61 FR 37495 / 07-18-96
JUSTICE/FBI-017
System Name: National DNA Index System (NDIS)
System Location: Federal Bureau of Investigation: FBI Laboratory, U.S. Department of Justice, J. Edgar Hoover Building, 935 Pennsylvania Ave., NW., Washington, DC 20535-0001.
Categories of Individuals Covered by the System: Individuals in this system include persons designated by criminal justice agencies as belonging to one or more of the following groups:
A) Convicted offenders: Persons who have been convicted of crimes in Federal, State, and/or local courts where the applicable law permits establishment of a DNA record for the convicted person.
B) Missing persons and their close biological relatives: Persons reported missing or whose whereabouts are unknown and sought and their close biological relatives, such as parents, siblings, and children.
C) Victims: Persons, living or dead, who have been victims of crimes where the perpetrator of the crime may have carried DNA of the victim away from the crime scene.
D) DNA personnel: Personnel in Federal, State, and/or local criminal justice agencies who perform duties related to or are responsible for DNA records.
Categories of Records in the System: The following definitions are used in this notice:
A) A DNA sample is a body tissue or fluid sample usually a blood and/or buccal sample, that can be subjected to DNA analysis.
B) A DNA profile consists of a set of DNA identification characteristics, i.e., the particular chemical form at the various DNA locations (loci), which permit the DNA of one person to be distinguishable from that of another person.
C) A target DNA profile is a DNA profile submitted by a criminal justice agency for the purpose of identifying DNA profiles maintained by NDIS which match the target DNA profile.
D) A target DNA profile search is a search of appropriate NDIS DNA records for those records with DNA profiles that may match the target DNA profile.
E) Personally identifiable information is information such as names, dates of birth, or social security numbers which are normally used to identify individuals. Personally identifiable information, as used in this notice, does not include information derived from the examination of a DNA sample.
F) A DNA record includes the DNA profile as well as data required to manage and operate NDIS, i.e., the NDIS Agency identifier which serves to identify the submitting agency; the NDIS Specimen Identification Number; information related to the reliability and maintainability of the DNA profiles; and names of the participating laboratories and DNA personnel associated with DNA profile analyses.
Records in this system do not include DNA samples but do include DNA profiles of persons described under "Categories of Individuals Covered by the System" in paragraph A-C. DNA records are input by criminal justice agencies for use by the NDIS. NDIS includes the names of DNA personnel associated with DNA profile analyses, the date after which DNA records from a given DNA analyst can be accepted, and, when applicable, the date after which associated DNA records are not accepted. NDIS does not contain case-related or other personally identifying information about the person from whom the DNA sample was collected.
DNA records are maintained as follows:
1) The Convicted Offender Index, consisting of DNA records from convicted offenders;
2) The Missing Persons Index, consisting of DNA records from missing persons;
3.)The Close Biological Relatives Index, consisting of DNA records from close biological relatives of missing persons;
4) The Unidentified Persons Index, consisting of DNA records from recovered living persons (e.g., children who can't and others who can't or refuse to identify themselves), and recovered dead persons (including their body parts and tissues), whose identities are not known;
5) The Victims Index, consisting of DNA records from victims, living or dead, from whom DNA may have been carried away by perpetrators;
6) The Forensic Index, consisting of DNA records from persons whose identities are not known with certainty and who left DNA at the scene of a crime or whose DNA was carried away from it; and
7) The Population File, consisting of DNA profiles intended to represent various population segments found in the United States. The Population File consists of DNA records from individuals whose identities may be: (a) Known to; (b) not known, but determinable under some circumstances by; or (c) not known and not determinable by the criminal justice agency submitting the DNA records to NDIS.
Authority for Maintenance of the System: The Violent Crime Control and Law Enforcement Act of 1994, Pub. L. No. 103-322, 108 Stat. 1796.
Purpose(s): The purpose of this system and the DNA records maintained in the system is to provide a national storage medium for DNA records input by criminal justice agencies. These records can be searched in order to identify DNA associations with a DNA record obtained during an investigation of a crime or a missing person. The system is also maintained for statistical, identification research, and protocol development and quality control purposes.
In addition to DNA records, records about DNA personnel are maintained in the system. The purposes of these DNA personnel records are to control the acceptance of DNA records by NDIS and to facilitate criminal justice agency contracts required to resolve potential DNA matches.
Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
1) Direct disclosures of NDIS records are made to the Federal, State, and local criminal justice agencies who participate in NDIS. As a result of an NDIS search by a criminal justice agency, the NDIS system analyzes the target DNA profile entered by the search agency and may identify a potential match. Where NDIS identifies a potential match, the matching DNA's records will be disclosed to the criminal justice agencies associated with the match.
2) The Federal statute which authorizes NDIS also provides that the FBI and other criminal justice agencies participating in NDIS may make secondary or indirect disclosures of DNA records:
(A) To criminal justice agencies for law enforcement identification purposes; (B) In judicial proceedings, if otherwise admissible pursuant to applicable statutes or rules; (C) For criminal defense purposes, to a defendant, who shall have access to samples and analyses performed in connection with the case in which defendant is charged; or (D) If personally identifiable information is removed, for a population statistics database, for identification research and protocol development purposes, or for quality control purposes.
Note: Personal information such as names are not found in NDIS. However, operational identifiers such as the Specimen No., Criminal Justice Agency Identifier, and DNA Personnel identifier, are contained in NDIS. Although unlikely, the identity of an individual could, under some circumstances, be ascertained with the disclosure of such numbers for purposes stated in (D) above. This is only possible when access to a criminal justice agency's records is provided to the holder of the operational identifiers. Therefore, to ensure that such associations are not made, these operational numbers will be removed before disclosure for these purposes.
3) A record may be disclosed from this system of records to the National Archives and Records Administration and the General Services Administration in records management inspections conducted under the authority of 44 U.S.C. 2904 and 2906, to the extent that legislation governing the records permits.
Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of Records in the System:
Storage: Information maintained in NDIS is stored electronically for use in a computer environment.
Retrievability: The primary method for retrieving information from NDIS is the target DNA profile search described in the routine use disclosure provisions of this notice.
The NDIS Custodian may retrieve records based on: the DNA profile, the NDIS Agency identifier, the NDIS Specimen Identification Number, and/or DNA personnel identifier. Criminal justice agencies with direct access to NDIS may retrieve their records by the NDIS Agency identifier, NDIS Specimen Identification Number, or DNA personnel identifier but only to inspect, modify, or delete their own DNA records.
Since NDIS records contained in NDIS do not include personal identifiers of the individuals from whom the DNA samples were collected, retrieval by personal identifiers of these record subjects is not possible.
Safeguards: All records in NDIS are protected from unauthorized access through appropriate administrative, physical, and technical safeguards. These safeguards include restricting access to those with a need-to-know to perform their official duties, using locks and alarm devices, and encrypting data communications.
No personally identifiable information about individuals who provided DNA samples is maintained in NDIS. Therefore, names and personally identifiable information of NDIS DNA records cannot be disclosed directly from NDIS. (NDIS does, however, maintain the names of NDA personnel.)
NDIS will disclose to a criminal justice agency the DNA records of another criminal justice agency only when there is a potential DNA match. Any additional disclosures of personally identifiable information or other case-related data are made directly by the criminal justice agencies from their own files and records, not from NDIS.
Although ostensibly devoid of personally identifiable information, DNA records in NDIS contain an NDIS Specimen Identification Number, NDIS Agency identifier, and a DNA personnel identifier for law enforcement and/or general operational purposes. Since it is possible, in some circumstances, to use those numbers together with the appropriate agency's own records to identify the individuals represented by the DNA records, additional precautions are taken.
The precautions involve removal of the Specimen Identification Numbers, NDIS Agency identifiers, and DNA personnel identifiers, prior to disclosure pursuant to the 2(D) routine use. (See the "Routine Uses of Records Maintained in the System" section of this notice.) Thus, NDIS will periodically generate DNA profile data sets, consisting of anonymous DNA profiles, for population statistics databases, for identification research and protocol development purposes, or for quality control purposes.
Criminal justice agencies are prohibited from submitting a DNA record for inclusion in the NDIS Population File for investigative purposes. The only target DNA profile searches conducted against the Population File are those necessary to eliminate duplicate DNA profiles representing the same individual.
Finally, criminal justice agencies with direct access to NDIS must agree to adhere to national quality assurance standards for DNA testing, undergo semi-annual external proficiency testing, and restrict access to DNA samples and data. The NDIS will not accept DNA analyses from those agencies and/or DNA personnel who fail to comply with these standards and restrictions; and the NDIS Custodian is authorized to restrict access to and delete any DNA records previously entered into the system.
Retention and Disposal: DNA records generated by criminal justice agencies, together with the personal identifying information of DNA personnel, shall be retained in NDIS as long as they are substantiated by internal records of the submitting agency and are permitted either by consent, by judicial/criminal justice authority, or by Federal, State, or local law. Records may be deleted by the originating criminal justice agency or by other Federal, State, or local authorities who are responsible for deleting any records that are no longer permitted or appropriate for retention in NDIS. DNA records submitted to NDIS and then found to be inaccurate shall either be modified to achieve accuracy or deleted from NDIS by the submitting agency.
Agencies granted access to NDIS are required to establish and maintain a system of controls to ensure that continued use of their DNA records in NDIS is lawfully permitted. Such a system of controls shall ensure that DNA records in NDIS which are authorized by the consent of individuals, for example, are retained in NDIS only for the duration and within the scope of the consent.
The NDIS Custodian has the authority to determine that certain DNA records in NDIS should be deleted or, alternatively, suspended from use for a period of time determined appropriate by the NDIS Custodian. The criminal justice agencies whose records are affected by a determination to delete or suspend records in NDIS shall be notified of this determination and the nature of the deletion or suspension. The NDIS Custodian may subsequently decide to either restore or delete the suspended records, and shall notify the affected agency of this subsequent determination.
The DNA personnel identifier for a single individual is deleted from NDIS only after all DNA records associated with that individual are deleted.
System Manager(s) and Address: Director, Federal Bureau of Investigation, c/o National DNA Index System Custodian, FBI Laboratory, U.S. Department of Justice, J. Edgar Hoover Building, 935 Pennsylvania Avenue, NW., Washington, DC 20535- 0001.
Notification Procedure: None. This system of records has been exempted from subsections (d) and (e)(4)(G) pursuant to subsection (j)(2) of the Privacy Act, and thus is exempt from the notification provision.
Records Access Procedure: This system of records has been exempted from subsection (d) and (e)(4)(H) pursuant to subsection (j)(2) of the Privacy Act, and thus is exempt from its access provisions. NDIS does not retain information that would allow the NDIS Custodian, independent of the agency which originated the DNA record, to personally identify the record by name or other personal identifier. However, subject to applicable Federal, State, and local law and procedures, the following alternative procedures are available by which an individual may request access to records in NDIS.
1) Subjects of DNA Records:
a) Convicted Offender Records: The individual may contact the Federal, State or local authority (the authorized agency) which ultimately received the collected DNA sample to obtain instructions on how to access his/her record. The authorized agency has the DNA record, if one exists, including information as to whether the DNA record has been submitted to NDIS. Only the authorized agency would have information sufficiently specific to permit retrieval of the record from its files by name or other personally identifiable information. The authorized agency may also retrieve the DNA record, if any, that was submitted to NDIS, once locally specified requirements are met.
In addition, where a convicted offender is relocated voluntarily or involuntarily to a criminal justice agency (i.e., penal institution or parole and probation authorities) for custodial or supervisory purposes in another State or jurisdiction, the DNA record may be created by the new host criminal justice agency or other State (or Federal) authority from a DNA sample collected from the Convicted Offender at the new host criminal justice agency or other State (or Federal) authority. In such circumstances, the individual may contact such agency or authority for access instructions.
b) Close Biological Relatives of Missing Persons and Victims; Living Victims; and Missing Persons Who Have Been Located: These individuals must contact the criminal justice agency (Federal, State, or local) which collected and processed the DNA sample to generate the DNA record. The criminal justice agency can then advise the individual about procedures for access to the DNA record. Such agency may also retrieve the DNA record, if any, that was submitted to NDIS, once locally specified requirements are met.
2) Records of DNA Personnel: These individuals may write to the Federal, State, or local criminal justice agency by which they are or were employed.
3) FBI Generated Records: The subject of an FBI-generated DNA record may address a Freedom of Information/Privacy Act (FOIA/PA) request to the Director, FBI, at the address given at the end of this paragraph. DNA personnel employed by the FBI may also address their requests to the system manager; however, all the information in NDIS concerning DNA personnel is also contained in the FBI's Central Records System (CRS), which may contain additional information. To request access to the CRS, DNA personnel may address an FOIA/PA request to the Director, FBI, U.S. Department of Justice, J. Edgar Hoover Building, 935 Pennsylvania Ave., NW., Washington, DC 20535-0001.
Contesting Records Procedure: This system of records has been exempted from subsections (d) and (e)(4)(H) pursuant to subsection (j)(2) of the Privacy Act, and is thus exempt from its amendment and correction provisions. However, subject to applicable Federal, State, and local laws and procedures, the following alternative procedures are available by which an individual may contest his/her records:
1) All Subjects of DNA Records: The requester must follow the same procedures for contesting records as those outlined under "Record Access Procedures." In addition, the requester should be aware of the following:
a) DNA records submitted to NDIS and contested on the basis of inaccurate information must be resolved with the criminal justice agency that submitted the DNA record NDIS. If a contested DNA record is found to be inaccurate by the criminal justice agency submitting the DNA record, such agency shall correct the inaccurate DNA record by either amending or deleting the record.
b) DNA records submitted to NDIS and contested on the basis of the authority to retain the DNA record must be resolved with the criminal justice agency that submitted the contested DNA record. If such agency determines that the contested DNA records should not be included in NDIS, such agency must delete the contested DNA record.
2) Records of All DNA Personnel: DNA personnel must follow the same procedures for contesting records as those outlined under "Record Access Procedures." record source categories: DNA records in NDIS are received from Federal, State, and local criminal justice agencies. These DNA records may be derived from DNA samples obtained by Federal, State, and local and criminal justice agencies or their agents (public or private).
Systems Exempted from Certain Provisions of the Act: The Attorney General has exempted this system of records from subsection (c) (3) and (4); (d); (e) (1), (2), and (3); (e)(4) (G) and (H); (e) (5) and (8); and (g) of the Privacy Act pursuant to 5 U.S.C. 552a(j)(2). Rules are being promulgated in accordance with the requirements of 5 U.S.C. 553 (b), (c), and (e); and are being published in the Federal Register.
Dated July 8, 1996
