28 CFR Part 907 — Compact Council Procedures for Compliant Conduct and Responsible Use of the Interstate Identification Index (III) System for Noncriminal Justice Purposes

law://us/cfr/28/907@2026-11-12

Contents

907.1Purpose and authority.#

Part 907 establishes policies and procedures to ensure that use of the III System for noncriminal justice purposes complies with the National Crime Prevention and Privacy Compact (Compact) and with rules, standards, and procedures established by the Compact Council regarding application and response procedures, record dissemination and use, response times, data quality, system security, accuracy, privacy protection, and other aspects of III System operation for noncriminal justice purposes. The rule is established pursuant to Article VI of the Compact, which authorizes the Compact Council to promulgate rules, procedures, and standards governing the use of the III System for noncriminal justice purposes. The rule requires responsible authorized access to the System and proper use of records that are obtained from the System. The rule provides comprehensive procedures for a coordinated compliance effort among the Compact Council, the FBI, and local, State and Federal government agencies, and encourages the cooperation of all affected parties.

907.2Applicability.#

This rule applies to III System access for noncriminal justice purposes as covered by the Compact, see 42 U.S.C. 14614 and 14616, and use of information obtained by means of the System for such purposes. The rule establishes procedures for ensuring that the FBI's and Compact Party States' criminal history record repositories carry out their responsibilities under the Compact, as set out in the National Fingerprint File (NFF) Qualification Requirements, and that local, State and Federal government agencies using the III System for noncriminal justice purposes comply with the Compact and with applicable Compact Council rules.

907.3Assessing compliance.#

(a)The FBI CJIS Division staff regularly conducts systematic compliance reviews of state repositories. These reviews may include, as necessary, reviews of III System user agencies, including governmental and nongovernmental noncriminal justice entities that submit fingerprints to the State repositories and criminal justice and noncriminal justice agencies with direct access to the III System. These reviews may include, as necessary, the governmental and nongovernmental noncriminal justice entities authorized to submit fingerprints directly to the FBI. The reviews may consist of systematic analyses and evaluations, including on-site investigations, and shall be as comprehensive as necessary to adequately ensure compliance with the Compact and Compact Council rules. Violations may also be reported or detected independently of a review.

(b)The FBI CJIS Division staff or the audit team established to review the FBI's noncriminal justice use of the III System shall prepare a draft report describing the nature and results of each review and set out all findings of compliance and noncompliance, including any reasons for noncompliance and the circumstances surrounding the noncompliance. If the agency under review is the FBI or another Federal agency, the draft report shall be forwarded to the FBI Compact Officer. If the agency under review is a State or local agency in a Party State, the draft report shall be forwarded to the State Compact Officer. If the agency under review is a State or local agency in a Nonparty State, the draft report shall be forwarded to the chief administrator of the State repository.

(c)The Compact Officer of the FBI or a Party State or the chief administrator of the State repository in a Nonparty State shall be afforded the opportunity to forward comments and supporting materials to the FBI CJIS Division staff or to the audit team.

(d)The FBI CJIS Division staff or the audit team shall review any comments and materials received and shall incorporate applicable revisions into a final report. The final report shall be provided to the Compact Officer of the FBI or a Party State or the chief administrator of the State repository in a Nonparty State to whom the draft report was sent. If the agency under review is a State or local agency, a copy of the report shall be provided to the FBI Compact Officer. If the agency under review is being reviewed for the first time, the letter transmitting the report shall provide that sanctions will not be imposed regarding any deficiencies set out in the report. The letter shall also advise, however, that the deficiencies must be remedied and failure to do so before the agency is reviewed again will result in the initiation of remedial action pursuant to § 907.4.

907.4Methodology for resolving noncompliance.#

(a)Subsequent to each compliance review that is not a first-time agency review, the final report shall be forwarded to the Compact Council Sanctions Committee (Sanctions Committee). The Sanctions Committee shall review the report and if it concludes that no violations occurred or no violations occurred that are serious enough to require further action, it shall forward its conclusions and recommendations to the Compact Council Chairman. If the Compact Council Chairman approves the Sanctions Committee's recommendations, the Compact Council Chairman shall send a letter to this effect to the FBI or Party State Compact Officer or the chief administrator of the state repository in a Nonparty State that has executed a Memorandum of Understanding. For all remaining states, the Compact Council Chairman shall forward the recommendations to the FBI Director or Designee who, upon approval of the recommendations, shall send a letter to this effect to the chief administrator of the state repository. If the agency under review is a state or local agency, a copy of the Compact Council Chairman's or FBI Director's or Designee's letter shall be provided to the FBI Compact Officer.

(b)Should the Sanctions Committee conclude that a violation has occurred that is serious enough to require redress, the Sanctions Committee shall recommend to the Compact Council a course of action necessary to bring the offending agency into compliance and require the offending agency to provide assurances that subsequent violations will not occur. In making its recommendation, the Sanctions Committee shall consider the minimal action necessary to ensure compliance or shall explain why corrective action is not required. This may include, but not be limited to, requiring a plan of action by the offending agency to achieve compliance, with benchmarks and performance measures, and/or requiring the agency to seek technical assistance to identify sources of the problem and proposed resolutions. If the Compact Council or, when applicable, the FBI Director or Designee approves the Sanctions Committee's recommendations, progressive actions shall be initiated as set forth below. The letters referred to in this paragraph (907.4(b)) shall be from the Compact Council Chairman when the offending agency is the FBI or another federal agency, a state or local agency in a Party State, or a state or local agency in a Nonparty State that has executed a Memorandum of Understanding. The documentation and written responses from the aforementioned agencies to such letters shall be sent to the Compact Council Chairman. For all remaining states, the Compact Council Chairman shall forward the Compact Council's recommendations to the FBI Director or Designee who, upon approval of the recommendations, shall send the letters; accordingly, all documentation and written responses relating to the FBI Director's or Designee's letters shall be sent to the FBI Director or Designee who shall make such letters available to the Compact Council Chairman. If the offending agency is an agency other than the FBI or a state repository, any response letters from the offending agency shall be sent to the Compact Officer of the FBI or Party State or the chief administrator of the state repository in a Nonparty State and shall outline the course of action the offending agency will undertake to correct the deficiencies and provide assurances that subsequent violations will not recur.

(1)As noted above, a letter shall be sent to the Compact Officer of the FBI or Party State or the chief administrator of the state repository in a Nonparty State identifying the violations and setting out the actions necessary to come into compliance. The letter shall provide that if compliance is not achieved and assurances provided that minimize the probability that subsequent violations will occur, and non-compliance is not excused, the Compact Council may authorize the FBI to refuse to process requests for criminal history record checks for noncriminal justice purposes from the offending agency and, if the offending agency is a criminal justice agency, may request the Director of the FBI to take appropriate action against the offending agency consistent with the recommendations of the Compact Council. The letter shall direct the Compact Officer of the FBI or Party State or the chief administrator of the state repository in a Nonparty State to submit a written response within 30 calendar days from the date of the letter, unless a more expeditious response is required. If the offending agency is a state or local agency, a copy of the Compact Council Chairman's or FBI Director's or Designee's letter shall be provided to the FBI Compact Officer. The Compact Council Chairman shall refer the response letter to the Sanctions Committee for appropriate action.

(2)If the Sanctions Committee deems the response letter under paragraph (b)(1) of this section to be insufficient, or if no response is received within the allotted time, the Sanctions Committee shall report its finding to the Compact Council. If the Compact Council agrees with the Sanctions Committee's finding, a letter shall be sent to the Director of the FBI (if the offending agency is the FBI or another federal agency) or to the head of the state agency in which the state repository resides (if the offending agency is a state or local agency), requesting assistance in correcting the deficiencies. The letter shall provide that the offending agency is being placed on probationary status. A copy of the letter shall be sent to the Compact Officer of the FBI or Party State or the chief administrator of the state repository in a Nonparty State. If the offending agency is a state or local agency, a copy of the Compact Council Chairman's or FBI Director's or Designee's letter shall be provided to the FBI Compact Officer. A written response to the letter shall be required within 20 calendar days from the date of the letter unless a more expeditious response is required. The Compact Council Chairman shall refer the response letter to the Sanctions Committee for appropriate action.

(3)If the Sanctions Committee deems the response letter under paragraph (b)(2) of this section to be insufficient, or if no response is received within the allotted time, the Sanctions Committee shall report its finding to the Compact Council. If the Compact Council agrees with the Sanctions Committee's finding, a letter shall be sent to the U. S. Attorney General (if the offending agency is the FBI or another federal agency) or to the elected/appointed state official who has oversight of the department in which the state repository resides (if the offending agency is a state or local agency), requesting assistance in correcting the deficiencies. If the state official is not the Governor, a copy of the letter shall be sent to the Governor. A copy of the letter shall also be sent to the FBI Compact Officer and (if the offending agency is a state or local agency) to the State Compact Officer or the chief administrator of the state repository in a Nonparty State. The letter shall provide that a written response is required within 20 calendar days of the date of the letter, and that if a sufficient response is not received within that time, sanctions may be imposed that could result in suspension of the offending agency's access to the III System for noncriminal justice purposes. The Compact Council Chairman shall refer the response letter to the Sanctions Committee for appropriate action.

(4)If no response letter is received under paragraph (b)(3) of this section within the allotted time, or if the Sanctions Committee deems the response to be insufficient, the Sanctions Committee shall report its finding to the Compact Council. If the Compact Council agrees with the Sanctions Committee's finding, the Compact Council Chairman or the FBI Director or Designee shall direct the FBI Compact Officer to take appropriate action to suspend noncriminal justice access to the III System by the offending agency. If the offending agency is a criminal justice agency, the Compact Council Chairman shall request the Director of the FBI to take appropriate action to suspend noncriminal justice access to the III System by the offending agency.

(5)Reinstatement of full service by the FBI shall occur after the Compact Officer of the FBI or a Party State or the chief administrator of the state repository in a Nonparty State provides satisfactory documentation that the deficiencies have been corrected or a process has been initiated to correct the deficiencies. Upon approval of the documentation by the Sanctions Committee in consultation with the Compact Council Chairman, the Compact Council Chairman or the FBI Director or Designee shall request the FBI Compact Officer to take appropriate action to reinstate full service. Letters to this effect shall be sent to all persons who have previously received letters relating to the deficiencies and resulting suspension of service. The decision to reinstate full service shall be considered for ratification by the Compact Council at its next regularly scheduled meeting.

(c)For good cause, the Compact Council Chairman and the FBI Director or Designee shall be authorized to extend the number of days allowed for the response letters required by paragraphs (b)(1) through (3) of this section.

907.5Sanction adjudication.#

(a)A Compact Officer of the FBI or a Party State or the chief administrator of the state repository in a Nonparty State may dispute a sanction under this Part by asking the Compact Council Chairman for an opportunity to address the Compact Council.

(b)Unresolved disputes based on the Compact Council's issuance of sanctions under this Part may be referred to the Compact Council Dispute Adjudication Committee when pertaining to disputes described under ARTICLE XI(a) of the Compact.

(c)Nothing prohibits the Compact Council from requesting the FBI to exercise immediate and necessary action to preserve the integrity of the III System pursuant to Article XI(b) of the Compact.

United States Government work; public domain under 17 U.S.C. § 105.

28 CFR Part 907 — Compact Council Procedures for Compliant Conduct and Responsible Use of the Interstate Identification Index (III) System for Noncriminal Justice Purposes

28 CFR Part 907 — Compact Council Procedures for Compliant Conduct and Responsible Use of the Interstate Identification Index (III) System for Noncriminal Justice Purposes

907.1Purpose and authority.#

907.2Applicability.#

907.3Assessing compliance.#

907.4Methodology for resolving noncompliance.#

907.5Sanction adjudication.#

History · 1 version

907.1Purpose and authority.#

907.2Applicability.#

907.3Assessing compliance.#

907.4Methodology for resolving noncompliance.#

907.5Sanction adjudication.#

Key facts