Privacy Act of 1974; System of Records, 64601-64605 [2018-27265]

Download as PDF Federal Register / Vol. 83, No. 241 / Monday, December 17, 2018 / Notices If additional information is required, please contact: Melody Braswell, Department Clearance Officer, U.S. Department of Justice, Justice Management Division, Policy and Planning Staff, Two Constitution Square, 145 N Street NE, Room 3E.405B, Washington, DC 20530. Dated: December 11, 2018. Melody Braswell, Department Clearance Officer for PRA, U.S. Department of Justice. [FR Doc. 2018–27172 Filed 12–14–18; 8:45 am] BILLING CODE 4410–PB–P DEPARTMENT OF JUSTICE [CPCLO Order No. 007–2018] Privacy Act of 1974; System of Records United States Department of Justice, Federal Bureau of Investigation. ACTION: Notice of a Modified System of Records. AGENCY: Pursuant to the Privacy Act of 1974 and Office of Management and Budget (OMB) Circular No. A–108, notice is hereby given that the Federal Bureau of Investigation (FBI), a component within the United States Department of Justice (DOJ), proposes to modify a system of records titled ‘‘Law Enforcement National Data Exchange’’ (N–DEx), JUSTICE/FBI–020, as to which notice was last published in the Federal Register on October 4, 2007 (Notice). The N–DEx System is a scalable information-sharing network that provides the capability for local, state, tribal, territorial, regional, federal, and foreign criminal justice agencies to make potential linkages between criminal justice incidents, investigations, arrests, bookings, incarcerations, parole and/or probation information, and criminal intelligence information, in order to help solve, deter, and prevent crimes, and, in the process, to enhance national security. DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is applicable upon publication, subject to a 30-day period in which to comment on the routine uses, described below. Please submit any comments by January 16, 2019. ADDRESSES: The public, OMB, and Congress are invited to submit any comments: by mail to DOJ, Office of Privacy and Civil Liberties, ATTN: Privacy Analyst, National Place Building, 1331 Pennsylvania Ave. NW, Suite 1000, Washington, DC 20530– 0001; by facsimile at 202–307–0693; or by email at privacy.compliance@ amozie on DSK3GDR082PROD with NOTICES1 SUMMARY: VerDate Sep<11>2014 19:17 Dec 14, 2018 Jkt 247001 usdoj.gov. To ensure proper handling, please reference the above CPCLO Order No. on your correspondence. FOR FURTHER INFORMATION CONTACT: Katherine Bond, Assistant General Counsel, Privacy and Civil Liberties Unit, Office of the General Counsel, FBI, 935 Pennsylvania Avenue NW, Washington, DC 20535–0001; telephone 202–324–3000. SUPPLEMENTARY INFORMATION: The FBI has revised this system of records to update the purpose and uses of the system, the type of information maintained by the system, the sources of information, and the retrieval capabilities of information from the system. The FBI is modifying the name of this system of records from ‘‘Law Enforcement National Data Exchange’’ to ‘‘National Data Exchange System’’ (N–DEx System). This name change reflects a previously implemented FBI policy decision to remove ‘‘law enforcement’’ from the title of the system to reflect more accurately the use of the N–DEx System by all criminal justice agencies. Similarly, to provide greater transparency on the use of the system of records, the term ‘‘law enforcement’’ within the existing notice is being changed to ‘‘criminal justice’’ generally. ‘‘Administration of criminal justice,’’ as defined by federal regulation, encompasses the performance of a broader array of activities than those performed only by sworn law enforcement officers, and include probation/parole, correctional supervision, prosecution, and rehabilitation of accused persons or criminal offenders. Criminal justice agencies also include courts and government agencies performing the administration of criminal justice functions. See 28 CFR 20.3(b) and (g). Despite changes to the system as described in this notice, the FBI continues to assert, and is not changing the Privacy Act exemptions for the system promulgated by Final Rule at 73 FR 9947 (Feb. 25, 2008). As stated in that Final Rule, these Privacy Act exemptions apply only to the extent that information in the system is within the scope of 5 U.S.C. 552a(j)(2), and to the extent it is, the rationale for asserting the exemptions has not changed. Although the name of this system of records is changing slightly pursuant to this Notice, the exemptions as stated in 73 FR 9947 (Feb. 25, 2008) under the prior name of this system continue to apply under the new name. When changes to the exemptions for this system become necessary, FBI will at that time indicate as part of the rule PO 00000 Frm 00086 Fmt 4703 Sfmt 4703 64601 change that the name of the system has changed slightly. The FBI is also updating the purpose and routine uses of the Notice to reflect the expanded purpose of the N–DEx System to provide records to criminal justice agencies for criminal justice employment background checks; firearms, explosive, and associated license/permit-related background checks; and security risk assessments conducted on individuals seeking access to select biological agents or toxins pursuant to 42 U.S.C. 262a and 42 CFR 73.10. In addition, the updated purpose reflects the use of the N–DEx System for federal suitability and fitness determinations as contemplated in Executive Order 13467, as amended by Executive Order 13764. These expanded uses of the N–DEx System promote public safety by ensuring that a prospective employee’s involvement in the criminal justice system is known before a criminal justice employee or federal employee is hired. Likewise, expanding the use of the N–DEx System for firearm, explosive, and associated license/permit-related checks and security risk assessments provides access to additional criminal justice information relevant to determining if a potential purchaser is prohibited by state or federal law from receiving a firearm, explosive, or associated permit or if an applicant is legally restricted from accessing select biological agents or toxins. For consolidation purposes, the routine uses applicable to the N– DEx System under the FBI’s Blanket Routine Uses (FBI–BRU, 66 FR 33558 (June 22, 2001), as amended by 70 FR 7513, 517 (Feb. 14, 2005) and 82 FR 24147 (May 25, 2017)), are also being included in the routine use portion of this notice. Additional changes are being made to this Notice to provide greater clarity about the information contained in the N–DEx System and the types of information that can be retrieved for criminal justice purposes by the N–DEx System. Expanding the N–DEx System to include records retrieved via a federated search of additional criminal justice information and criminal intelligence databases increases criminal justice agencies’ access to information necessary for them to perform their legally authorized, required functions. In accordance with 5 U.S.C. 552a(r), the DOJ has provided a report to OMB and the Congress on this revised system of records. E:\FR\FM\17DEN1.SGM 17DEN1 64602 Federal Register / Vol. 83, No. 241 / Monday, December 17, 2018 / Notices Dated: December 11, 2018. Peter A. Winn Acting Chief Privacy and Civil Liberties Officer, United States Department of Justice. SYSTEM NAME AND NUMBER: National Data Exchange System (N– DEx System), JUSTICE/FBI–020. SECURITY CLASSIFICATION: Sensitive But Unclassified. SYSTEM LOCATION: Records will be located at the Federal Bureau of Investigation (FBI), Criminal Justice Information Services (CJIS) Division, 1000 Custer Hollow Road, Clarksburg, WV 26306, and at appropriate locations for system backup and continuity of operations purposes. Records may also be maintained in secure cloud computing environments. The cloud computing service provider on the date of this publication is Amazon Web Services, located at 12900 Worldgate Drive, Herndon, VA 20170. Cloud computing service providers may change. For information about the current cloud computing service provider, please contact the Unit Chief, Privacy and Civil Liberties Unit, Office of the General Counsel, FBI, 935 Pennsylvania Avenue NW, Washington, DC 20535–0001; telephone 202–324– 3000. SYSTEM MANAGER(S): Director, Federal Bureau of Investigation, 935 Pennsylvania Avenue NW, Washington, DC 20535–0001; telephone 202–324–3000. AUTHORITY FOR MAINTENANCE OF THE SYSTEM: The system is established and maintained in accordance with 28 U.S.C. 533, 534; 28 CFR 0.85 and 28 CFR part 20. amozie on DSK3GDR082PROD with NOTICES1 PURPOSE(S) OF THE SYSTEM: The purpose of the N–DEx System is to enhance the interconnectivity of criminal justice databases in various agencies and jurisdictions in order to improve the sharing of multiple levels of criminal justice data to further objectives for crime analysis, criminal justice administration (‘‘administration of criminal justice’’ is defined at 28 CFR 20.3(b)), and strategic/tactical operations in investigating, reporting, solving, and preventing crime, and, thereby, improving national security. The N–DEx System provides local, state, tribal, territorial, regional, federal, foreign criminal justice, and limited authorized noncriminal justice agencies with a powerful investigative tool to link, share, search, and analyze criminal justice information, including incident/ case reports, incarceration data, and VerDate Sep<11>2014 19:17 Dec 14, 2018 Jkt 247001 parole/probation data. In addition to containing information submitted by criminal justice agencies and jurisdictions nationwide (as will be detailed below in this Notice), the N– DEx System facilitates the sharing of criminal justice and criminal intelligence information (‘‘criminal intelligence information’’ is defined at 28 CFR 23.3(b)(3)) controlled and maintained by many different agencies and jurisdictions nationwide. As well as facilitating information sharing for investigative purposes, the N–DEx System also facilitates such sharing for criminal justice employment background checks; federal suitability and fitness determinations for covered individuals as defined in Executive Order 13467, as amended by Executive Order 13764; security risk assessments on individuals applying for access to select biological agents and toxins as set forth in 42 U.S.C. 262a and 42 CFR 73.10; and firearms, explosives, and associated license/permit-related background checks conducted by criminal justice agencies. CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM: The N–DEx System contains information maintained by the FBI about the following types of individuals: A. Any individual who is identified in a criminal justice report concerning a criminal justice incident or investigation. These individuals include, but are not limited to: Subjects; suspects; associates; victims; persons of interest; witnesses; and/or any individual named in pre-trial investigations and arrest, booking, incident, incarceration, parole, and probation reports. B. N–DEx System users and individuals listed as the point of contact for records in the N–DEx System. C. Individuals who have been queried through the N–DEx System. In addition to information about the above individuals that is actually maintained by the system, the N–DEx System also facilitates access to information not maintained by the FBI, but that is contained in non-FBI databases (controlled by local, state, tribal, territorial, regional, and other federal agencies) that can be searched via functionality of the N–DEx System. The information in systems controlled or maintained by other agencies or jurisdictions will include information about the categories of individuals described in (A) above, but will also include information about individuals identified in criminal intelligence information (defined at 28 CFR 23.3(b)(3)). These individuals may PO 00000 Frm 00087 Fmt 4703 Sfmt 4703 include, but are not limited to, subjects, suspects, associates, victims, persons of interest, witnesses, and/or any individual named in a criminal intelligence product or report. Information about individuals maintained in local, state, tribal, territorial, regional, federal (nonDepartment of Justice), and foreign criminal justice databases, and merely accessed via N–DEx System search are not part of the N–DEx System system of records because they are not ‘‘under the control of’’ the Department as stated in the Privacy Act definition of ‘‘system of records.’’ 5 U.S.C. 552a(a)(5). CATEGORIES OF RECORDS IN THE SYSTEM: The N–DEx System contains information collected by criminal justice agencies that is needed for the performance of their legally authorized, required functions. The records in the N–DEx System span the entire criminal justice lifecycle and consist of arrest, holding, incident, supervised release, booking, incarceration, service call, case and warrant reports; pre-trial investigation reports; missing persons reports; parole and/or probation information; other information collected by criminal justice agencies; and information shared for collaboration purposes from local, state, tribal, territorial, regional, federal, and foreign criminal justice entities. Identifying information in the N–DEx System includes, but is not limited to: Name(s); sex; race; citizenship; date and place of birth; address(es); telephone number(s); social security number(s) or other unique identifiers; physical description, including height, weight, hair color, eye color, gender; occupation and vehicle identifiers; and photographs. Records from the FBI’s CJIS Division systems, including the National Crime Information Center (NCIC), the Interstate Identification Index (III), and the Next Generation Identification (NGI) Systems, will be made available to the N–DEx System for queries, but the N–DEx System will not contain copies of these databases. Additionally, records from other criminal justice and criminal intelligence databases controlled and updated by local, state, tribal, territorial, regional, federal, and foreign criminal justice entities or non-governmental agencies will be made accessible for queries via the N–DEx System, but because the FBI and DOJ will not control or update the records from these databases, this information will not be considered part of the N–DEx System system of records. Records maintained in the N–DEx System about individuals described in category ‘‘B’’ of INDIVIDUALS E:\FR\FM\17DEN1.SGM 17DEN1 Federal Register / Vol. 83, No. 241 / Monday, December 17, 2018 / Notices COVERED BY THE SYSTEM above include name, userID, phone number, email address, associated identity provider, employing agency, and information users voluntarily provide for collaboration purposes. The N–DEx System also maintains an audit log of searches conducted in the N–DEx System and records viewed as a result of each search. The audit log includes search criteria that may include identifying information (e.g. name, date of birth, social security number) about individuals described in category ‘‘C’’ of INDIVIDUALS COVERED BY THE SYSTEM above. RECORD SOURCE CATEGORIES: Information contained in the N–DEx System is obtained from local, state, tribal, territorial, regional, federal, and foreign criminal justice agencies and non-governmental agencies that compile information for criminal justice purposes. amozie on DSK3GDR082PROD with NOTICES1 ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES: As part of those disclosures generally permitted under 5 U.S.C. 552a(b), the records in this system may be disclosed as a routine use, under 5 U.S.C. 552a(b)(3) to the following persons or entities and under the circumstances or for the purposes described below: A. To any criminal, civil, or regulatory authority (whether local, state, tribal, territorial, regional, federal, or foreign) where the information is relevant to the recipient entity’s criminal justice responsibilities. B. To a local, state, tribal, territorial, regional, federal, foreign, international, or other public agency/organization, or to any person or entity in either the public or private sector, domestic or foreign, where such disclosure may facilitate the apprehension of fugitives, the location of missing persons, the location and/or return of stolen property or similar criminal justice objectives. C. To local, state, tribal, territorial, regional, or federal criminal justice agencies for the performance of firearms, explosives, or associated license/permit-related background checks. D. To federal agencies for the performance of federal suitability or fitness determinations under the authority of Executive Order 13467 as amended by Executive Order 13764. E. To federal agencies in connection with a security risk assessment conducted, pursuant to 42 U.S.C. 262a and 42 CFR 73.10, on an individual applying for access to select biological agents or toxins. VerDate Sep<11>2014 19:17 Dec 14, 2018 Jkt 247001 F. To a local, state, tribal, territorial, regional, federal, or foreign governmental entity lawfully engaged in collecting law enforcement, law enforcement intelligence, national security information, homeland security information, national intelligence, possible national security threat information, or terrorism information for law enforcement, intelligence, national security, homeland security, or counterterrorism purposes. G. To any person or entity in either the public or private sector, domestic or foreign, if deemed by the FBI to be reasonably necessary to elicit information or cooperation from the recipient for use in furthering the purposes of the system. H. To appropriate agencies, entities, and persons when (1) the Department suspects or has confirmed that there has been a breach of the system of records; (2) the Department has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, DOJ (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department’s efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm. I. To another Federal agency or Federal entity, when the Department determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach. J. To those agencies, entities, and persons the FBI may consider necessary or appropriate in ensuring the continuity of government functions in the event of any actual or potential significant disruption of normal government operations. This also includes all related pre-event planning, preparation, backup/redundancy, training and exercises, and post-event operations, mitigation, and recovery. K. If any system record, on its face or in conjunction with other information, indicates a violation or potential violation of law (whether civil or criminal), regulation, rule, order, or contract, the pertinent record may be disclosed to the appropriate entity (whether federal, state, local, joint, PO 00000 Frm 00088 Fmt 4703 Sfmt 4703 64603 tribal, foreign, or international), that is charged with the responsibility of investigating, prosecuting, and/or enforcing such law, regulation, rule, order, or contract. L. To contractors, grantees, experts, consultants, students, or others performing or working on a contract, service, grant, cooperative agreement, or other assignment for the Federal Government, when necessary to accomplish an agency function. M. To the news media or members of the general public in furtherance of a legitimate law enforcement or public safety function as determined by the FBI, e.g., to assist in locating fugitives; to provide notifications of arrests; to provide alerts, assessments, or similar information on potential threats to life, health, or property; or to keep the public appropriately informed of other law enforcement or FBI matters or other matters of legitimate public interest where disclosure could not reasonably be expected to constitute an unwarranted invasion of personal privacy. (The availability of information in pending criminal or civil cases will be governed by the provisions of 28 CFR 50.2.) N. To a court or adjudicative body, in matters in which (a) the FBI or any FBI employee in his or her official capacity, (b) any FBI employee in his or her individual capacity where the Department of Justice has agreed to represent the employee, or (c) the United States, is or could be a party to the litigation, is likely to be affected by the litigation, or has an official interest in the litigation, and disclosure of system records has been determined by the FBI to be arguably relevant to the litigation. Similar disclosures may be made in analogous situations related to assistance provided to the Federal Government by non-FBI employees (see Routine Use L). O. To an actual or potential party or his or her attorney for the purpose of negotiating or discussing such matters as settlement of the case or matter, or informal discovery proceedings, in matters in which the FBI has an official interest and in which the FBI determines records in the system to be arguably relevant. P. To such recipients and under such circumstances and procedures as are mandated by Federal statute or treaty. Q. To a Member of Congress or a person on his or her staff acting on the Member’s behalf when the request is made on behalf and at the request of the individual who is the subject of the record. R. National Archives and Records Administration (NARA) Records E:\FR\FM\17DEN1.SGM 17DEN1 amozie on DSK3GDR082PROD with NOTICES1 64604 Federal Register / Vol. 83, No. 241 / Monday, December 17, 2018 / Notices Management. To the National Archives and Records Administration (NARA) for records management inspections and such other purposes conducted under the authority of 44 U.S.C. 2904 and 2906. S. To any agency, organization, or individual for the purposes of performing authorized audit or oversight operations of the FBI and meeting related reporting requirements. T. The DOJ may disclose relevant and necessary information to a former employee of the Department for purposes of: Responding to an official inquiry by a federal, state, or local government entity or professional licensing authority, in accordance with applicable Department regulations; or facilitating communications with a former employee that may be necessary for personnel-related or other official purposes where the Department requires information and/or consultation assistance from the former employee regarding a matter within that person’s former area of responsibility. (Such disclosures will be effected under procedures established in title 28, Code of Federal Regulations, sections 16.300– 301 and DOJ Order 2710.8C, including any future revisions.) U. To the White House (the President, Vice President, their staffs, and other entities of the Executive Office of the President (EOP)), and, during Presidential transitions, the PresidentElect and Vice-President Elect and their designees for appointment, employment, security, and access purposes compatible with the purposes for which the records were collected by the FBI, e.g., disclosure of information to assist the White House in making a determination whether an individual should be: (1) Granted, denied, or permitted to continue in employment on the White House Staff; (2) given a Presidential appointment or Presidential recognition; (3) provided access, or continued access, to classified or sensitive information; or (4) permitted access, or continued access, to personnel or facilities of the White House/EOP complex. System records may be disclosed also to the White House and, during Presidential transitions, to the President Elect and Vice-President Elect and their designees, for Executive Branch coordination of activities which relate to or have an effect upon the carrying out of the constitutional, statutory, or other official or ceremonial duties of the President, President Elect, VicePresident or Vice-President Elect. V. To complainants and/or victims to the extent deemed appropriate by the FBI to provide such persons with VerDate Sep<11>2014 19:17 Dec 14, 2018 Jkt 247001 information and explanations concerning the progress and/or results of the investigations or cases arising from the matters of which they complained and/or of which they were victims. W. To appropriate officials and employees of a federal agency or entity which requires information relevant to a decision concerning the hiring, appointment, or retention of an employee; the issuance, renewal, suspension, or revocation of a security clearance; the execution of a security or suitability investigation; the letting of a contract; or the issuance of a grant or benefit. X. To designated officers and employees of local, state, (including the District of Columbia), or tribal law enforcement or detention agencies in connection with the hiring or continued employment of an employee or contractor, where the employee or contractor would occupy or occupies a position of public trust as a law enforcement officer or detention officer having direct contact with the public or with prisoners or detainees, to the extent that the information is relevant and necessary to the recipient agency’s decision. POLICIES AND PRACTICES FOR STORAGE OF RECORDS: Most information is maintained in electronic form and stored in computer memory, on disk storage, on computer tape, in a government approved cloud computing infrastructure (e.g., FedRAMP approved) offered by a cloud service provider (e.g. Amazon Web Services), or on other computer media. However, some information may also be maintained by the contributing agency in hard copy (paper) or other form. POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS: Information will be retrieved from the N–DEx System by keyword search and linkages based on identifying data collected on involved persons, places and things, and other non-specific descriptions of circumstances to identify common or similar events. This could include individual names or other personal identifiers. In addition to returning records based upon a direct query of the N–DEx System, N–DEx System records may also be retrieved by a query made to other authorized interoperable systems when the users of the other systems would also be authorized to access the N–DEx System. POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS: The information within the N–DEx System will be contributed by local, PO 00000 Frm 00089 Fmt 4703 Sfmt 4703 state, tribal, territorial, regional, federal, and foreign criminal justice entities. Records in the N–DEx System are restricted to information obtained by criminal justice agencies in connection with their official duties administering criminal justice. All entities are responsible for ensuring the relevance and currency of the information they contribute to the N–DEx System and will have control and responsibility for the disposition of their own records through a process that is documented by the N–DEx Policy and Operating Manual, or based upon federal law. The N–DEx Policy and Operating Manual requires that before taking action on an N–DEx System record, agencies verify the accuracy and completeness of the record with the record owner. Policy also dictates that record contributors update their records at least monthly. Those portions of the N–DEx System that constitute federal records are subject to applicable retention schedules approved by the National Archives and Records Administration (NARA). In addition, the N–DEx System itself will result in the creation of metadata or an audit log that reflects any correlation between any of the submitted records, as well as information about user activity. The N– DEx System metadata or audit logs will be retained for 25 years, or as otherwise specified in the NARA schedule, Job No. N1–065–11–2. ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS: N–DEx System records are maintained in limited access space in FBI controlled facilities and offices or in secure cloudcomputing environments. Computerized data is password protected. Information in the cloud is stored in a government approved cloud computing infrastructure (e.g., FedRAMP approved) offered by a cloud service provider. All communications between the FBI infrastructure and the cloud service provider are encrypted both in transit and at rest to comply with Trusted Internet Connection (TIC) requirements and security best practices. All FBI personnel are required to pass extensive background investigations. N–DEx System information is accessed only by authorized DOJ personnel, or by nonDOJ personnel properly authorized to assist in the conduct of an agency function related to these records. The N–DEx System has adequate physical security and built in controls to protect against unauthorized personnel gaining access to the equipment and/or the information stored in it. E:\FR\FM\17DEN1.SGM 17DEN1 Federal Register / Vol. 83, No. 241 / Monday, December 17, 2018 / Notices RECORD ACCESS PROCEDURES: Because the N–DEx System contains records compiled to assist with the enforcement of criminal laws, the records in this system have been exempted from notification, access, and amendment to the extent permitted by subsection (j) of the Privacy Act. An individual who is the subject of one or more records in this system may be notified of records that are not exempt from notification and, accordingly, may access those records that are not exempt from disclosure. All requests for access should follow the guidance provided on the FBI’s website at https://www.fbi.gov/ services/records-management/foipa. A request for access to a record from this system of records must be submitted in writing and comply with 28 CFR part 16. Individuals may mail, fax, or electronically submit a request, clearly marked ‘‘Privacy Act Access Request,’’ to the FBI, ATTN: FOI/PA Request, Record/Information Dissemination Section, 170 Marcel Drive, Winchester, VA 22602–4843; facsimile: 540–868– 4995/6/7; electronically: https:// www.fbi.gov/services/recordsmanagement/foipa/requesting-fbirecords. The request should include a general description of the records sought, and must include the requester’s full name, current address, and date and place of birth. The request must be signed and dated and either notarized or submitted under penalty of perjury. While no specific form is required, requesters may obtain a form (Form DOJ–361) for use in certification of identity, which can be located at the above link. In the initial request, the requester may also include any other identifying data that the requester may wish to furnish to assist the FBI in making a reasonable search. The request should include a return address for use by the FBI in responding; requesters are also encouraged to include a telephone number to facilitate FBI contacts related to processing the request. A determination of whether a record may be accessed will be made after a request is received. amozie on DSK3GDR082PROD with NOTICES1 CONTESTING RECORD PROCEDURES: To contest or amend information maintained in the N–DEx System, an individual should direct his/her request to the address provided above, stating clearly and concisely what information is being contested, the reasons for contesting it, and the proposed amendment to the information sought. Some information may be exempt from contesting record procedures as described in the section titled ‘‘Exemptions Claimed for the System.’’ An individual who is the subject of one VerDate Sep<11>2014 19:17 Dec 14, 2018 Jkt 247001 or more records in this system may contest and pursue amendment of those records that are not exempt. A determination whether a record may be subject to amendment will be made at the time a request is received. NOTIFICATION PROCEDURES: Same as RECORD ACCESS PROCEDURES paragraph, above. 64605 FOR FURTHER INFORMATION CONTACT: Contact Surina Singh at compplan@ ncpc.gov or by phone at (202) 482–7233. Authority: 40 U.S.C. 8721(a). Dated: December 6, 2018. Anne R. Schuyler, General Counsel. [FR Doc. 2018–26990 Filed 12–14–18; 8:45 am] BILLING CODE P EXEMPTIONS PROMULGATED FOR THE SYSTEM: The Attorney General has exempted the N–DEx System from subsection (c)(3) and (4); (d)(1), (2), (3) and (4); (e)(1), (2), (3), (5) and (8); and (g) of the Privacy Act pursuant to 5 U.S.C. 552a(j)(2). Rules have been promulgated in accordance with the requirements of 5 U.S.C. 553(b), (c), and (e). See 28 CFR 16.96(t) and (u). NATIONAL CREDIT UNION ADMINISTRATION Sunshine Act: Notice of a Matter To Be Added to the Agenda for Consideration at an Agency Meeting FEDERAL REGISTER CITATION OF PREVIOUS ANNOUNCEMENT: December 10, 2018 (83 FR 63540). HISTORY: 10:00 a.m., Thursday, December 13, 2018. PLACE: Board Room, 7th Floor, Room 7047, 1775 Duke Street, Alexandria, VA 22314–3428. STATUS: Open. [FR Doc. 2018–27265 Filed 12–14–18; 8:45 am] Pursuant to the provisions of the BILLING CODE 4410–02–P ‘‘Government in Sunshine Act’’ notice is hereby given that the NCUA Board gave notice on December 6, 2018 of the open NATIONAL CAPITAL PLANNING meeting of the NCUA Board scheduled COMMISSION for December 13, 2018. Prior to the meeting, on December 13, 2018, the Notice of Final Adoption and Effective NCUA Board unanimously determined Date that agency business required the addition of a fourth item on the agenda AGENCY: National Capital Planning with less than seven days’ notice to the Commission. public, and that no earlier notice of the ACTION: Notice of final adoption of and addition was possible. effective date for a revised Parks and MATTER TO BE ADDED: 4. 2019 Share Open Space Element for the Federal Elements of the Comprehensive Plan for Insurance Fund Normal Operating Level. the National Capital. FOR FURTHER INFORMATION CONTACT: SUMMARY: The National Capital Planning Gerard Poliquin, Secretary of the Board, Commission adopted the Parks and Telephone: 703–518–6304. Open Space Element (Element) of the Gerard Poliquin, ‘‘Comprehensive Plan for the National Capital: Federal Elements’’ on December Secretary of the Board. 6, 2018. The Element guides planning [FR Doc. 2018–27355 Filed 12–13–18; 4:15 pm] and development, and addresses matters BILLING CODE 7535–01–P related to Federal parks and open space in the National Capital Region, which NATIONAL CREDIT UNION includes the District of Columbia; ADMINISTRATION Montgomery and Prince George’s Counties in Maryland; Arlington, Submission for OMB Review; Fairfax, Loudoun, and Prince William Comment Request Counties in Virginia; and all cities within the boundaries of these counties. AGENCY: National Credit Union The Element provides the policy Administration (NCUA). framework for Commission actions on ACTION: Notice. plans and projects subject to Commission review. The Element is SUMMARY: The National Credit Union available online for review at https:// Administration (NCUA) will submit the www.ncpc.gov/plans/compplan/. following information collection request DATES: The revised Element will become to the Office of Management and Budget (OMB) for review and clearance in effective February 15, 2019. Law Enforcement National Data Exchange System (N–DEx), JUSTICE/ FBI–020, 77 FR 56793 (Oct. 4, 2007), as amended by 82 FR 24151, 157 (May 25, 2017). PO 00000 Frm 00090 Fmt 4703 Sfmt 4703 TIME AND DATE: E:\FR\FM\17DEN1.SGM 17DEN1

Agencies

[Federal Register Volume 83, Number 241 (Monday, December 17, 2018)]
[Notices]
[Pages 64601-64605]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-27265]


-----------------------------------------------------------------------

DEPARTMENT OF JUSTICE

[CPCLO Order No. 007-2018]


Privacy Act of 1974; System of Records

AGENCY: United States Department of Justice, Federal Bureau of 
Investigation.

ACTION: Notice of a Modified System of Records.

-----------------------------------------------------------------------

SUMMARY: Pursuant to the Privacy Act of 1974 and Office of Management 
and Budget (OMB) Circular No. A-108, notice is hereby given that the 
Federal Bureau of Investigation (FBI), a component within the United 
States Department of Justice (DOJ), proposes to modify a system of 
records titled ``Law Enforcement National Data Exchange'' (N-DEx), 
JUSTICE/FBI-020, as to which notice was last published in the Federal 
Register on October 4, 2007 (Notice). The N-DEx System is a scalable 
information-sharing network that provides the capability for local, 
state, tribal, territorial, regional, federal, and foreign criminal 
justice agencies to make potential linkages between criminal justice 
incidents, investigations, arrests, bookings, incarcerations, parole 
and/or probation information, and criminal intelligence information, in 
order to help solve, deter, and prevent crimes, and, in the process, to 
enhance national security.

DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11), this notice is 
applicable upon publication, subject to a 30-day period in which to 
comment on the routine uses, described below. Please submit any 
comments by January 16, 2019.

ADDRESSES: The public, OMB, and Congress are invited to submit any 
comments: by mail to DOJ, Office of Privacy and Civil Liberties, ATTN: 
Privacy Analyst, National Place Building, 1331 Pennsylvania Ave. NW, 
Suite 1000, Washington, DC 20530-0001; by facsimile at 202-307-0693; or 
by email at privacy.compliance@usdoj.gov. To ensure proper handling, 
please reference the above CPCLO Order No. on your correspondence.

FOR FURTHER INFORMATION CONTACT: Katherine Bond, Assistant General 
Counsel, Privacy and Civil Liberties Unit, Office of the General 
Counsel, FBI, 935 Pennsylvania Avenue NW, Washington, DC 20535-0001; 
telephone 202-324-3000.

SUPPLEMENTARY INFORMATION: The FBI has revised this system of records 
to update the purpose and uses of the system, the type of information 
maintained by the system, the sources of information, and the retrieval 
capabilities of information from the system.
    The FBI is modifying the name of this system of records from ``Law 
Enforcement National Data Exchange'' to ``National Data Exchange 
System'' (N-DEx System). This name change reflects a previously 
implemented FBI policy decision to remove ``law enforcement'' from the 
title of the system to reflect more accurately the use of the N-DEx 
System by all criminal justice agencies. Similarly, to provide greater 
transparency on the use of the system of records, the term ``law 
enforcement'' within the existing notice is being changed to ``criminal 
justice'' generally. ``Administration of criminal justice,'' as defined 
by federal regulation, encompasses the performance of a broader array 
of activities than those performed only by sworn law enforcement 
officers, and include probation/parole, correctional supervision, 
prosecution, and rehabilitation of accused persons or criminal 
offenders. Criminal justice agencies also include courts and government 
agencies performing the administration of criminal justice functions. 
See 28 CFR 20.3(b) and (g).
    Despite changes to the system as described in this notice, the FBI 
continues to assert, and is not changing the Privacy Act exemptions for 
the system promulgated by Final Rule at 73 FR 9947 (Feb. 25, 2008). As 
stated in that Final Rule, these Privacy Act exemptions apply only to 
the extent that information in the system is within the scope of 5 
U.S.C. 552a(j)(2), and to the extent it is, the rationale for asserting 
the exemptions has not changed. Although the name of this system of 
records is changing slightly pursuant to this Notice, the exemptions as 
stated in 73 FR 9947 (Feb. 25, 2008) under the prior name of this 
system continue to apply under the new name. When changes to the 
exemptions for this system become necessary, FBI will at that time 
indicate as part of the rule change that the name of the system has 
changed slightly.
    The FBI is also updating the purpose and routine uses of the Notice 
to reflect the expanded purpose of the N-DEx System to provide records 
to criminal justice agencies for criminal justice employment background 
checks; firearms, explosive, and associated license/permit-related 
background checks; and security risk assessments conducted on 
individuals seeking access to select biological agents or toxins 
pursuant to 42 U.S.C. 262a and 42 CFR 73.10. In addition, the updated 
purpose reflects the use of the N-DEx System for federal suitability 
and fitness determinations as contemplated in Executive Order 13467, as 
amended by Executive Order 13764. These expanded uses of the N-DEx 
System promote public safety by ensuring that a prospective employee's 
involvement in the criminal justice system is known before a criminal 
justice employee or federal employee is hired. Likewise, expanding the 
use of the N-DEx System for firearm, explosive, and associated license/
permit-related checks and security risk assessments provides access to 
additional criminal justice information relevant to determining if a 
potential purchaser is prohibited by state or federal law from 
receiving a firearm, explosive, or associated permit or if an applicant 
is legally restricted from accessing select biological agents or 
toxins. For consolidation purposes, the routine uses applicable to the 
N-DEx System under the FBI's Blanket Routine Uses (FBI-BRU, 66 FR 33558 
(June 22, 2001), as amended by 70 FR 7513, 517 (Feb. 14, 2005) and 82 
FR 24147 (May 25, 2017)), are also being included in the routine use 
portion of this notice.
    Additional changes are being made to this Notice to provide greater 
clarity about the information contained in the N-DEx System and the 
types of information that can be retrieved for criminal justice 
purposes by the N-DEx System. Expanding the N-DEx System to include 
records retrieved via a federated search of additional criminal justice 
information and criminal intelligence databases increases criminal 
justice agencies' access to information necessary for them to perform 
their legally authorized, required functions.
    In accordance with 5 U.S.C. 552a(r), the DOJ has provided a report 
to OMB and the Congress on this revised system of records.


[[Page 64602]]


    Dated: December 11, 2018.
Peter A. Winn
Acting Chief Privacy and Civil Liberties Officer, United States 
Department of Justice.

SYSTEM NAME AND NUMBER:
    National Data Exchange System (N-DEx System), JUSTICE/FBI-020.

SECURITY CLASSIFICATION:
    Sensitive But Unclassified.

SYSTEM LOCATION:
    Records will be located at the Federal Bureau of Investigation 
(FBI), Criminal Justice Information Services (CJIS) Division, 1000 
Custer Hollow Road, Clarksburg, WV 26306, and at appropriate locations 
for system backup and continuity of operations purposes. Records may 
also be maintained in secure cloud computing environments. The cloud 
computing service provider on the date of this publication is Amazon 
Web Services, located at 12900 Worldgate Drive, Herndon, VA 20170. 
Cloud computing service providers may change. For information about the 
current cloud computing service provider, please contact the Unit 
Chief, Privacy and Civil Liberties Unit, Office of the General Counsel, 
FBI, 935 Pennsylvania Avenue NW, Washington, DC 20535-0001; telephone 
202-324-3000.

SYSTEM MANAGER(S):
    Director, Federal Bureau of Investigation, 935 Pennsylvania Avenue 
NW, Washington, DC 20535-0001; telephone 202-324-3000.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    The system is established and maintained in accordance with 28 
U.S.C. 533, 534; 28 CFR 0.85 and 28 CFR part 20.

PURPOSE(S) OF THE SYSTEM:
    The purpose of the N-DEx System is to enhance the interconnectivity 
of criminal justice databases in various agencies and jurisdictions in 
order to improve the sharing of multiple levels of criminal justice 
data to further objectives for crime analysis, criminal justice 
administration (``administration of criminal justice'' is defined at 28 
CFR 20.3(b)), and strategic/tactical operations in investigating, 
reporting, solving, and preventing crime, and, thereby, improving 
national security. The N-DEx System provides local, state, tribal, 
territorial, regional, federal, foreign criminal justice, and limited 
authorized noncriminal justice agencies with a powerful investigative 
tool to link, share, search, and analyze criminal justice information, 
including incident/case reports, incarceration data, and parole/
probation data. In addition to containing information submitted by 
criminal justice agencies and jurisdictions nationwide (as will be 
detailed below in this Notice), the N-DEx System facilitates the 
sharing of criminal justice and criminal intelligence information 
(``criminal intelligence information'' is defined at 28 CFR 23.3(b)(3)) 
controlled and maintained by many different agencies and jurisdictions 
nationwide. As well as facilitating information sharing for 
investigative purposes, the N-DEx System also facilitates such sharing 
for criminal justice employment background checks; federal suitability 
and fitness determinations for covered individuals as defined in 
Executive Order 13467, as amended by Executive Order 13764; security 
risk assessments on individuals applying for access to select 
biological agents and toxins as set forth in 42 U.S.C. 262a and 42 CFR 
73.10; and firearms, explosives, and associated license/permit-related 
background checks conducted by criminal justice agencies.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The N-DEx System contains information maintained by the FBI about 
the following types of individuals:
    A. Any individual who is identified in a criminal justice report 
concerning a criminal justice incident or investigation. These 
individuals include, but are not limited to: Subjects; suspects; 
associates; victims; persons of interest; witnesses; and/or any 
individual named in pre-trial investigations and arrest, booking, 
incident, incarceration, parole, and probation reports.
    B. N-DEx System users and individuals listed as the point of 
contact for records in the N-DEx System.
    C. Individuals who have been queried through the N-DEx System. In 
addition to information about the above individuals that is actually 
maintained by the system, the N-DEx System also facilitates access to 
information not maintained by the FBI, but that is contained in non-FBI 
databases (controlled by local, state, tribal, territorial, regional, 
and other federal agencies) that can be searched via functionality of 
the N-DEx System. The information in systems controlled or maintained 
by other agencies or jurisdictions will include information about the 
categories of individuals described in (A) above, but will also include 
information about individuals identified in criminal intelligence 
information (defined at 28 CFR 23.3(b)(3)). These individuals may 
include, but are not limited to, subjects, suspects, associates, 
victims, persons of interest, witnesses, and/or any individual named in 
a criminal intelligence product or report.
    Information about individuals maintained in local, state, tribal, 
territorial, regional, federal (non-Department of Justice), and foreign 
criminal justice databases, and merely accessed via N-DEx System search 
are not part of the N-DEx System system of records because they are not 
``under the control of'' the Department as stated in the Privacy Act 
definition of ``system of records.'' 5 U.S.C. 552a(a)(5).

CATEGORIES OF RECORDS IN THE SYSTEM:
    The N-DEx System contains information collected by criminal justice 
agencies that is needed for the performance of their legally 
authorized, required functions. The records in the N-DEx System span 
the entire criminal justice lifecycle and consist of arrest, holding, 
incident, supervised release, booking, incarceration, service call, 
case and warrant reports; pre-trial investigation reports; missing 
persons reports; parole and/or probation information; other information 
collected by criminal justice agencies; and information shared for 
collaboration purposes from local, state, tribal, territorial, 
regional, federal, and foreign criminal justice entities. Identifying 
information in the N-DEx System includes, but is not limited to: 
Name(s); sex; race; citizenship; date and place of birth; address(es); 
telephone number(s); social security number(s) or other unique 
identifiers; physical description, including height, weight, hair 
color, eye color, gender; occupation and vehicle identifiers; and 
photographs. Records from the FBI's CJIS Division systems, including 
the National Crime Information Center (NCIC), the Interstate 
Identification Index (III), and the Next Generation Identification 
(NGI) Systems, will be made available to the N-DEx System for queries, 
but the N-DEx System will not contain copies of these databases. 
Additionally, records from other criminal justice and criminal 
intelligence databases controlled and updated by local, state, tribal, 
territorial, regional, federal, and foreign criminal justice entities 
or non-governmental agencies will be made accessible for queries via 
the N-DEx System, but because the FBI and DOJ will not control or 
update the records from these databases, this information will not be 
considered part of the N-DEx System system of records.
    Records maintained in the N-DEx System about individuals described 
in category ``B'' of INDIVIDUALS

[[Page 64603]]

COVERED BY THE SYSTEM above include name, userID, phone number, email 
address, associated identity provider, employing agency, and 
information users voluntarily provide for collaboration purposes.
    The N-DEx System also maintains an audit log of searches conducted 
in the N-DEx System and records viewed as a result of each search. The 
audit log includes search criteria that may include identifying 
information (e.g. name, date of birth, social security number) about 
individuals described in category ``C'' of INDIVIDUALS COVERED BY THE 
SYSTEM above.

RECORD SOURCE CATEGORIES:
    Information contained in the N-DEx System is obtained from local, 
state, tribal, territorial, regional, federal, and foreign criminal 
justice agencies and non-governmental agencies that compile information 
for criminal justice purposes.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    As part of those disclosures generally permitted under 5 U.S.C. 
552a(b), the records in this system may be disclosed as a routine use, 
under 5 U.S.C. 552a(b)(3) to the following persons or entities and 
under the circumstances or for the purposes described below:
    A. To any criminal, civil, or regulatory authority (whether local, 
state, tribal, territorial, regional, federal, or foreign) where the 
information is relevant to the recipient entity's criminal justice 
responsibilities.
    B. To a local, state, tribal, territorial, regional, federal, 
foreign, international, or other public agency/organization, or to any 
person or entity in either the public or private sector, domestic or 
foreign, where such disclosure may facilitate the apprehension of 
fugitives, the location of missing persons, the location and/or return 
of stolen property or similar criminal justice objectives.
    C. To local, state, tribal, territorial, regional, or federal 
criminal justice agencies for the performance of firearms, explosives, 
or associated license/permit-related background checks.
    D. To federal agencies for the performance of federal suitability 
or fitness determinations under the authority of Executive Order 13467 
as amended by Executive Order 13764.
    E. To federal agencies in connection with a security risk 
assessment conducted, pursuant to 42 U.S.C. 262a and 42 CFR 73.10, on 
an individual applying for access to select biological agents or 
toxins.
    F. To a local, state, tribal, territorial, regional, federal, or 
foreign governmental entity lawfully engaged in collecting law 
enforcement, law enforcement intelligence, national security 
information, homeland security information, national intelligence, 
possible national security threat information, or terrorism information 
for law enforcement, intelligence, national security, homeland 
security, or counterterrorism purposes.
    G. To any person or entity in either the public or private sector, 
domestic or foreign, if deemed by the FBI to be reasonably necessary to 
elicit information or cooperation from the recipient for use in 
furthering the purposes of the system.
    H. To appropriate agencies, entities, and persons when (1) the 
Department suspects or has confirmed that there has been a breach of 
the system of records; (2) the Department has determined that as a 
result of the suspected or confirmed breach there is a risk of harm to 
individuals, DOJ (including its information systems, programs, and 
operations), the Federal Government, or national security; and (3) the 
disclosure made to such agencies, entities, and persons is reasonably 
necessary to assist in connection with the Department's efforts to 
respond to the suspected or confirmed breach or to prevent, minimize, 
or remedy such harm.
    I. To another Federal agency or Federal entity, when the Department 
determines that information from this system of records is reasonably 
necessary to assist the recipient agency or entity in (1) responding to 
a suspected or confirmed breach or (2) preventing, minimizing, or 
remedying the risk of harm to individuals, the recipient agency or 
entity (including its information systems, programs, and operations), 
the Federal Government, or national security, resulting from a 
suspected or confirmed breach.
    J. To those agencies, entities, and persons the FBI may consider 
necessary or appropriate in ensuring the continuity of government 
functions in the event of any actual or potential significant 
disruption of normal government operations. This also includes all 
related pre-event planning, preparation, backup/redundancy, training 
and exercises, and post-event operations, mitigation, and recovery.
    K. If any system record, on its face or in conjunction with other 
information, indicates a violation or potential violation of law 
(whether civil or criminal), regulation, rule, order, or contract, the 
pertinent record may be disclosed to the appropriate entity (whether 
federal, state, local, joint, tribal, foreign, or international), that 
is charged with the responsibility of investigating, prosecuting, and/
or enforcing such law, regulation, rule, order, or contract.
    L. To contractors, grantees, experts, consultants, students, or 
others performing or working on a contract, service, grant, cooperative 
agreement, or other assignment for the Federal Government, when 
necessary to accomplish an agency function.
    M. To the news media or members of the general public in 
furtherance of a legitimate law enforcement or public safety function 
as determined by the FBI, e.g., to assist in locating fugitives; to 
provide notifications of arrests; to provide alerts, assessments, or 
similar information on potential threats to life, health, or property; 
or to keep the public appropriately informed of other law enforcement 
or FBI matters or other matters of legitimate public interest where 
disclosure could not reasonably be expected to constitute an 
unwarranted invasion of personal privacy. (The availability of 
information in pending criminal or civil cases will be governed by the 
provisions of 28 CFR 50.2.)
    N. To a court or adjudicative body, in matters in which (a) the FBI 
or any FBI employee in his or her official capacity, (b) any FBI 
employee in his or her individual capacity where the Department of 
Justice has agreed to represent the employee, or (c) the United States, 
is or could be a party to the litigation, is likely to be affected by 
the litigation, or has an official interest in the litigation, and 
disclosure of system records has been determined by the FBI to be 
arguably relevant to the litigation. Similar disclosures may be made in 
analogous situations related to assistance provided to the Federal 
Government by non-FBI employees (see Routine Use L).
    O. To an actual or potential party or his or her attorney for the 
purpose of negotiating or discussing such matters as settlement of the 
case or matter, or informal discovery proceedings, in matters in which 
the FBI has an official interest and in which the FBI determines 
records in the system to be arguably relevant.
    P. To such recipients and under such circumstances and procedures 
as are mandated by Federal statute or treaty.
    Q. To a Member of Congress or a person on his or her staff acting 
on the Member's behalf when the request is made on behalf and at the 
request of the individual who is the subject of the record.
    R. National Archives and Records Administration (NARA) Records

[[Page 64604]]

Management. To the National Archives and Records Administration (NARA) 
for records management inspections and such other purposes conducted 
under the authority of 44 U.S.C. 2904 and 2906.
    S. To any agency, organization, or individual for the purposes of 
performing authorized audit or oversight operations of the FBI and 
meeting related reporting requirements.
    T. The DOJ may disclose relevant and necessary information to a 
former employee of the Department for purposes of: Responding to an 
official inquiry by a federal, state, or local government entity or 
professional licensing authority, in accordance with applicable 
Department regulations; or facilitating communications with a former 
employee that may be necessary for personnel-related or other official 
purposes where the Department requires information and/or consultation 
assistance from the former employee regarding a matter within that 
person's former area of responsibility. (Such disclosures will be 
effected under procedures established in title 28, Code of Federal 
Regulations, sections 16.300-301 and DOJ Order 2710.8C, including any 
future revisions.)
    U. To the White House (the President, Vice President, their staffs, 
and other entities of the Executive Office of the President (EOP)), 
and, during Presidential transitions, the President-Elect and Vice-
President Elect and their designees for appointment, employment, 
security, and access purposes compatible with the purposes for which 
the records were collected by the FBI, e.g., disclosure of information 
to assist the White House in making a determination whether an 
individual should be: (1) Granted, denied, or permitted to continue in 
employment on the White House Staff; (2) given a Presidential 
appointment or Presidential recognition; (3) provided access, or 
continued access, to classified or sensitive information; or (4) 
permitted access, or continued access, to personnel or facilities of 
the White House/EOP complex. System records may be disclosed also to 
the White House and, during Presidential transitions, to the President 
Elect and Vice-President Elect and their designees, for Executive 
Branch coordination of activities which relate to or have an effect 
upon the carrying out of the constitutional, statutory, or other 
official or ceremonial duties of the President, President Elect, Vice-
President or Vice-President Elect.
    V. To complainants and/or victims to the extent deemed appropriate 
by the FBI to provide such persons with information and explanations 
concerning the progress and/or results of the investigations or cases 
arising from the matters of which they complained and/or of which they 
were victims.
    W. To appropriate officials and employees of a federal agency or 
entity which requires information relevant to a decision concerning the 
hiring, appointment, or retention of an employee; the issuance, 
renewal, suspension, or revocation of a security clearance; the 
execution of a security or suitability investigation; the letting of a 
contract; or the issuance of a grant or benefit.
    X. To designated officers and employees of local, state, (including 
the District of Columbia), or tribal law enforcement or detention 
agencies in connection with the hiring or continued employment of an 
employee or contractor, where the employee or contractor would occupy 
or occupies a position of public trust as a law enforcement officer or 
detention officer having direct contact with the public or with 
prisoners or detainees, to the extent that the information is relevant 
and necessary to the recipient agency's decision.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    Most information is maintained in electronic form and stored in 
computer memory, on disk storage, on computer tape, in a government 
approved cloud computing infrastructure (e.g., FedRAMP approved) 
offered by a cloud service provider (e.g. Amazon Web Services), or on 
other computer media. However, some information may also be maintained 
by the contributing agency in hard copy (paper) or other form.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Information will be retrieved from the N-DEx System by keyword 
search and linkages based on identifying data collected on involved 
persons, places and things, and other non-specific descriptions of 
circumstances to identify common or similar events. This could include 
individual names or other personal identifiers. In addition to 
returning records based upon a direct query of the N-DEx System, N-DEx 
System records may also be retrieved by a query made to other 
authorized interoperable systems when the users of the other systems 
would also be authorized to access the N-DEx System.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    The information within the N-DEx System will be contributed by 
local, state, tribal, territorial, regional, federal, and foreign 
criminal justice entities. Records in the N-DEx System are restricted 
to information obtained by criminal justice agencies in connection with 
their official duties administering criminal justice. All entities are 
responsible for ensuring the relevance and currency of the information 
they contribute to the N-DEx System and will have control and 
responsibility for the disposition of their own records through a 
process that is documented by the N-DEx Policy and Operating Manual, or 
based upon federal law. The N-DEx Policy and Operating Manual requires 
that before taking action on an N-DEx System record, agencies verify 
the accuracy and completeness of the record with the record owner. 
Policy also dictates that record contributors update their records at 
least monthly. Those portions of the N-DEx System that constitute 
federal records are subject to applicable retention schedules approved 
by the National Archives and Records Administration (NARA). In 
addition, the N-DEx System itself will result in the creation of 
metadata or an audit log that reflects any correlation between any of 
the submitted records, as well as information about user activity. The 
N-DEx System metadata or audit logs will be retained for 25 years, or 
as otherwise specified in the NARA schedule, Job No. N1-065-11-2.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    N-DEx System records are maintained in limited access space in FBI 
controlled facilities and offices or in secure cloud-computing 
environments. Computerized data is password protected. Information in 
the cloud is stored in a government approved cloud computing 
infrastructure (e.g., FedRAMP approved) offered by a cloud service 
provider. All communications between the FBI infrastructure and the 
cloud service provider are encrypted both in transit and at rest to 
comply with Trusted Internet Connection (TIC) requirements and security 
best practices. All FBI personnel are required to pass extensive 
background investigations. N-DEx System information is accessed only by 
authorized DOJ personnel, or by non-DOJ personnel properly authorized 
to assist in the conduct of an agency function related to these 
records. The N-DEx System has adequate physical security and built in 
controls to protect against unauthorized personnel gaining access to 
the equipment and/or the information stored in it.

[[Page 64605]]

RECORD ACCESS PROCEDURES:
    Because the N-DEx System contains records compiled to assist with 
the enforcement of criminal laws, the records in this system have been 
exempted from notification, access, and amendment to the extent 
permitted by subsection (j) of the Privacy Act. An individual who is 
the subject of one or more records in this system may be notified of 
records that are not exempt from notification and, accordingly, may 
access those records that are not exempt from disclosure. All requests 
for access should follow the guidance provided on the FBI's website at 
https://www.fbi.gov/services/records-management/foipa. A request for 
access to a record from this system of records must be submitted in 
writing and comply with 28 CFR part 16. Individuals may mail, fax, or 
electronically submit a request, clearly marked ``Privacy Act Access 
Request,'' to the FBI, ATTN: FOI/PA Request, Record/Information 
Dissemination Section, 170 Marcel Drive, Winchester, VA 22602-4843; 
facsimile: 540-868-4995/6/7; electronically: https://www.fbi.gov/services/records-management/foipa/requesting-fbi-records. The request 
should include a general description of the records sought, and must 
include the requester's full name, current address, and date and place 
of birth. The request must be signed and dated and either notarized or 
submitted under penalty of perjury. While no specific form is required, 
requesters may obtain a form (Form DOJ-361) for use in certification of 
identity, which can be located at the above link. In the initial 
request, the requester may also include any other identifying data that 
the requester may wish to furnish to assist the FBI in making a 
reasonable search. The request should include a return address for use 
by the FBI in responding; requesters are also encouraged to include a 
telephone number to facilitate FBI contacts related to processing the 
request. A determination of whether a record may be accessed will be 
made after a request is received.

CONTESTING RECORD PROCEDURES:
    To contest or amend information maintained in the N-DEx System, an 
individual should direct his/her request to the address provided above, 
stating clearly and concisely what information is being contested, the 
reasons for contesting it, and the proposed amendment to the 
information sought.
    Some information may be exempt from contesting record procedures as 
described in the section titled ``Exemptions Claimed for the System.'' 
An individual who is the subject of one or more records in this system 
may contest and pursue amendment of those records that are not exempt. 
A determination whether a record may be subject to amendment will be 
made at the time a request is received.

NOTIFICATION PROCEDURES:
    Same as RECORD ACCESS PROCEDURES paragraph, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    The Attorney General has exempted the N-DEx System from subsection 
(c)(3) and (4); (d)(1), (2), (3) and (4); (e)(1), (2), (3), (5) and 
(8); and (g) of the Privacy Act pursuant to 5 U.S.C. 552a(j)(2). Rules 
have been promulgated in accordance with the requirements of 5 U.S.C. 
553(b), (c), and (e). See 28 CFR 16.96(t) and (u).

HISTORY:
    Law Enforcement National Data Exchange System (N-DEx), JUSTICE/FBI-
020, 77 FR 56793 (Oct. 4, 2007), as amended by 82 FR 24151, 157 (May 
25, 2017).
[FR Doc. 2018-27265 Filed 12-14-18; 8:45 am]
 BILLING CODE 4410-02-P