Compendium Of State Privacy And Security Legislation

where applicable. It also includes areview and analysis sectioncontaining a general overview ofstate laws and regulations and adiscussion of trends and conclusionsconcerning two especially importantinformation policy issues: (1)requirements imposed on criminaljustice agencies to maintain recordquality, and (2) dissemination anduse of criminal history informationfor noncriminal justice purposes.Since this volume compiles thematerial from previous compendia, aswell as more recent enactments, thesheer bulk of this body of materialprecludes continuing the practice ofreproducing the complete text of thestate laws and regulations. Copies ofspecific statutes or the complete setof statutes are available onmicrofiche from the NationalCriminal Justice Reference Service(NCJRS) in Rockville, Maryland. Afull, hard-copy library of these laws,regulations and other materials ismaintained by SEARCH, TheNational Consortium for JusticeInformation and Statistics, at itsoffices in Sacramento, California.Copies of specific enactments may beordered by mail or telephone.This Compendium contains foursections. Section 1 sets out anoverview of state criminal historyrecord laws and an analysis of staterequirements relating to data qualityand noncriminal justice access anduse. Section 2 defines the 28 subjectmatter categories into which the lawsand regulations are classified in thetables in the Compendium. Thesecategories are the same as those usedin previous volumes. Section 3 setsout summary tables showing trendsand developments in criminal justiceinformation law and policy byclassification category. Section 4sets out summary tables of criminaljustice information statutes andregulations by state, along with a listof the titles of the state codes (seepage 47) from which the citationswere extracted. All of the tables inSections 3 and 4 set out completecitations to the official state codes orother state compilations where thefull text of the laws and regulationsmay be found. These citations shouldbe used in ordering copies ofparticular provisions from NCJRS orSEARCH.The methodology used in compilingthe Compendium included a survey ofstate officials concerned withcriminal record programs and policy,followed by extensive libraryresearch in the state codes to verifyand augment survey responses. Thesurvey and research compiled thelaws of 53 jurisdictions: the 50states, the District of Columbia,Puerto Rico and the Virgin Islands.In the Compendium, all of thesejurisdictions are referred to as“states.”How to use the CompendiumBecause this volume is a completecompilation of all prior compendiaand supplements, it will not benecessary to consult prior volumes.To facilitate use of this volume, thelaws and regulations have beenclassified into 28 subject-mattercategories that are defined in Section2. Numerous tables are included inSections 3 and 4 to assist readers infinding laws dealing with particularsubjects or to determine whichaspects of information policy areaddressed by particular states. Thesummary tables in Section 3 listcitations to all state statutes andregulations under each of the 28classification categories. Forexample, the table for the category“State regulatory authority” (page 17)indicates which of the states haveprovisions establishing or designating2an agency to promulgate statewideregulations governing criminalhistory records and provides the legalcitations to the provisions. Inaddition to finding particularcitations, the reader is able to quicklyidentify the concentration of statesaddressing a particular policy area.Another view of state privacy andsecurity trends is reflected in thetable on page 15 titled “Surveycomparison of changes in statestatutes and regulations byclassification category.” At a glance,the table indicates the degree ofattention that a particular area ofinformation policy has received in thestates over the past 17 years, asreflected by surveys conducted in1974, 1977, 1979, 1981, 1984, 1987,1989, 1991 and 1994.A summary table for each state isincluded in Section 4. These tablesuse the 28 classification categoriesreferred to above and set out citationsto all of the laws and regulations ofparticular states. If no entry appearsunder one or more classificationcategories for a particular state, itmeans that the state has no law orregulation addressing that policyarea, or that research has failed todiscover any.The state summary tables presentedin Section 4 include subdivisions offour classification categories.Category 3, “Disseminationregulations,” is subdivided to showwhether the states permit or prohibitaccess by various types of groups orindividuals (criminal justice agencies,governmental noncriminal justiceagencies and private agencies orindividuals) to various types ofinformation (conviction, nonconviction and arrest information).Category 4, “Inspection,” issubdivided to show whether the statespermit an individual to inspect hiscriminal history record; inspect his

record and take notes; or inspect hisrecord and obtain a copy ofinformation contained in that record.Category 14, “Accuracy andcompleteness,” is subdivided topermit statutes to be classified asrelating to disposition reporting,auditing, or other accuracy andcompleteness requirements. Finally,Category 22, “Security,” issubdivided to enable statutes to beclassified as relating to physical,administrative or computer security.These classification subdivisionsshould present a more accurate anddetailed view of state legislative andregulatory activity in these fourimportant policy areas and will makethe Compendium a more usefulresearch tool.3

Section 1: Review and analysisA. Current status of thelawIn the early 1970s, at a time whenpublic concern about privacy,automation and mushroominginformation systems was at its height,Congress considered severallegislative proposals that would haveimposed a uniform nationwideinformation management scheme forstate and local handling of criminalhistory record information. AlthoughCongress did not enactcomprehensive legislation, in 1973 itdid adopt an amendment to theOmnibus Crime Control and SafeStreets Act of 1968 (now Section812(b) of the Justice Assistance Actof 1984; Pub. L. 98-473). Theamendment provided in general termsthat all criminal history recordinformation7 collected, maintained ordisseminated by state and localcriminal justice agencies withfinancial support made availableunder the Act must be kept completeand secure, must be made availablefor review and challenge by recordsubjects, and must be used only forlaw enforcement and other lawfulpurposes.In 1975 the U.S. Department ofJustice’s Law EnforcementAssistance Administration issuedcomprehensive information systemsregulations to implement theamendment. These regulations,usually referred to as the Departmentof Justice (DOJ) regulations, areapplicable to all state and local7Investigative and intelligenceinformation is not covered. Wantedperson information, original records ofentry, court records or traffic offenserecords are specifically exempted fromcoverage of the Department of Justiceregulations.criminal justice agencies that haveused funding for the support ofcriminal history record systems. Theregulations impose minimum generalrequirements for criminal historyinformation management, leaving thedevelopment of specific programsand procedures to state legislationand policymaking. As intended, theregulations have been instrumental instimulating many states to enact theirown laws to comply with therequirements of the federalgovernment. In addition, theregulations triggered a reassessmentof existing state privacy and securitylaws that has gone beyond merecompliance, as evidenced by the factthat about half of the states haveenacted comprehensive criminalhistory laws, some of which are insome respects stricter than therequirements of the regulations.Today, virtually all of the states haveenacted legislation governing at leastthe dissemination of criminal historyrecords. Although the approachesdiffer considerably, virtually all ofthe states have followed the lead ofthe regulations in distinguishingbetween information referring toconvictions and current arrests, onthe one hand, and nonconviction dataon the other (information referring tocases without recorded dispositionsor with dispositions favorable to theaccused). Most states have placedstricter limits on the release ofnonconviction data for noncriminaljustice purposes, such as backgroundscreening for employment andlicensing purposes. Virtually all ofthe states also have establishedprocedures to permit record subjectsto review their records and toinstitute procedures to correctinaccuracies. Finally, virtually all ofthe states have established security4procedures complying generally withthe requirements of the regulations.In these areas, as in other areas ofrecord management, the regulationsdo not require the enactment oflegislation, so long as adequateoperational procedures areimplemented by regulation, agencyrule or other appropriate means.Thus, the numbers of state statutes inthese areas cited in this volume donot fully reflect the significantprogress made in these areas ofprivacy protection.Two areas of criminal history recordinformation management meritspecial analysis. These areas are:(1) data quality and (2) disseminationof criminal records for noncriminaljustice purposes. They are discussedin Section B.B. Analysis of criticalissues1. Data qualityAs noted earlier, the broad languageof the 1973 Congressionalamendment provided the basis forcomprehensive regulations issued byLEAA in 1975 covering all state andlocal criminal history record systemssupported in whole or in part byfederal funding. 8 Among otherthings, the regulations require allcovered agencies to implementoperational procedures designed toensure that criminal history recordinformation is complete andaccurate. 98“Criminal Justice InformationSystems Regulations,” 28 C.F.R. Part 20.928 C.F.R. § 20.21(a)(1993).

The regulations state that to becomplete, a record of an arrest mustcontain information concerning anydisposition occurring within the statewithin 90 days after the dispositionhas occurred. In order to promote thedissemination of complete criminalhistory records, the regulationsrequire that state and local agenciesestablish procedures to query thestate central repository prior todisseminating information unless theagency is assured that it isdisseminating the most up-to-datedisposition data or time is of theessence and the repository istechnically incapable of respondingwithin the necessary time period.10purposes of ensuring accuracy andcompleteness.12As noted earlier, the regulations donot require the states to enactlegislation dealing with accuracy andcompleteness. Many states, however,have chosen to deal with the problemby state law. In 1974, just prior topublication of the regulations, only14 states had adopted statutory dataquality safeguards. By 1978, twoyears after the adoption of the LEAAregulations, 41 states had added dataquality provisions of one kind oranother to their criminal historyrecord statutes. That numberincreased to 45 states in 1979, to 49states in 1981, to 51 states in 1984,and to 52 states in 1991.13The provisions of the regulationsdealing with accuracy defineaccuracy literally to mean that “norecord containing criminal historyrecord information shall containerroneous information.”11 In orderto promote accuracy, two types ofoperational procedures are required:(1) a process of data collection, entry,stor

Overview is the ninth in the series of Bureau of Justice Statistics' publications referencing . development and issuance by the Law Enforcement Assistance Administration of the Department of Justice regulations on privacy and security of criminal history record . 1984, 1987, 1989, 1992 and now the current 1994 edition. The purpose of the .