TITLE 6. CRIMINAL JUSTICE AND CORRECTIONS

BOARD OF JUVENILE JUSTICE

Fast-Track Regulation

Title of Regulation: 6VAC35-160. Regulations Governing Juvenile Record Information and the Virginia Juvenile Justice Information System (amending 6VAC35-160-10, 6VAC35-160-130).

Statutory Authority: § 16.1-223 of the Code of Virginia.

Public Hearing Information: No public hearing is currently scheduled.

Public Comment Deadline: August 27, 2025.

Effective Date: September 15, 2025.

Agency Contact: Kristen Peterson, Regulatory Coordinator, Department of Juvenile Justice, P.O. Box 1110, Richmond, VA 23218-1110, telephone (804) 773-0180, fax (804) 371-6497, or email kristen.peterson@djj.virginia.gov.

Basis: Section 16.1-223 of the Code of Virginia authorizes the Board of Juvenile Justice to promulgate regulations governing the security and confidentiality of data submitted into the Virginia Juvenile Justice Information System (VJJIS).

Purpose: The amendments remove the incorporation by reference of Information Technology Resource Management (ITRM) Information Security Standard 501-09.1, which provides technical and programmatic guidance regarding the ITRM framework applicable to the Commonwealth's executive, legislative, and judicial branches, along with independent agencies and institutions of higher education. In addition to concerns with the breadth of provisions incorporated by reference, the department believes that the definition of data owner and the requirement to implement a screen saver lockout period are sufficient as standalone provisions and do not require additional reference to the ITRM standard. The standard has also been updated nine times since 2016 before being superseded by COV ITRM Standard SEC 530, effective March 2023. Thus, the current incorporated standard is obsolete. This action is intended to reduce the regulatory burden on regulants, thereby improving compliance and protecting public health, safety, and welfare.

Rationale for Using Fast-Track Rulemaking Process: This action is noncontroversial and therefore suitable for the fast-track rulemaking process because the DIBR being removed is obsolete and is incorporated into two regulatory sections whose provisions are sufficient without the incorporation.

Substance: The amendments remove (i) the document incorporated by reference (DIBR), ITRM Information Security Standard 501–09.1, and (ii) references to the DIBR throughout the chapter.

Issues: The primary advantage of this action is the removal of an obsolete document that contains hundreds of requirements not relevant to the applicable sections in this chapter, which will prevent the department from enforcing these supplemental provisions as part of this chapter. There are no anticipated disadvantages to the public or the Commonwealth.

Department of Planning and Budget Economic Impact Analysis:

The Department of Planning and Budget (DPB) has analyzed the economic impact of this proposed regulation in accordance with § 2.2-4007.04 of the Code of Virginia (Code) and Executive Order 19. The analysis presented below represents DPBs best estimate of the potential economic impacts as of the date of this analysis.¹

Summary of the Proposed Amendments to Regulation. The Board of Juvenile Justice (board) proposes to remove a document incorporated by reference (DIBR) and two references to the DIBR from 6VAC35-160, Regulations Governing Juvenile Record Information and the Virginia Juvenile Justice Information System.

Background. The current regulation lists the Commonwealth of Virginia Information Technology Resource Management Standard, Information Security Standard, 50109.1, Virginia Information Technologies Agency (rev. 12/2016), SEC 501-09.1, as a DIBR, and references the document in 6VAC35-160-10 in the definition of data owner and in 6VAC35-160-130 in the requirement to implement a screen saver lockout period after a maximum of 15 minutes of inactivity for devices.

Estimated Benefits and Costs. The Department of Juvenile Justice (DJJ) states that the department believes that incorporating this document is not necessary within the context of 6VAC35-160-10, definition of data owner since the regulatory definition is consistent with SEC 501-09.1's requirements and sufficient to address which DJJ employee should serve in this capacity. Further, DJJ states that the department believes the requirement to implement a lockout period after 15 minutes of inactivity is sufficient to carry out the provisions intent without invoking SEC 501-09.1. Thus, the proposed removal of the reference to SEC 501-09.1 from the definition of data owner, and from the requirement to implement a screen saver lockout period, should have no substantive impact.

Businesses and Other Entities Affected. According to DJJ, the regulation applies to participating agencies. The regulation defines participating agencies as the department, including state-operated court service units; any locally operated court service unit, secure juvenile detention center, or juvenile group home; or any public agency, child welfare agency, private organization, facility, or person who is treating or providing services to a child pursuant to a contract with the department or pursuant to the Virginia Juvenile Community Crime Control Act as set out in Article 12.1 (§ 16.1-309.2 et seq.) of Chapter 11 of Title 16.1 of the Code of Virginia, that is approved by the department to have direct access to juvenile record information through the Virginia Juvenile Justice Information System (VJJIS) or any of its component or derivative information systems. The term "participating agency" does not include any court.

DJJ states that no other state agencies have applied for and received access to the VJJIS, but it has granted such access to the VJJIS to the two locally operated court service units, the 24 locally and regionally operated juvenile detention centers, and various localities operating Virginia Juvenile Community Crime Control Act (VJCCCA) programs. The agency contracts with a regional service coordinator, who has also been granted access to the VJJIS in order to support DJJs continuum of services through service coordination, quality assurance, and reporting. Other private entities that operate VJCCCA programs also have access to various components of the VJJIS.
The Code requires DPB to assess whether an adverse impact may result from the proposed regulation.² An adverse impact is indicated if there is any increase in net cost or reduction in net benefit for any entity, even if the benefits exceed the costs for all entities combined.³ Since there is no increase in net cost nor reduction in net benefit for any entity, no adverse impact is indicated.

Small Businesses⁴ Affected.⁵ The proposed amendments do not adversely affect small businesses.

Localities⁶ Affected.⁷ The proposed amendments neither disproportionately affect particular entities, nor affect costs for local government.

Projected Impact on Employment. The proposed amendments do not adversely affect small businesses.

Effects on the Use and Value of Private Property. The proposed amendments neither affect the use and value of private property, nor affect real estate development costs.

_____________________________

¹ Section 2.2-4007.04 of the Code of Virginia requires that such economic impact analyses determine the public benefits and costs of the proposed amendments. Further the analysis should include but not be limited to: (1) the projected number of businesses or other entities to whom the proposed regulatory action would apply, (2) the identity of any localities and types of businesses or other entities particularly affected, (3) the projected number of persons and employment positions to be affected, (4) the projected costs to affected businesses or entities to implement or comply with the regulation, and (5) the impact on the use and value of private property.

² Pursuant to § 2.2-4007.04 D: In the event this economic impact analysis reveals that the proposed regulation would have an adverse economic impact on businesses or would impose a significant adverse economic impact on a locality, business, or entity particularly affected, the Department of Planning and Budget shall advise the Joint Commission on Administrative Rules, the House Committee on Appropriations, and the Senate Committee on Finance. Statute does not define "adverse impact," state whether only Virginia entities should be considered, nor indicate whether an adverse impact results from regulatory requirements mandated by legislation.

³ Statute does not define "adverse impact," state whether only Virginia entities should be considered, nor indicate whether an adverse impact results from regulatory requirements mandated by legislation. As a result, DPB has adopted a definition of adverse impact that assesses changes in net costs and benefits for each affected Virginia entity that directly results from discretionary changes to the regulation.

⁴ Pursuant to § 2.2-4007.04, small business is defined as "a business entity, including its affiliates, that (i) is independently owned and operated and (ii) employs fewer than 500 full-time employees or has gross annual sales of less than $6 million."

⁵ If the proposed regulatory action may have an adverse effect on small businesses, § 2.2-4007.04 requires that such economic impact analyses include: (1) an identification and estimate of the number of small businesses subject to the proposed regulation, (2) the projected reporting, recordkeeping, and other administrative costs required for small businesses to comply with the proposed regulation, including the type of professional skills necessary for preparing required reports and other documents, (3) a statement of the probable effect of the proposed regulation on affected small businesses, and (4) a description of any less intrusive or less costly alternative methods of achieving the purpose of the proposed regulation. Additionally, pursuant to § 2.2-4007.1 of the Code of Virginia, if there is a finding that a proposed regulation may have an adverse impact on small business, the Joint Commission on Administrative Rules shall be notified.

⁶ "Locality" can refer to either local governments or the locations in the Commonwealth where the activities relevant to the regulatory change are most likely to occur.

⁷ Section 2.2-4007.04 defines "particularly affected" as bearing disproportionate material impact.

Agency Response to Economic Impact Analysis: The Board of Juvenile Justice concurs with the Department of Planning and Budget's economic impact analysis.

Summary:

In response to Executive Order 19 (2022), the amendments remove (i) an obsolete document incorporated by reference (DIBR) and (ii) all references to the DIBR within the chapter.

6VAC35-160-10. Definitions.

The following words and terms when used in this chapter shall have the following meanings unless the context clearly indicates otherwise:

"Access" means the ability directly to directly obtain information concerning an individual juvenile contained in manual or automated files.

"Commonwealth of Virginia Information Technology Resource Management Standards" or "COV ITRM Standards" means the information technology standards applicable to all Commonwealth executive branch agencies that manage, develop, purchase, and use information technology resources in the Commonwealth of Virginia.

"Data owner" means a Department of Juvenile Justice employee who is responsible for the policy and practice decisions regarding data as identified by COV ITRM Standard Security (SEC) 501–09.1.

"Department" means the Department of Juvenile Justice.

"Destroy" means to totally eliminate and eradicate by various methods, including shredding, incinerating, or pulping.

"Dissemination" means any transfer of juvenile record information, whether orally, in writing, or by electronic means, to any person other than an employee of a participating agency who is authorized to receive the information under § 16.1-300 of the Code of Virginia and who is not barred from receiving the information by other applicable law.

"Expunge" means to destroy all records concerning an individual juvenile, or all personal identifying information related to an individual juvenile that is included in aggregated files and databases, in accordance with a court order or the Code of Virginia.

"Juvenile record information" means any information in the possession of a participating agency pertaining to the case of a juvenile who is or has been the subject of an action by an intake officer as provided by § 16.1-260 of the Code of Virginia, as well as to personal identifying information concerning such a juvenile in any database or other aggregated compilation of records. The term does not apply to statistical or analytical records or reports in which individuals are not identified and from which their identities are not ascertainable.

"Need to know" means the principle that a user should access only the specific information necessary to perform a particular function in the exercise of his official duties.

"Participating agency" means the department, including state-operated court service units; any locally operated court service unit, secure juvenile detention center, or juvenile group home; or any public agency, child welfare agency, private organization, facility, or person who is treating or providing services to a child pursuant to a contract with the department or pursuant to the Virginia Juvenile Community Crime Control Act as set out in Article 12.1 (§ 16.1-309.2 et seq.) of Chapter 11 of Title 16.1 of the Code of Virginia, that is approved by the department to have direct access to juvenile record information through the VJJIS or any of its component or derivative information systems. The term "participating agency" does not include any court.

"Remote access" means a connection to the department's systems from a remote location other than a department facility.

"Telecommunication connection" means the infrastructure used to establish a remote access to department information technology systems.

"Virginia Juvenile Justice Information System" or "VJJIS" means the equipment, facilities, agreements, and procedures used to collect, process, preserve, or disseminate juvenile record information in accordance with § 16.1-224 or 16.1-300 of the Code of Virginia. The operations of the system may be performed manually or by using electronic computers or other automated data processing equipment.

6VAC35-160-130. Security of telecommunications.

A. The department may permit the use of a nondedicated means of data transmission to access juvenile record information when there are adequate and verifiable safeguards in place to restrict access to juvenile record information to authorized persons. Industry standard levels of encryption shall be required to protect all juvenile record information moving through any network.

B. Where remote access of juvenile record information is permitted, remote access devices must be secure. Remote access devices capable of receiving or transmitting juvenile record information shall be secured during periods of operation. When the remote access device is unattended, the device shall be made inoperable for purposes of accessing juvenile record information by implementing a screen saver lockout period after a maximum of 15 minutes of inactivity for devices as required by COV ITRM Standards SEC 501–09.1. In addition, appropriate identification of the remote access device operator shall be required.

C. The telecommunications connection used with the remote access device shall also be secured. Telecommunications connections shall be reasonably protected from possible tampering or tapping.

DOCUMENTS INCORPORATED BY REFERENCE (6VAC35-160)

Information Technology Resource Management Standard - Removal of Commonwealth Data from Electronic Media Standard, 514–04, Virginia Information Technologies Agency (rev. 12/2015)

Commonwealth of Virginia Information Technology Resource Management Standard, Information Security Standard, 501–09.1, Virginia Information Technologies Agency (rev. 12/2016)