FEDERAL BUREAU OF INVESTIGATION
PRIVACY IMPACT ASSESSMENT
National Dental Image Repository
February 15, 2006
I. BACKGROUND
This PIA is conducted pursuant to the E-Government Act of 2002, P.L. 107-347, the accompanying guidelines issued by the Office of Management and Budget (OMB) on September 26, 2003, and the FBI's PIA guidelines.
In May of 2005, the FBI's Criminal Justice Information System (CJIS) Management approved the creation of the National Dental Image/Information Repository (NDIR) to facilitate the identification of Missing, Unidentified, and Wanted persons. The NDIR will be housed on Law Enforcement Online (LEO) and will permit law enforcement agencies to store, access and supplement dental records which are currently housed in the Missing, Unidentified, and Wanted Persons files in the National Crime Information Center (NCIC) system. The NCIC system is a nationwide computerized database of documented criminal justice information maintained and supported by CJIS. Data in NCIC is exchanged in a shared-management partnership with criminal justice officials of local, state and federal governments in the United States, its possessions, and Canada. Each entry is assigned a unique identifying number by the system. The number is referred to as the "NCIC number." Users may query the system, enter new records, supplement existing entries, modify transactions, locate transactions or remove records from the system. The NCIC database consists of eleven (11) files which concern individuals, three (3) of which may contain dental records (the Missing, Unidentified and Wanted Person Files).
CJIS advises that the NCIC system does not have sufficient image capability for dental x-rays, radiographs, models, etc. in the Missing, Unidentified, and Wanted Person Files. NCIC's image retention capability is limited to small, relatively low resolution images. Stakeholder law enforcement agencies currently submit the dental records of Missing, Unidentified, and Wanted Persons to the NCIC system. The records are compared to existing dental records in NCIC. The NCIC system generates a list of potential record matches. Agencies contact the agency that submitted the original potential matching dental record to obtain additional information concerning the record and to retrieve and review physical copies of the dental records. The process is time-consuming and inefficient and delays the identification or exclusion of potential matches because the querying agency is often unable to establish contact with the originating agency. Accordingly, the NDIR will provide law enforcement agencies with direct access to digital images of these dental records, thereby eliminating the need to contact each originating agency to retrieve and review physical copies of the records.
Agencies submitting digital dental images to the NDIR must submit the following forms to CJIS's Advisory Groups Management Unit (AGMU) via e-mail.
• A Missing, Unidentified, and Wanted Person Submission Form
• A digitized copy of the NCIC Record
• A digitized copy of the Dental Condition Worksheet
• A digitized copy of a NCIC Person Dental Report Form
• A digitized scan of the treating dentist's treatment records
• A digitized copy of the Dental Report Form
• A digitized scan of all available radiographs, and miscellaneous digital scans for identification purposes, including, intraoral/extraoral photographs of teeth, digital photographs of dental models, cephalometric radiographs or other medical radiographs of the head and neck region
The NCIC number must be referenced on each e-mail submitted to the AGMU. The forms contain personally identifying information such as name, photograph, date of birth, height, weight, eye color, hair color, sex, race, social security number, scars, tattoos, etc., as well as name and contact information (including e-mail addresses) for forensic dentists and investigators.
Upon receipt of the e-mail packet, the packet will be forwarded to an expert on the NDIR Review Panel to ensure that it has been properly coded. The review panel will consist of a group of professionals certified by the American Board of Forensic Odontologists who have specialized training in the proper coding of NCIC dental records and the comparison and/or identification of NCIC records. If the record has been improperly coded, the submitting agency will be contacted by an NDIR Review Panel expert for correction and re-submission to the NDIR. If the expert determines that the record packet is correct, the expert will notify the AGMU via e-mail. The AGMU will review the packet to ensure that it is complete. If the AGMU determines that the packet is complete, it will post the information in an electronic folder (listed by NCIC number) under the Missing, Wanted, or the Unidentified Person files of the NDIR.
II. ASSESSMENT
A. What information is being collected?
The Missing, Unidentified and Wanted Person electronic files of the NDIR will contain personally identifying information such as name, photograph, date of birth, height, weight, eye color, hair color, sex, race, social security number, scars, tattoos, etc., as well as name and contact information for forensic dentists and investigators (including e-mail addresses). The NDIR will also contain dental records and images posted to the NDIR by the AGMU.
B. Why is the information being collected?
Digital dental images are being collected to supplement the NCIC Missing, Unidentified, and Wanted Person files because it does not contain sufficient image capability.
C. What is the intended use of the information?
Digital dental images in the NDIR will be used to identify or exclude potential record matches identified by the NCIC system.
D. With whom will the information be shared?
All federal, tribal, state and local law enforcement agencies having access to NCIC may submit supplemental digital dental records to the NDIR. Information will be accessed, retrieved and reviewed by any federal, tribal, state and local law enforcement agency representative who is a member of LEO on a need to know basis.
E. What opportunities will individuals have to decline to provide information or to consent to particular uses of the information?
Due to the nature of the dental records in the NDIR, individuals are not provided with an opportunity to decline to provide information or to consent to the uses of the information.
F. How will the information be secured?
The NDIR information will be housed on LEO. Access to LEO is subject to FBI approval and is restricted by password. All network traffic is monitored and recorded by personnel authorized by the FBI. LEO utilizes a Virtual Private Network which provides secure, encrypted channels of communication between LEO users and data contained within the LEO network. Physical security protections include guards and locked facilities requiring badges and passwords for access. Records are accessed by authorized government personnel and are protected by appropriate physical and technological safeguards to prevent unauthorized access.
G. Is this a system of records?
The NDIR will contain personally identifiable information regarding individuals and information will be retrieved by name or personal identifier but will be incorporated into an existing system of records. A new systems notice is not required; however, NCIC's Privacy Act system notice must be amended to reflect the NDIR.
H. What choices did the FBI make regarding an IT system or collection of information as a result of performing the PIA?
The Missing, Unidentified, and Wanted Person files in NCIC have limited storage capacity. The NDIR will permit law enforcement agencies to more readily determine whether a potential dental record match identified by NCIC is identifiable to the subject of the inquiry. Because NCIC has limited storage capacity, and because the current practice of contacting each agency that submitted the original dental record is inefficient and time-consuming, there is no reasonable alternative to proceeding with the development of the NDIR.
III. APPROVAL
The FBI's Senior Privacy Official has reviewed this system for privacy policy issues, perceives no unusual privacy concerns at stake here, and approves the FBI's implementation of this system. The NDIR is a simple system involving limited use and access. A new Privacy Act systems notice is not required, but the NCIC notice should be amended to reflect the NDIR.
