification.

(a) Any person from whom information identifiable to a private person is to be obtained directly, either orally, by questionnaire, or other written documents, shall be advised: (1) That the information will only be used or revealed for research or statistical purposes; and (2) That compliance with the request for information is entirely voluntary and may be terminated at any time. (b) Except as noted in paragraph (c) of this section, where information is to be obtained through observation of individual activity or performance, such individuals shall be advised: (1) Of the particular types of information to be collected; (2) That the data will only be utilized or revealed for research or statistical purposes; and (3) That participation in the project in question is voluntary and may be terminated at any time. (c) Notification, as described in paragraph (b) of this section, may be eliminated where information is obtained through field observation of individual activity or performance and in the judgment of the researcher such notification is impractical or may seriously impede the progress of the research. (d) Where findings in a project cannot, by virtue of sample size, or uniqueness of subject, be expected to totally conceal subject identity, an individual shall be so advised.

28 C.F.R. § 22.28 Use of data identifiable to a private person for judicial, legislative or administrative purposes.

(a) Research or statistical information identifiable to a private person shall be immune from legal process and shall only be admitted as evidence or used for any purpose in any action, suit, or other judicial, legislative or administrative proceeding with the written consent of the individual to whom the data pertains. (b) Where consent is obtained, such consent shall: (1) Be obtained at the time that information is sought for use in judicial, legislative or administrative proceedings; (2) Set out specific purposes in connection with which information will be used; (3) Limit, where appropriate, the scope of the information subject to such consent.

28 C.F.R. § 22.29 Sanctions.

Where BJA, OJJDP, BJS, NIJ, or OJP believes that a violation of section 812(a) of the Act or section 1407(d) of the Victims of Crime Act, these regulations, or any grant or contract conditions entered into thereunder has occurred, it may initiate administrative actions leading to termination of a grant or contract, commence appropriate personnel and/or other procedures in cases involving Federal employees, and/or initiate appropriate legal actions leading to imposition of a civil penalty not to exceed $10,000 for a violation occurring before September 29, 1999, and not to exceed $11,000 for a violation occurring on or after September 29, 1999 against any person responsible for such violations. For civil penalties assessed after August 1, 2016, whose associated violations occurred after November 2, 2015, see the civil penalty amount as provided in 28 CFR 85.5.

Starting a business? Corpus forms LLCs in all 50 states and DC.