SUPPLEMENTARY INFORMATION:

The Bureau of Justice Statistics (BJS), located within the Office of Justice Programs (OJP) in the U.S. Department of Justice (DOJ), is a recognized statistical agency and is one of 13 principal statistical agencies recognized by the Office of Management and Budget (OMB). Consistent with Responsibilities of Recognized Statistical Agencies and Units,5 CFR 1321, BJS's activities are predominantly the collection, compilation, processing, or analysis of information described below for statistical purposes. Statistical purpose means “the description, estimation, or analysis of the characteristics of groups, without identifying the individuals or organizations that comprise such groups.” 44 U.S.C. 3561 (12). Statistical purposes exclude “any administrative, regulatory, law enforcement, adjudicatory, or other purpose that affects the rights, privileges, or benefits of a particular identifiable respondent.” 44 U.S.C. 3561(8).

BJS's mission is to collect, analyze, publish, and disseminate data on crime, criminal offenders, victims of crime, and the operation of justice systems at all levels of government. BJS also collects data on civil justice and administrative matters, including information on civil and administrative proceedings to study civil justice systems and issues, particularly when such matters bear directly and substantially on criminal justice issues. See34 U.S.C. 10237. BJS provides criminal, civil, and administrative justice data to legislators, policymakers, criminal justice officials, researchers, and the public. These audiences use the data to analyze justice system operations and inform budgetary, programmatic, and policy decisions across criminal, civil, and administrative contexts.

This is a new system of records that includes information collected under BJS's authority from sources including demographic survey respondents (individuals or households) and from administrative data that are routinely maintained by other establishments including federal, state, local, and tribal criminal and civil justice or governmental agencies and offices. The purpose of this system of records is to maintain data collected under BJS's authority through questionnaires, paper and electronic survey tools, interviews, focus groups, and administrative records to support its statistical mission. BJS regularly obtains information with direct identifiers, including names, addresses, social security numbers, and other identifiers. BJS may also collect other records with information such as criminal history and victimization information, demographic information, employment information, civil and administrative proceedings information, and medical information to complete its statistical activities. As a federal statistical agency, BJS is governed by strict data use, privacy, and confidentiality laws. 34 U.S.C. 10231(a); 34 U.S.C. 10134; and 28 CFR 22.

Summary of BJS's Data Use and Confidentiality Obligations

BJS conducts its statistical data collections under the authority of 34 U.S.C. 10132. BJS is also authorized to administer data collections under 34 U.S.C. 10132 in conjunction with different statutes and the purposes described therein, for example, the Prison Rape Elimination Act of 2003 (PREA; Pub. L. 108-79) and the Death in Custody Reporting Act of 2013 (DCRA; Pub. L. 113-242).

BJS may only use the data it collects for statistical and research purposes and must protect respondents' privacy and confidentiality under 34 U.S.C. 10231(a). Additionally, 34 U.S.C. 10134 ( printed page 65599) requires that “[d]ata collected by the Bureau shall be used only for statistical or research purposes, and shall be gathered in a manner that precludes their use for law enforcement or any purpose relating to a private person or public agency other than statistical or research purposes.” PREA data are further protected under the confidentiality requirements in Public Law 108-79, 4 (34 U.S.C. 30303(5)), except as authorized under 34 U.S.C. 30303(7).

BJS's confidentiality protections apply to information identifiable to a private person, which includes both individuals and establishments as defined in and consistent with the applicability requirements the Department of Justice's Confidentiality of Identifiable Research and Statistical Information Rule, 28 CFR 22. This includes, under 28 CFR 22.2(e) information identifiable to a private person, meaning data that is labeled with personal identifiers or can be reasonably linked to a specific individual based on small sample or cell sizes, combinations of indirect identifiers, or linkage to other data sources.

In accordance with 5 U.S.C. 552a(r), the Department has provided a report to OMB and Congress on the new system of records.

JUSTICE/OJP-017

SYSTEM NAME AND NUMBER:

Bureau of Justice Statistics (BJS) Statistical Data, JUSTICE/OJP-017.

SECURITY CLASSIFICATION:

Unclassified

SYSTEM LOCATION:

Office of Justice Programs, U.S. Department of Justice, 999 N. Capitol Street NE, Washington, DC 20531

SYSTEM MANAGER(S):

Director, Enterprise Infrastructure and Engineering Division, Office of the Chief Information Officer, Office of Justice Programs

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

The Bureau of Justice Statistics (BJS) conducts its statistical data-collection activities pursuant to 34 U.S.C. 10132. BJS is located within the Office of Justice Programs (OJP) in the U.S. Department of Justice (DOJ), and is a statistical agency formally recognized by the Office of Management and Budget (OMB). See Responsibilities of Recognized Statistical Agencies and Units, 5 CFR 1321. BJS's activities are predominantly the collection, compilation, processing, or analysis of information for statistical purposes. Statistical purpose means “the description, estimation, or analysis of the characteristics of groups, without identifying the individuals or organizations that comprise such groups.” 44 U.S.C. 3561 (12). Statistical purposes exclude “any administrative, regulatory, law enforcement, adjudicatory, or other purpose that affects the rights, privileges, or benefits of a particular identifiable respondent.” 44 U.S.C. 3561(8).

BJS and its award recipients acting as BJS-data collection agents, at any stage (including collection, storage, analysis, or dissemination), may use the information collected under BJS's direction solely for statistical and research purposes. All entities must comply with strict confidentiality protections set forth in 34 U.S.C. 10231(a); 34 U.S.C. 10134; and 28 CFR 22.

In addition to its primary statutory authority, BJS administers certain data collections under different statutes in conjunction with 34 U.S.C. 10132 including the Death in Custody Reporting Act of 2013 (DCRA; Pub. L. 113-242) or the Prison Rape Elimination Act of 2003 (PREA) Public Law 108-79. PREA data are further protected under the confidentiality provisions in Public Law 108-79, 4 (34 U.S.C. 30303).

PURPOSE(S) OF THE SYSTEM:

The purpose of this system of records is to maintain the statistical data that BJS collects, acquires, or maintains through questionnaires, surveys, interviews, focus groups, and administrative records from criminal and civil justice agencies to support BJS's statutory mission to collect, analyze, publish, and disseminate statistical information on crime, criminal offenders, victims of crime, and the operation of justice systems at all levels of government. BJS uses this information to produce aggregate statistical reports and data products, conduct methodological research to improve survey operations, and comply with specific statutory mandates under the Prison Rape Elimination Act (PREA) or Death in Custody Reporting Act (DCRA).

Consistent with 34 U.S.C. 10231(a), BJS is prohibited from using individual-level data for compliance, regulatory, or enforcement activities or to make determinations about an individual's benefits. BJS makes its published microdata available through its data archive for secondary analysis, subject to strict confidentiality protections and appropriate access controls based on disclosure risk assessments. All data collection, use, sharing, and dissemination activities are conducted solely for statistical and research purposes under BJS's governing authorities at 34 U.S.C. 10132.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM

Self-Reporting Surveys:

Households participating in victimization surveys; individuals who have experienced or witnessed criminal victimization; inmates currently incarcerated in federal prisons, state prisons, or local jails; individuals under community supervision including probationers and parolees; individuals previously incarcerated who participate in recidivism or post-release studies; arrestees participating in specialized surveys; and juveniles in residential placement facilities.

Administrative Records:

Individuals whose records are maintained by criminal and civil justice agencies, including: arrestees and suspects whose information is recorded by law enforcement agencies; defendants prosecuted in federal, state, local, or tribal courts; individuals sentenced by courts; inmates admitted to or released from correctional facilities; individuals under probation or parole supervision; individuals involved in cases handled by prosecutors' or public defender offices; individuals who work at criminal justice or victim service provider organizations; and decedents who died while in the custody of law enforcement or correctional agencies.

CATEGORIES OF RECORDS IN THE SYSTEM:

Categories of records in this system include working statistical files ( e.g., those files being analyzed to produce reports), administrative data files ( e.g., those files containing information provided by federal, state, local, or tribal criminal and civil justice or governmental agencies and offices), survey data files ( i.e., those files containing answers directly from the respondent), and/or data contact files ( i.e., those files used for contacting respondents). Examples of the data that will be maintained in this system of records include: activity and event-related information ( e.g., alcohol and substance abuse, physical abuse, sexual abuse, victimization, mortality, and relationship to victim or perpetrator); criminal justice history information ( e.g., arrest date(s) and location(s), arrest ( printed page 65600) charge(s), disposition(s), appeal(s), incarceration status, and criminal justice agency and court name); non-criminal data including civil and administrative proceedings information from immigration courts ( e.g., immigration-related charges, bond redetermination requests and decisions, applications for relief or protection from removal, basis of asylum or withholding of removal application, and court and appeals decisions); general personal information ( e.g., name, address, citizenship status, country of nationality, language, and date of birth); medical information; military service information; financial information; identifying numbers ( e.g., FBI ID number, state ID number, state Department of Correction (DOC) ID number, social security number (SSN), Alien Registration Number, and file, case, and arrest numbers); employment information; computer network address (URL); and respondent contact information ( e.g., name, address, phone number, and email address).

RECORD SOURCE CATEGORIES:

Records in this system are obtained directly from individual survey respondents through questionnaires, interviews, and other data collection instruments; from administrative records maintained by federal, state, local, and Tribal criminal and civil justice agencies and offices, including but not limited to law enforcement agencies, courts, correctional facilities, probation and parole agencies, prosecutors' and public defender offices, and medical examiners; from governmental agencies and establishments such as victim service providers and juvenile justice facilities; and from data extracts, reports, and establishment surveys provided by these entities. BJS may combine survey data with administrative records data, where practical and permissible, to enhance data quality, reduce respondent burden and collection costs, improve data completeness, and support statistical analysis.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b), all or a portion of the records or information contained in this system of records may be disclosed as a routine use pursuant to 5 U.S.C. 552a(b)(3) under the circumstances or for the purposes described below, however, disclosures of individually identifiable information are subject to the confidentiality protections of both 34 U.S.C. 10231(a), which prohibit the use of information collected for statistical or research purposes for any non-statistical or research purposes and 34 U.S.C. 10134, prohibiting use of statistical or research data for law enforcement, compliance, and investigative purposes, consistent with the applicability described in 28 CFR 22.20. The confidentiality of survey respondents for collections administered under the PREA are further protected under the confidentiality provisions of 34 U.S.C. 30303(a)(5), except as authorized under (a)(7). Furthermore, to the extent such disclosures are compatible with the purposes for which the information was collected and not contrary to law, routine uses are as follows:

1. To contractors, award recipients, subcontractors, consultants, and other authorized individuals performing or working on a BJS-funded contract, grant, cooperative agreement, or interagency agreement, consistent with BJS's statutory authorities, when necessary to accomplish an agency function related to this system of records and support BJS's statistical mission. Such individuals work under BJS's authority and direction as agents to collect, receive, handle, analyze, transfer, process, store, and/or disseminate records maintained in this system of records. Access to records is based on an individual's job responsibilities and need to know to support BJS objectives.

2. To federal governmental agencies and offices, consistent with BJS's statutory authorities, for approved statistical and research purposes, including to facilitate the linkage of statistical records through the use of personal identifiers for example general personal information ( e.g., name, address, citizenship status, country of nationality, and date of birth); and identifying numbers ( e.g., FBI ID number, state ID number, state Department of Correction (DOC) ID number, social security number (SSN) (as to BJS administrative statistical data collections only), Alien Registration Number, and file, case, and arrest numbers).

3. To another federal agency; the Congressional Budget Office; State, local, and Tribal governments; researchers; and other individuals, as appropriate, to support approved statistical, research, and evidence-building purposes, consistent with BJS's statutory authorities.

4. To such recipients and under such circumstances and procedures as are mandated by federal statute or treaty.

5. To a Member of Congress or staff acting upon the Member's behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record.

6. To appropriate agencies, entities, and persons when (1) the Department suspects or has confirmed that there has been a breach of the system of records; (2) the Department has determined that as a result of the suspected or confirmed breach, there is a risk of harm to individuals, the Department (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

7. To another federal agency or federal entity, when the Department determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach, or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

8. To the National Archives and Records Administration (NARA) for the purpose of records management inspections conducted under the authority of 44 U.S.C. 2904 and 2906.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records will be stored in secure drives and secure Cloud platforms. In rare cases where physical copies of records are received, they will be stored in a secure, locked area with appropriate physical and administrative controls, until they can be digitized, stored securely, and disposed of according to National Institute of Standards and Technology (NIST) standards to clear, purge, and destroy data to prevent unauthorized recovery, or currently accepted federal requirements. Information systems that store BJS data will maintain the appropriate technical controls to safeguard the data in accordance with 28 CFR 22, the Federal Information Security Modernization Act, NIST, and other applicable federal requirements. Datasets are accessible only by authorized personnel. Control lists will be used to restrict access to those employees with a need to know; access will be granted based on job functions and access logs will be maintained and audited periodically to ensure only ( printed page 65601) authorized staff access confidential BJS data. BJS data collection agents are required to maintain a comparable level of protection and adhere to the data security requirements described in 28 CFR 22.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

A limited number of individuals on the BJS project team, including BJS employees and its data collection agents who are authorized to complete statistical activities under BJS's direction, will have access to records, as needed on a project-specific basis. Requisite OJP and contractor IT security administrators will have access to the stored data to complete essential job functions. BJS and its data collection agents may use a personal identifier such as name, associated case file number, and type of crime or victimization to retrieve information about a specific record for activities related to its statistical and research work, such as data quality checks to resolve missing, incongruous, or incomplete information; or survey sampling frame development activities for routine statistical analysis purposes. BJS may also use personal identifiers such as an individual's name and, for example, a criminal justice case number or facility location (in the case of inmates) to retrieve specific records that need to be purged or updated.

Consistent with its authorizing confidentiality and data use statutes, BJS policies adheres strictly to prohibiting the unauthorized use or disclosure of personal identifiers for reasons other than statistical or research purposes, such as to look up information on a specific private person for individual-level investigative, compliance, or enforcement purposes or to make determinations about the receipt of benefits. To further minimize the risk of unauthorized use or disclosure of personal identifiers maintained in BJS systems, BJS will delete direct identifiers from its data analysis files and replace them with unique non-identifying codes where practical and when doing so will not compromise data integrity, reliability, or utility. When direct identifiers cannot be replaced with non-identifying codes, BJS will store the personal identifiers in secure systems in accordance with the Federal Information Security Modernization Act (FISMA) and ensure that only authorized staff have access to the records to protect the information from unauthorized use or disclosure.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

BJS official records, including final versions of collected data and all related research and statistical records, are currently classified as Unscheduled Records, in accordance with National Archives and Records Administration (NARA) guidance. As unscheduled federal records, these materials cannot be destroyed and must be retained indefinitely until a NARA-approved records disposition schedule is established. Working data files and duplicates are disposed of using secure methods when no longer needed for business purposes.

BJS is actively developing a comprehensive records disposition schedule that will outline permanent retention and transfer requirements for statistical products, supporting documentation, and related analytical files. Until NARA approves this schedule, all BJS official records, whether electronic or physical, will continue to be maintained securely and without destruction.

Where applicable, BJS adheres to relevant NIST or other accepted federal standards to securely remove and dispose of data from its servers and physical media. Such standards include using various techniques to securely clear, purge, and destroy the data, such as cryptographic erasure, shredding, and degaussing procedures.

For BJS award recipients, final disposition requirements remain governed by 28 CFR 22.25 and the terms of the award agreement. Such entities are authorized to destroy identifiable or nonpublic data using secure disposition standards only after secure transfer to BJS and receipt of written destruction authorization from BJS. These requirements do not alter BJS's mandatory retention of official records.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

BJS is required to comply with applicable Federal and DOJ IT security policies, procedures, and guidelines to adequately secure and protect information systems against unauthorized disclosure (28 CFR 22), specifically to: assess and secure information systems in accordance with the Federal Information Security Modernization Act (FISMA); adhere to National Institute of Standards and Technology (NIST) guidelines to categorize and secure data; reduce the volume of records collected and retained to the minimum necessary; limit access to information identifiable to a private person and restrict its use for only the approved purposes; complete data security and confidentiality training, as applicable; and comply with DOJ policies on remote access and security incident preparation, reporting, and notification.

BJS data collection agents are required to maintain the appropriate physical, technical, and administrative controls and security procedures to protect information identifiable to a private person from unauthorized disclosure or misuse (28 CFR 22). Further, BJS award recipients must maintain a data management plan that describes the specific controls and procedures that will be used to safeguard the administrative, technical, and physical security of identifiable data and return to BJS and destroy all nonpublic data to BJS at the end of the project period.

Any person who violates BJS's confidentiality provisions of 34 U.S.C. 10231 may be punished by a fine of up to $10,000, in addition to any other penalties imposed by Federal law.

To comply with the Federal Cybersecurity Enhancement Act of 2015 and mitigate cybersecurity threats, OJP facilitates the inspection of all information transmitted to and from OJP systems including, but not limited to, respondent data collected and maintained by BJS.

The BJS Data Protection Guidelines, found on the BJS website ( www.bjs.gov) summarize BJS's responsibilities related to the collection, handling, use, dissemination, protection, and disposition of data collected under BJS's authority.

RECORD ACCESS PROCEDURES:

A major part of this system is exempted from this requirement under subsections (c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H), and (f) of the Privacy Act pursuant to 5 U.S.C. 552a(k)(4). A determination as to exemption shall be made at the time a request for access is received. All requests for access to records must be in writing and should be addressed as follows:

OJP FOIA Officer; Office of Justice Programs; Office of the General Counsel; 999 North Capitol Street NE, Washington, DC 20002.

The envelope and letter should be clearly marked “Privacy Act Access Request.” The request must describe the records sought in sufficient detail to enable DOJ personnel to locate them with a reasonable amount of effort. The request must include a general description of the records sought and must include the requester's full name, current address, and date and place of birth. The request must be signed and either notarized or submitted under penalty of perjury. ( printed page 65602)

Although no specific form is required, you may obtain forms for this purpose from the FOIA/Privacy Act Mail Referral Unit, United States Department of Justice, 950 Pennsylvania Avenue NW, Washington, DC 20530, or on the Department of Justice website at www.justice.gov/​oip/​oip-request.html.

More information regarding the DOJ's procedures for accessing records in accordance with the Privacy Act can be found at 28 CFR part 16 Subpart D, “Protection of Privacy and Access to Individual Records Under the Privacy Act of 1974.”

CONTESTING RECORD PROCEDURES:

Individuals seeking to contest or amend records pertaining to them, maintained in this system of records, must direct their requests to the address indicated in the “RECORD ACCESS PROCEDURES” paragraph, above. All requests to contest or amend records must be in writing and the envelope and letter should be clearly marked “Privacy Act Amendment Request.” All requests must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.

More information regarding the DOJ's procedures for amending or contesting records in accordance with the Privacy Act can be found at 28 CFR 16.46, “Requests for Amendment or Correction of Records.”

NOTIFICATION PROCEDURES:

Individuals may request to be notified if a record in this system of records pertains to them by utilizing the same procedures as those identified in the “RECORD ACCESS PROCEDURES” paragraph, above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

The Attorney General has exempted this system from subsections (c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H), and (f) of the Privacy Act pursuant to 5 U.S.C. 552a(k)(4). The reasons for asserting these exemptions are to comply with the confidentiality provisions of 34 U.S.C. 10231 and 34 U.S.C. 30303 and the requirements of 34 U.S.C. 10134 and 44 U.S.C. 3563 that the data are to be used solely for statistical purposes and to avoid unlawful consideration of these records whose sole statistical and research use comports fully with a basic purpose of the Privacy Act, namely, that no adverse disclosures are made from these records as to any identifiable individual. The exemptions will be applied only to the extent that the information in the system is subject to exemption pursuant to 5 U.S.C. 552a(k)(4). Rules are in the process of being promulgated in accordance with the requirements of 5 U.S.C. 553(b), (c), and (e) and are in the process of being published in the Federal Register .

HISTORY:

None.