|
PRIVACY
IMPACT ASSESSMENT (PIA)
|
|
FEDERAL
BUREAU OF INVESTIGATION
PRIVACY
IMPACT ASSESSMENT (PIA)
NICS
- Voluntary Appeal File (VAF)
January
6, 2006
I. BACKGROUND
This PIA is conducted pursuant to the E-Government Act
of 2002, P.L. 107-347, the accompanying guidelines issued
by the Office of Management and Budget (OMB) on September
26, 2003, and the FBI's PIA
guidelines.
In November
1993, the Brady Handgun Violence Prevention Act (Brady
Act) was signed into law.
[1]
The Brady Act required that federal firearms
licensees conduct background checks on individuals attempting
to purchase firearms.
The permanent provisions of the Brady Act, which
became effective November 30, 1998, required the Attorney
General to establish the National Instant Criminal Background
Check System (NICS).
NICS is a national name check system that queries
available records in the National Crime Information Center
(NCIC), the Interstate Index (III),
and the NICS Index to determine if prospective
purchasers are disqualified from receiving firearms.
NICS provides federal firearms licensees with an
immediate determination as to whether the transfer of
a firearm may proceed or if more research is required
to determine whether the transfer would violate federal
or state law. Firearms purchasers who are denied may request
the reason for the denial and may challenge the accuracy
of the record upon which the denial is based.
[2]
Pursuant
to a final rule published on July 20, 2004, the NICS must
destroy identifying information by or on behalf of any
person who has been determined not to be prohibited from
receiving a firearm no more than twenty four (24) hours
after the system advises a federal firearms licensee that
the transfer would not violate the Brady Act.
[3]
Accordingly, NICS must destroy all identifying
information on allowed transactions prior to the start
of the next business day.
If a potential purchaser is delayed or denied a
firearm and successfully appeals the decision, NICS cannot
retain the record of the appeal or the supporting documentation. To that end, individuals who wish to make subsequent
purchases may be delayed or denied again until the record
has been re-reviewed or until the purchaser has appealed
the denial by resubmitting the same
documentation/information. In order to prevent future delays or erroneous
denials, the final rule permits lawful transferees to
request that NICS maintain information about themselves
in a
Voluntary
Appeal File (VAF), a separate computer file that will
be checked by NICS.
The NICS has developed a brochure which fully
explains Brady Act requirements and includes a VAF application. Through the VAF application, potential purchasers
will have the option to request that the NICS maintain
personal identifying information about them which would
otherwise be destroyed. This information includes, but is not limited
to, fingerprint cards,
[4]
photographs,
court documentation, correspondence, and information contained
in the applicant’s appeal file if one exists.
[5]
The VAF permits applicants to voluntarily submit
personal identifying information for the limited purpose
of clarifying existing records or proving identity.
On November
12, 2004, the FBI submitted the VAF information request
to the Office of Management and Budget (OMB) for notice
and public comment.
[6]
II. ASSESSMENT
A. What
information is being collected?
The VAF
contains information voluntarily submitted by firearms
purchasers via the VAF application. Purchasers have the
option of supplying the NICS with personal identifying
information such as their name, sex, race, height, weight,
sex, date of birth, alien registration number, and social
security number. Further, purchasers have the option of supplying
other identifying numbers such as military identification
numbers, driver license numbers, FBI numbers and state
identification numbers. Documents or information which clarify records
or prove identity (e.g., fingerprint cards, photographs,
court records, pardons, etc.) are entered into the VAF.
Paper copies are retained and filed accordingly
by the NICS.
B. Why is
the information being collected?
The information
is being collected for the limited purpose of providing
applicants with a means by which they can submit information
to the VAF to prevent future erroneous denials or extended
delays of firearms purchases or transfers.
C. What
is the intended use of the information?
Because
the final rule mandates that the NICS destroy all identifying
information on allowed transactions within twenty four
(24) hours, applicants who are delayed or denied a firearm
purchase, and who successfully appeal the denials, would
be required to resubmit documentation/information for
every subsequent firearms purchase without the VAF.
The VAF permits individuals to submit documentation
which proves or clarifies identity.
Upon receipt of a VAF application, NICS staff conducts
research to determine whether an applicant has a disqualifying
record which would prohibit the applicant from purchasing
a firearm. NICS
employees input the results of the research in the "comments
and hit" summary field.
The hit and comment summary includes NCIC, III,
NICS, and ICE hits. Non-identifiable and identifiable hits are
duly noted in the VAF.
If the NICS determines that there is no disqualifying
information which would prevent the applicant from purchasing
the firearm and validates the information supplied by
the applicant, the application is approved and the applicant
is assigned a Unique Personal Identification Numbers (UPIN).
NICS notifies these applicants in writing. NICS retains paper files of the other data submitted by successful
applicants. NICS notifies unsuccessful applicants that their applications
have been denied via letter.
Other data submitted by unsuccessful applicants
are destroyed.
[7]
However, the NICS may retain records as long
as needed to pursue cases of identified misuse of the
system.
D. With
whom will the information be shared?
FBI personnel
(Legal Instruments Examiners, Program Analysts, Supervisors,
Management Staff) and state points of contact have access
to the information in the VAF for the purpose of conducting
NICS checks.
[8]
State points of contact are able to obtain
a numeric and alphabetic list of entrants in the VAF through
Law Enforcement Online (LEO).
Access is "read-only" for all users with
the exception of NICS staff responsible for adding/deleting
information from the VAF. Information may be disclosed in accordance
with applicable regulations and routine uses.
E. What
opportunities will individuals have to decline to provide
information or to consent to particular uses of the information?
Submission
of information to the VAF is strictly voluntary. Successful
applicants who have supplied information and who wish
to have the information removed may make a written request
to have the information removed. Upon receipt, the NICS will destroy all documentation/information
entered in the VAF.
However, the FBI may retain records as long as
needed to pursue cases of identified misuse of the system.
[9]
F. How will
the information be secured?
Until
the VAF becomes an integrated part of the NICS computer
system, the NICS is using a VAF prototype which resides
in a separate electronic system folder.
The folder is solely accessible to employees within
the NICS and select NICS staff have modification privileges.
Authorized users have "read only" access.
Physical security protections include guards and locked
facilities requiring badges and passwords for access. Records are accessed by authorized government
personnel and are protected by appropriate physical and
technological safeguards to prevent unauthorized access.
During
the implementation stage, federal, state and local law
enforcement agencies that seek access to records located
in the VAF obtain VAF information through LEO via password.
[10]
VAF information
is contained within a closed special interest group. Federal, state and local points of contact
must specifically request entry into the special interest
group. Three (3) members, two (2) program analysts
and one (1) liaison of the NICS staff approve membership
applications to the special interest group.
Currently, state and local law enforcement agencies
who query the VAF database via LEO are able to view a
listing of all VAF participants. NICS advised that, in order to restrict access in LEO, the NICS
would have to expend between $ 500,000 and $ 1,000,000. The NICS advised that such an expenditure would
impact the NICS' other current high priority operations
and maintenance efforts.
Thus, the NICS' advises that restricting access
to individualized queries in LEO is not feasible at this
time.
In CY
2006, the VAF will become an integrated part of the NICS
computer system. The NICS advises that queries in the VAF will
limited to individualized queries at that time. Information maintained in the NICS is stored electronically in
a secure FBI computer environment.
[11]
Access to information in the NICS is restricted
to authorized personnel of federal, state, and local law
enforcement agencies.
[12]
These agencies must have adequate physical
security to protect against any unauthorized personnel
gaining access to computer equipment.
[13]
Further, employees who have access to NICS
information must be thoroughly screened.
[14]
G. Is this
a system of records?
Yes, the
VAF contains personally identifiable information regarding
individuals and information is retrieved by name or personal
identifier. The NICS Privacy Act system notice is being
amended to reflect the VAF.
[15]
H. What
choices did the FBI make regarding an IT system or collection
of information as a result of performing the PIA?
NICS
has determined that the collection of information is necessary
to prevent delays and denials of firearms purchases.
Thus, there is no reasonable alternative to the
VAF. Applicants to the VAF voluntarily submit personal
identifying information which is verified and retained
by NICS for the limited purpose of facilitating the purchase
of firearms. Applicants who submit this information may
request in writing that the information be removed from
the VAF. Thus, the VAF does not involve any new
collection techniques or processes that may be controversial
or invasive of personal privacy.
As a
result of conducting the PIA, the Senior Privacy Official
[16]
determined that the fact that state
and local law enforcement agencies who query the VAF database
via LEO are able to view a listing of all VAF participants
created limited privacy risks.
The Senior Privacy Official discussed this issue
with the NICS and the NICS advised that because of the
tremendous costs associated with restricting access in
LEO, it is unable to restrict access at this time.
The Senior Privacy Official determined that because
access to the VAF, via LEO is temporary, and because access
will be restricted once the VAF becomes part of the NICS
computer system, the privacy risks associated with access
to VAF information via LEO are sufficiently mitigated.
III. APPROVAL
The FBI's Senior Privacy Official has
reviewed this system for privacy policy issues, perceives
no unusual privacy concerns at stake here, and approves
the FBI's implementation of this system.
Specifically, applicants to the VAF voluntarily
submit personal identifying information which is verified
and retained by NICS for the limited purpose of facilitating
the purchase of firearms. Applicants who submit this information may
request in writing that the information be removed from
the VAF. The dissemination of the information is limited
to legitimate purposes in compliance with allowable disclosures
for information contained in the NICS system of records. Further, information submitted to the VAF is verified by NICS personnel
who contact the contributing agencies to verify that information
is accurate. Moreover,
NICS verifies data by performing scheduled assessments
and audits. Ultimately, the VAF is a simple system containing routine information
which is voluntarily submitted and involves limited use
and access. A
new Privacy Act systems notice is not required, but the
NICS notice will be amended to reflect the VAF.
ËË
[1]
18 U.S.C.
§ 923 (2004).
[2]
28 C.F.R. § 25.10(a), (c) (2004).
[3]
National Instant Criminal Background Check
System Regulation, 69 FR 43892 (July 23, 2004) (to be
codified at 28 C.F.R. pt. 25).
[4]
Fingerprint
impressions must be prepared by a law enforcement agency
who must stamp their agency name, address, and telephone
number in the designated area.
[5]
NICS maintains paper copies of information
submitted for entry into the VAF.
[6]
Sixty (60) Day Emergency Notice of Collection
Under Review Voluntary Appeal File, 69 Fed. Reg. 65455
(proposed Nov. 12, 2004).
On May 2, 2005, the FBI resubmitted the
VAF information request to OMB for public comment. See Thirty (30) Day Notice of Information
Collection Under Review, 70 Fed. Reg. 22704 (proposed
May 2, 2005). The notice provided an additional thirty (30)
days for public comment.
See id.
[7]
NICS returns fingerprint cards to unsuccessful applicants.
[8]
The folder is also accessible to information
technology personnel who provide technical support to
the NICS.
[9]
25 C.F.R.
§ 25.10(g).
[10]
Access to LEO is subject to FBI approval.
LEO is accessed via password and all network
traffic is monitored and recorded by personnel authorized
by the FBI.
[11]
28 C.F.R.
§ 25.8(a)-(b).
[12]
28 C.F.R. § 25.8(c)(1)-(5),(d)(1)-(3).
[15]
See 63
FR 30514 (June 4, 1998).
[16]
This position
is currently held by Deputy General Counsel Patrick
W. Kelley.
|
|