Complaints Alleging Improper Access to or Dissemination of CJIS Information

(1) An individual may file a complaint with DCJIS upon the belief that an agency improperly obtained, attempted to obtain, or disseminated CJIS information regarding the individual. (a) The complaint shall: 1. be signed by the complaining witness; 2. state a reasonable time period within which the complaining witness believes the agency improperly obtained or attempted to obtain or disseminated the CJIS information; 3. state what specific CJIS information the complaining witness believes the agency improperly obtained, attempted to obtain, or disseminated; 4. state which agency the complaining witness believes improperly obtained or attempted to obtain or disseminated the CJIS information; 5. state the names and contact information of any persons the complaining witness believes improperly obtained or attempted to obtain or disseminated the CJIS information; and 6. state any other relevant facts about the allegations. (b) DCJIS shall review the complaint. If the complaint meets the requirements of 803 CMR 7.13(1)(a), then DCJIS staff shall conduct an audit of the CJIS system to determine if a specific CJA or authorized CJIS user accessed the alleged information through CJIS during the reasonable time period specified in the complaint. If the audit confirms such access, DCJIS staff may contact the agency head to request an internal investigation. (c) If requested by DCJIS, the agency head shall conduct an investigation into the alleged misuse according to the rules, regulations, and policies in place at the agency. At the conclusion of the investigation, the agency head shall provide DCJIS with a written summary of the investigation's findings. In addition, if the agency head substantiates the allegation(s), then the written summary shall provide details of the specific actions taken to correct the misuse as well as details of the sanctions imposed on the subject(s) of the investigation, if any. (d) Where there is no violation of the CORI law, DCJIS may close or otherwise dispose of any such complaints by decision of the Commissioner of DCJIS. (e) Based upon its review of the complaint and any investigation by the agency, and in order to ensure the integrity and security of CJIS, DCJIS may choose to impose preventative measures such as training, restricted access, or other requirements upon the agency or any persons alleged to have improperly obtained, attempted to obtain, or disseminated CJIS information. (f) DCJIS may impose additional penalties as outlined elsewhere in 803 CMR 7.00 including, but not limited to, those described in 803 CMR 7.14. Violation of the CORI law may entail additional civil or criminal liability and penalties. 803 CMR - 42.1