Privacy and Security Requirements

PURPOSE: This rule establishes a rule governing the procedures for dissemination of criminal history record information and to assure that the privacy and security of individuals have not been violated. (1) Criminal History Record Information (CHRI). (A) CHRI means information collected by criminal justice agencies on individuals consisting of identifiable descriptions and notations of arrests, detentions, indictments, information or other formal criminal charges, any disposition arising from criminal charges, sentencing, correctional supervision and release. (B) The regulations do not apply to CHRI contained in— 1. Posters, announcements or lists for identifying or apprehending fugitives or wanted persons; 2. Original records of entry, such as police blotters maintained by criminal justice agencies, compiled chronologically and required by law or long standing custom to be made public, if records are organized on a chronological basis; 3. Court records of public judicial proceedings; 4. Published court or administrative opinions or public, judicial, administrative or legislative proceedings; 5. Records of traffic offenses maintained by state departments of transportation, motor vehicles or the equivalent of those records for regulating the issuance, suspension, revocation or renewal of drivers’, pilots’ or other operators’ licenses; and 6. Announcements of executive clemency. (2) Completeness and Accuracy. (A) To meet accuracy and completeness requirements, the Missouri State Highway Patrol’s Criminal Records Division has been designated by state law as the central repository of CHRI for the state. (B) For the purpose of maintaining complete and accurate criminal history record information, all police officers of this state, the clerk of each court, the Department of Corrections, the sheriff of each county, the chief law enforcement official of a city not within a county and the prosecuting attorney of each county or the circuit attorney of a city not within a county shall submit certain criminal arrest, charge and disposition information to the central repository for filing without undue delay (within thirty (30) days) in the form and manner required by sections 43.500–43.530, RSMo. (3) Dissemination. (A) Criminal justice agencies shall receive complete CHRI for criminal justice purposes and criminal justice employment purposes. (B) Criminal justice agencies shall receive the following CHRI for the issuance of a concealable firearms permit: 1. All conviction data; 2. All charges for which an individual is currently under the jurisdiction of the criminal justice system; 3. All charges resulting in an imposition of sentence being suspended (SIS) until the time as the case is final terminated; and 4. Information regarding an arrest, if it is within thirty (30) days of the arrest and no action has been taken by the prosecuting or circuit attorney. (C) Noncriminal justice agencies or citizens shall receive the following CHRI for employment, licensing purposes or reasons stated in the request: 1. All conviction data; 2. All charges for which an individual is currently under the jurisdiction of the criminal justice system; 3. All charges resulting in an imposition of SIS until the time as the case is finally terminated; and 4. Information regarding an arrest, if it is within thirty (30) days of the arrest and no action has been taken by the prosecuting or circuit attorney. (D) Federal noncriminal justice agencies shall receive complete CHRI for those investigative purposes as authorized by law or presidential executive order. (4) Agency Audit. (A) By federal regulation, every state is required to conduct biennial audits of randomly selected criminal justice agencies to assure that privacy and security regulations are being followed. (B) To make this audit possible, agencies are required to retain appropriate records. Agencies will need to account for each dissemination in a log so that the audit can be performed. The log should contain the name of the subject on whom the record is disseminated, the name of the recipient of the information, the agency he represents, whether the agency is criminal justice or not, the purpose for which the information is to be used, address of the agency, date and time. (C) Criminal justice agencies may choose a manual or automated dissemination logging system. Agencies which are not automated and rely on other systems, such as the central repository for automated dissemination logging, must log all secondary dissemination. Secondary dissemination is defined as “The dissemination of any CHRI response to another criminal justice agency or to an individual within another criminal justice agency or to anyone legally entitled to receive such information who is outside the original receiving agency.” These logs shall be maintained for thirteen (13) months from the date of dissemination. and Privacy/Security Information (D) The reporting of a criminal justice transaction to a state, local or federal repository is not a dissemination of information. Also agencies are not required to account for no record responses. (5) Security of CHRI. (A) Agencies providing security must be mindful of computer software and hardware, restriction of file access and safeguard policies regarding computer operation in the following areas: protection through proper storage, protection through computer programs, legitimate destruction of records, detection of unauthorized penetration of programs or files, and protection of security and protection from destruction. (B) Agencies must screen prospective employees who will have access to CHRI and be responsible for transferring or removing personnel in cases of violation. (C) The agency must institute manual procedures for physical and data security, institute manual procedures to prevent file destruction and limit direct access to criminal history record information. (D) Each employee working with or having access to criminal history record information shall be made familiar with the substance and intent of these regulations. (6) Access and Review. (A) Any individual, upon satisfactory verification of his/her identity, shall be entitled to review without undue burden to either the criminal justice agency or the individual any CHRI maintained about him/herself and obtain a copy of the information when necessary for challenge or review. (B) Employees who process access and review inquiries must be cautious when a person asks to see his/her CHRI. Positive identification is required. A driver’s license with a photo may be sufficient; however if identification is questionable, fingerprints may be required. (C) If a person has accessed and reviewed his/her CHRI and disagrees with the information, a challenge can follow. The challenge may be oral or written indicating that the record is inaccurate or incomplete and be accompanied by a corrected version. (D) If it is determined that there is an error in the record, the agency must make the necessary correction. At the individual’s request, the agency must give him/her the names of all noncriminal justice agencies to whom the data has been disseminated. Disseminations to criminal justice agencies will not be disclosed. (E) The correcting agency shall notify all criminal justice recipients of the corrected information. (F) The individual is not entitled to data contained in intelligence, investigatory or other related files and shall not be construed to include any other information than that defined as CHRI. (G) When an error in a CHRI record has been detected and the correction has been made, the correcting agency shall forward corrected copies to the central repository including a copy for the Federal Bureau of Investigation. (H) In the event an agreement cannot be reached between the individual and the agency being challenged, the individual may proceed with an administrative appeal to the director of the Department of Public Safety, Truman Building, 8th Floor, Jefferson City, MO 65101. AUTHORITY: sections 43.506, 43.515, 610.100, 610.105 and 610.120, RSMo 1986* and Code of Federal Regulations, Title 28, Chapter I, Part 20. Original rule filed Aug. 4, 1987, effective Oct. 25, 1987. Amended: Filed July 15, 1991, effective Dec. 9, 1991. *Original authority: 43.506, RSMo 1986, amended 1989, 1991; 43.515, RSMo 1986; 610.100, RSMo 1973, amended 1981; 610.105, RSMo 1973, amended 1981; and 610.120, RSMo 1981, amended 1983, 1989. and Privacy/Security Information and Privacy/Security Information and Privacy/Security Information