Title of Regulation: 6VAC20-120. Regulations Relating to Criminal History Record Information Use and Security (amending 6VAC20-120-20 through 6VAC20-120-80, 6VAC20-120-100 through 6VAC20-120-140, 6VAC20-120-160; repealing 6VAC20-120-10).

Statutory Authority: §§ 9.1-102 and 9.1-131 of the Code of Virginia.

Effective Date: November 4, 2016.

Agency Contact: Barbara Peterson-Wilson, Law Enforcement Program Coordinator, Department of Criminal Justice Services, 1100 Bank Street, Richmond, VA 23219, telephone (804) 225-4503, FAX (804) 225-3853, or email barbara.peterson-wilson@dcjs.virginia.gov.

Summary:

The amendments (i) update definitions, (ii) clarify that the department does not have the authority to audit noncriminal justice agencies or individuals, (iii) update provisions relating to the Central Criminal Records Exchange (CCRE), (iv) clarify that agencies are not authorized to query CCRE at the request of an individual, (iv) reflect statutory provisions relating to expunged records and court requirements when using imaged case records, and (v) make technical or corrective changes.

Summary of Public Comments and Agency's Response: No public comments were received by the promulgating agency.

[ Part I
General ]

6VAC20-120-10. Purpose. (Repealed.)

Pursuant to the provisions of §§ 9-170 1, 9-170 15, 9-170 16, 9-170 17, 9-170 21 and §§ 9-184 through 9-196 of the Code of Virginia, the Criminal Justice Services Board hereby promulgates the following regulations relating to Criminal History Record Information Use and Security.

The purpose of these regulations is to assure that state and local criminal justice agencies maintaining criminal history record information establish required record keeping procedures to ensure that criminal history record information is accurate, complete, timely, electronically and physically secure, and disseminated only in accordance with federal and state legislation and regulations. Agencies may implement specific procedures appropriate to their particular systems, but at a minimum shall abide by the requirements outlined herein.

[ Part I
General ]

6VAC20-120-20. Definitions.

The following words and terms, when used in this chapter, shall have the following meanings, unless the context clearly indicates otherwise.

"Access" means the ability to obtain, directly or through an intermediary, criminal history record information contained in manual or automated files.

"Board" means the Criminal Justice Services Board, as defined in § 9-168 9.1-108 of the Code of Virginia.

"Central Criminal Records Exchange (CCRE)" [ or "CCRE" ] means the repository in this Commonwealth which that receives, identifies, maintains, and disseminates individual criminal history records, in accordance with § 9-170 22 Chapter 23 (§ 19.2-387 et seq.) of Title 19.2 of the Code of Virginia.

"Challenge" means an individual's objection to his criminal history record information.

"Conviction data" means information in the custody of any criminal justice agency relating to a judgement judgment of conviction, and the consequences arising therefrom, in any court.

"Correctional status information" means records and data concerning each condition of a convicted person's custodial status, including probation, confinement, work release, study release, escape, or termination of custody through expiration of sentence, parole, pardon, or court decision.

"Criminal history record information" means records and data collected by criminal justice agencies on adult individuals consisting of identifiable descriptions and notations of arrests, detentions, indictments, informations information, or other formal charges and any disposition arising therefrom. The term shall not include juvenile record information which is controlled by Chapter 11 (§ 16.1-226 et seq.), of Title 16.1 §§ 16.1-299 and 19.2-389.1 of the Code of Virginia, criminal justice investigative information, or correctional status information.

"Criminal history record information area" means any office, room, or space in which criminal history record information is regularly collected, processed, stored, or disseminated to an authorized user. This area includes computer rooms, computer terminal workstations, file rooms, and any other rooms or space in which the above those activities are carried out.

"Criminal intelligence information" means information on identifiable individuals compiled in an effort to anticipate, prevent or monitor possible data that has been evaluated and determined to be relevant to the identification and criminal activity of individuals or organizations that are reasonably suspected of involvement in criminal activity. Criminal intelligence information shall not include criminal investigative files.

"Criminal investigative information" means information on identifiable individuals compiled in the course of the investigation of specific criminal acts.

"Criminal justice agency" means a court or any other governmental agency or subunit thereof which that as its principal function performs the administration of criminal justice and any other agency or subunit thereof which that performs criminal justice activities.

"Criminal justice information system" means a system, including the equipment, facilities, procedures, agreements, and organizations thereof, which that is used for the collection, processing, preservation, or dissemination of criminal history record information. The operations of the system may be performed manually or by using electronic computers or other automated data processing equipment.

"Department" means the Department of Criminal Justice Services.

"Destroy" means to totally eliminate and eradicate by various methods, including, but not limited to, shredding, incinerating, or pulping.

"Director" means the chief administrative officer of the department.

"Dissemination" means any transfer of information, whether orally, in writing, or by electronic means. The term does not include access to the information by officers or employees of a criminal justice agency maintaining the information who have both a need and a right to know the information.

"Expunge" means to remove, in accordance with a court order, a criminal history record, or a portion of a record, from public inspection or normal access.

"Modify" means to add or delete information from a record to accurately reflect the reported facts of an individual's criminal history record. (See § 9-192(C) 9.1-132 of the Code of Virginia.) This includes eradicating, supplementing, updating, and correcting inaccurate and erroneous information.

"Noncriminal justice agencies or individuals" means those agencies or individuals authorized to receive limited criminal history record information pursuant to a specific agreement with a criminal justice agency under the provisions of subsection A of § 19.2-389 of the Code of Virginia.

"Originating agency identifier" or "ORI" means a unique nine-character designation used to identify the agency that places records in the Virginia Criminal Information Network (VCIN).

"Seal" means to physically prevent access to a criminal history record, or portion of a criminal history record.

"Superintendent" means the chief administrative officer of the Virginia Department of State Police.

Part II
Criminal History Record Information Use

6VAC20-120-30. Applicability.

These regulations govern A. This chapter governs originals and copies of manual or automated criminal history record information which that are used, collected, stored, or disseminated by a state or local criminal justice agencies or other agencies receiving criminal history record information in the Commonwealth. The regulations This chapter also set sets forth the required procedures that ensure the proper processing of the expungement of criminal history record information. The provisions of this chapter apply to the following groups, agencies, and individuals:

1. State and local criminal justice agencies and subunits of these agencies in the Commonwealth; and

2. The United States Government or the government of another state or its political subdivisions which that exchange such information with criminal justice agencies in the Commonwealth, but only to the extent of that exchange;.

3. Noncriminal justice agencies or individuals who are eligible under the provisions of § 19.2-389 of the Code of Virginia to receive limited criminal history record information.

B. The provisions of this chapter do not apply to: (i) original or copied records of entry, such as police blotters maintained by a criminal justice agency on a chronological basis and permitted to be made public, but only if such records are not indexed or accessible by name; (ii) offense and dispatch records maintained by a criminal justice agency on a chronological basis and permitted to be made public, if such records are not indexed or accessible by name or do not contain criminal history record information; (iii) court records of public criminal proceedings, including opinions and published compilations thereof; (iv) records of traffic offenses disseminated to or maintained by the Department of Motor Vehicles for the purpose of regulating the issuance, suspension, revocation, or renewal of drivers' or other operators' licenses; (v) statistical or analytical records or reports in which individuals are not identified and from which their identities are not ascertainable; (vi) announcements of executive clemency; (vii) posters, announcements, or lists for identifying or apprehending fugitives or wanted persons; and (viii) criminal justice intelligence information; or criminal justice investigative information.

C. Nothing in this chapter shall be construed as prohibiting a criminal justice agency from disclosing to the public factual information concerning the status of an investigation,; the apprehension, arrest, release or prosecution of an individual,; the adjudication of charges,; or the correctional status of an individual, which is related to the offense for which the individual is currently within the criminal justice system.

6VAC20-120-40. Collection.

A. Responsibility. Responsibility for collecting and updating criminal history record information rests with:

1. State officials and criminal justice agencies having the power to arrest, detain, or hold convicted persons in correctional facilities;

2. Sheriffs of cities or counties;

3. Police officials of cities, counties, and towns;

4. Other local law-enforcement officers or conservators of the peace who have the power to arrest for a felony (see § 19.2-390 of the Code of Virginia);

5. Clerks of court and court agencies or officers of the court; and

6. Other criminal justice agencies or agencies having criminal justice responsibilities which generate criminal history record information.

B. Reportable offenses. The above officials listed in subsection A of this section and their representatives are required to submit to the Central Criminal Records Exchange, on forms provided by the Central Criminal Records Exchange, a report on every arrest they complete for:

1. Treason;

2. Felonies or offenses punishable as a misdemeanor under Title 54.1 18.2 of the Code of Virginia;

3. Class 1 and 2 misdemeanors under Title 18.2 except an arrest for a violation of Article 2 (§ 18.2-266 et seq.) of Chapter 7 of Title 18.2; a violation of Article 2 (§ 18.2-415 et seq.) of Chapter 9 of Title 18.2, or § 18.2-119; or a violation of any similar ordinance of a county, city or town.

In addition to those offenses enumerated above in this subsection, the Central Criminal Records Exchange may receive, classify, and file any other fingerprints and records of arrest or confinement submitted to it by any law-enforcement agency or correctional institution.

The chief of police, sheriff, or criminal justice agency head is responsible for establishing a system to ensure that arrest forms are completed and submitted in a timely and accurate fashion.

C. Timelines of submission.

1. Arrests. Arrest reports for all offenses noted above in subsection B of this section, except as provided in this section, and a fingerprint card for the arrested individual shall be forwarded to the Central Criminal Records Exchange in accordance with the time limits specified by the Department of State Police. A copy of the Central Criminal Records Exchange arrest form shall also be sent to the local court (a copy of the form is provided for the courts) at the same time.

The link between the arrest report and the fingerprint card shall be established according to Central Criminal Records Exchange requirements. Arrests that occur simultaneously for multiple offenses need only be accompanied by one fingerprint card.

2. Nonconvictions. For arrests except as noted in subdivision 3a below, the clerk of each circuit and district court shall notify the Central Criminal Records Exchange of the final action on a case. This notification must always be made no more than 30 days from the date the order is entered by the presiding judge.

3. 2. Convictions. a. For persons arrested and released on summonses under § 19.2-74 of the Code of Virginia, the chief law-enforcement officer or his designee, who may be the arresting officer, shall furnish a fingerprint cards card and a completed copy of the Central Criminal Records Exchange form to the Central Criminal Records Exchange. The form shall be completed immediately upon conviction unless an appeal is noted. In the case of an appeal, officials responsible for reporting the disposition of charges shall report the conviction within 30 days after final action of the case.

b. For arrests except as noted in subdivision 3 a above, the clerk of each circuit and district court shall notify the Central Criminal Records Exchange of the final action on a case. This notification must always be made no more than 30 days after occurrence of the disposition.

4. 3. Final disposition. State correctional officials shall submit to the Central Criminal Records Exchange the release status of an inmate of the state correctional system within 20 days of the release.

D. Updating and accuracy.

1. Arresting officers and court clerks noted above in subsection A of this section are responsible for notifying the Central Criminal Records Exchange in a timely fashion manner, and always within 30 days, of changes or errors and necessary corrections in arrests, convictions, or other dispositions, concerning arrests and dispositions that the criminal justice agency originated. In the case of correctional status or release information, correctional officials are responsible for notifying the Central Criminal Records Exchange within the same time limits of updates or changes in correctional status information. Forms for updating and correcting information are provided by the Central Criminal Records Exchange.

2. Each criminal justice agency is required to supply timely corrections of criminal history record information the agency has provided to a criminal justice or a noncriminal justice agency for a period of two years after the date of dissemination.

E. Locally maintained and nonreportable offenses. Criminal history record information generated by a criminal justice agency and maintained in a locally used and maintained file, including criminal history record information on offenses not required to be reported to the Central Criminal Records Exchange but maintained in local files, as well as criminal history record information maintained by the Central Criminal Records Exchange, shall adhere to the standards of collection, timeliness, updating, and accuracy as required by these regulations this chapter. Arrests shall be noted and convictions or adjudications recorded within 30 days of court action or the elapse of time to appeal.

F. Except as provided in §§ 15.2-1722, 16.1-299, and 19.2-390 of the Code of Virginia, nothing contained in this article shall be construed as requiring any criminal justice agency to collect, maintain, or update criminal history record information, as defined in § 9.1-101 of the Code of Virginia, when such information is already available and readily accessible from another criminal justice agency.

6VAC20-120-50. Dissemination.

A. Authorization.

1. No criminal justice agency or individual shall confirm or deny the existence or nonexistence of a criminal history record to persons or agencies that would not be eligible to receive the information. No dissemination of a criminal history record is to be made to a noncriminal justice agency or individual if an interval of one year has elapsed from the date of arrest and no disposition of the charge has been recorded and no active prosecution of the charge is pending.

2. Criminal history record information or portions of an individual's record both maintained and used by criminal justice agencies and eligible recipients, maintained either at the Central Criminal Records Exchange, or by the originating criminal justice agency, or both, shall only be disseminated as provided by § 19.2-389 of the Code of Virginia.

3. Upon receipt of a request for criminal history record information, by personal contact, mail, or electronic means from an agency or individual claiming to be authorized to obtain such information, the person responding to the request shall determine whether the requesting agency or individual is authorized to receive criminal history record information.

4. Criminal justice agencies shall determine what positions in their agency require regular access to criminal history record information as part of their the position's job responsibilities. These positions will be exempt from the dissemination rules below provisions of subsection B of this section. Use of criminal history record information by a member of a criminal justice agency not occupying a position authorized to receive criminal history record information, or for a purpose or activity other than one for which the person is authorized to receive criminal history record information, will be considered a dissemination and shall meet the provisions of this section. If the user of criminal history record information does not meet the procedures in subsection B of this section, the use of the information will be considered an unauthorized dissemination.

5. The release of criminal history record information to an individual or entity not included in § 19.2-389 [ of the Code of Virginia ] is unlawful and unauthorized. An individual or criminal justice agency that releases criminal history record information to a party which does not clearly belong to one of the categories of agencies and individuals authorized to receive the information as outlined in § 19.2-389 of the Code is subject to being denied access to state and national criminal history record information on a temporary or permanent basis and to the administrative sanctions described in 6VAC20-120-100. Unlawful dissemination contrary to the provisions of this chapter is also a Class 2 misdemeanor (see  § 9-195 9.1-136 of the Code of Virginia).

B. Procedures for responding to requests. A criminal justice agency disseminating criminal history record information shall adhere to the following regulations provisions:

1. Allowable responses to requests. Local and regional criminal justice agencies may respond to requests for criminal history record information in two ways:

a. For offenses required to be reported to the Central Criminal Records Exchange (CCRE), they may shall refer the requester to the Central Criminal Records Exchange, which will directly provide the requester with the information, or shall themselves query the Central Criminal Records Exchange to obtain the most accurate and complete information available and provide the information to the requester. (See § 19.2-389 of the Code of Virginia.)

It should be noted that the Code of Virginia provides an exception to the above mentioned procedure for responding to information requests. The local law-enforcement agency may directly provide criminal history record information to the requester without making an inquiry to the Central Criminal Records Exchange or referring the requester to the Central Criminal Records Exchange if the time is of the essence and the normal response time of the exchange would exceed the necessary time period. (See § 19.2-389 of the Code of Virginia.) Under circumstances where When an inquiry to the exchange is not made, the record provided by the local law-enforcement agency should be accompanied by an appropriate disclaimer indicating that the record may not be complete.

b. For nonreportable offenses (i.e., those offenses not reported to the Central Criminal Records Exchange), the law-enforcement agency shall provide the information requested, following the dissemination procedures as required by the regulations below subdivisions 2 through 8 of this subsection.

2. Prior to dissemination. Prior to disseminating criminal history record information a criminal justice agency shall:

a. Verify requester identity.

(1) Individual requester. For an individual requesting his own record and not known to the person responding to the request, the individual shall provide proper identification, to include at least two of the following, one of which must be a photo identification: (i) a valid passport, (ii) drivers' license with photo, (iii) social security card, (iv) birth certificate, or (v) military identification, or (vi) state issued identification card with photo, if there is more than one name match. Fingerprints or other additional information shall be required if the disseminating criminal justice agency deems it appropriate or necessary to ensure a match of the record and the requesting subject.

(2) Criminal justice agencies. For personnel of criminal justice agencies requesting a record, the requester shall provide valid agency identification unless the disseminator recognizes the requesting individual as having previously been authorized to receive the information for the same purpose.

(3) Noncriminal justice agencies or individuals. For an individual requesting the record of another, as in the case of an attorney requesting the record of his client, the individual shall provide a sworn written request from the record subject naming the requester as a recipient, as provided in subsection A of § 19.2-389A 19.2-389 of the Code of Virginia. The written request shall include the full name, date of birth, race, and sex of the record subject. Identification of the attorney or individual shall also be required unless the attorney or individual is known to the official responding to the request.

b. Verify record subject identity. Because serious harm could come from the matching of criminal history record information to the wrong individual, verification procedures shall be carefully managed, particularly when dissemination will be to noncriminal justice recipients. The following verification methods are the only acceptable methods information shall be reviewed to verify the record subject's identity:

(1) Individual requesters. The verification requirements for individuals requesting their own records and for individual requesters with sworn requests from the subject of the information shall be the same as the requirements for noncriminal justice agencies as described below. The full name, date of birth, race, and sex of the record subject. Fingerprint identification may be required prior to dissemination if there is any doubt as to the match. If a criminal justice agency does not have the capability to classify fingerprints, it may submit them by mail to the Central Criminal Records Exchange. Only when the information supplied and the information in the Central Criminal Records Exchange or local files satisfactorily match shall information be disseminated.

(2) Criminal justice agencies. Criminal history record information which reasonably corresponds to the name, aliases, and physical identity of the subject can be disseminated to a legitimate requester when time is of the essence or if criminal justice interests will be best served by the dissemination. This includes the dissemination of records with similar but not identical name spellings, similar physical characteristics, and similar but not identical aliases. When criminal history record information is obtained in this manner and results in an apparent match between the identity of the subject and the record, the criminal history record should be verified using fingerprint identification prior to prosecution, adjudication or sentencing of the record subject. If a criminal justice agency does not have the capability to classify fingerprints, it may submit them by mail to the Central Criminal Records Exchange.

(3) Noncriminal justice agencies. Full name, date of birth, race, and sex of the record subject must be provided by the requester for a criminal history record to be disseminated. Fingerprint identification may be required prior to dissemination if there is any doubt as to the match. If a criminal justice agency does not have the capability to classify fingerprints, it may submit them by mail to the Central Criminal Records Exchange. Information supplied by the requester and available through the Central Criminal Records Exchange (or in the local files where the request is for criminal history record information maintained only locally) must match to the satisfaction of the disseminator, or the dissemination shall not be made.

c. Notify requester of costs and restrictions. The official responsible for aiding the requester shall notify the requester of the costs involved and of restrictions generally imposed on use of the data, or be reasonably assured that the requester is familiar with the costs and restrictions, prior to beginning the search for the requested criminal history record information, and shall obtain the consent of the requester to pay any charges associated with the dissemination.

3. Locating and disseminating information requested. Once a request for a criminal history record has been made, and the responsible official is satisfied as to the legitimacy of the request and the identity of the subject and has informed the requester of costs and restrictions, the responsible official conducting the search for the record shall supply the information after querying the Central Criminal Records Exchange. However, if time is of the essence, or the offenses in a criminal history record are not required to be reported to Central Criminal Records Exchange, the responsible official may directly supply the information contained in the local files on offenses not required to be reported to the Central Criminal records Exchange (see § 19.2-389 of the Code of Virginia).

4. Instructions regarding dissemination to requesters. The disseminated record must be accompanied by one of the three following messages message "UNAUTHORIZED DISSEMINATION WILL SUBJECT THE DISSEMINATOR TO CRIMINAL AND CIVIL PENALTIES" in printed form, whichever matches the category of the requester for the following requesters:

a. Record subjects. Record subjects have a right to receive and disseminate their own criminal history record information, subject to these regulations this chapter and subdivision 11 of § 19.2-389(11) 19.2-389 of the Code of Virginia. If a record subject or his attorney complies with the requirements of these sections this section, he shall be given the requested criminal history record information. However, if an agency or individual receives a record from the record subject, that agency or individual shall not further disseminate the record. The following printed message shall accompany the criminal history record information disseminated to a record subject:

"UNAUTHORIZED DISSEMINATION WILL SUBJECT THE DISSEMINATOR TO CRIMINAL AND CIVIL PENALTIES."

b. Criminal justice agencies. The following printed message shall accompany the criminal history record information disseminated to a criminal justice agency:

"UNAUTHORIZED DISSEMINATION WILL SUBJECT THE DISSEMINATOR TO CRIMINAL AND CIVIL PENALTIES."

c. Noncriminal justice agencies and individuals other than record subjects. Even with the sworn consent of the record subject, only criminal history record information that is conviction data shall be disseminated to a noncriminal justice agency or an individual in compliance with the existing laws and shall not be disseminated further. The following printed message shall accompany the criminal history record information disseminated to an individual or a noncriminal justice agency receiving criminal history record information:

"UNAUTHORIZED DISSEMINATION WILL SUBJECT THE DISSEMINATOR TO CRIMINAL AND CIVIL PENALTIES."

5. Maintaining a dissemination log. A record of any dissemination all secondary disseminations shall be maintained at the disseminating criminal justice agency or shall be accessible electronically for a period of at least two years from the date of the dissemination.

The dissemination log must list all requests for criminal history record information. The log may be automated or manual.

Records will include the following information on each dissemination:

a. Date of inquiry;

b. Requesting agency name and address or the agency ORI;

c. Identifying name and number (either FBI or state identification number of record subject, or notification of "no record found");

d. Name of requester within the agency requesting criminal history record information; and

e. Name of disseminator (officer or civilian who provides the criminal history record information to the requester).

6. Reporting unauthorized disseminations. While individual criminal justice agencies are not expected to audit agencies who that receive criminal history record information that they provide, in order to identify unauthorized releases, they individual criminal justice agencies shall notify the department of any violations observed of the above dissemination regulations this section. The department will investigate and respond to the violation in a manner deemed appropriate by the department.

A criminal justice agency which that knowingly fails to report a violation may be subject to immediate audit of its entire dissemination log to ensure that disseminations are being appropriately managed.

7. Interstate dissemination. Interstate dissemination of criminal history record information shall be subject to the procedures described herein in this section. Dissemination to an agency outside of the Commonwealth shall be carried out in compliance with Virginia law and this chapter, as if the agency were within the jurisdiction of the Commonwealth.

8. Fees. Criminal justice agencies may charge a reasonable fee for search and copying time expended when dissemination of criminal history record information is requested by a noncriminal justice agency or an individual. The criminal justice agency shall post the schedule of fees to be charged, and shall obtain approval from the requester to pay such costs prior to initiating the search.

C. Limitations on use. Use of criminal history record information disseminated to noncriminal justice agencies shall be limited to the purposes for which the information was given and may not be disseminated further.

6VAC20-120-60. Access and review.

A. Who can review. An individual or his attorney, upon providing proper identification and in the case of an attorney representing a client, with a sworn written request from the record subject, shall have the right to inspect criminal history record information being maintained on that individual by the Central Criminal Records Exchange or other criminal justice agencies. Completing a request form may shall be required by the Central Criminal Records Exchange or the local criminal justice agency.

B. Review at local law-enforcement agency or central criminal records exchange.

1. An individual or his attorney may review the individual's criminal history record information arising from arrests for felonies and Class 1 and 2 misdemeanors maintained in the Central Criminal Records Exchange by applying at any law-enforcement agency with terminal capabilities on through a request to the Virginia Criminal Information Network or to the Central Criminal Records Exchange of the Virginia Department of State Police, during normal working hours. An individual or his attorney may review the individual's criminal history record regarding offenses not required to be reported to the Central Criminal Records Exchange at the arresting law-enforcement agency.

2. The law-enforcement agency to which the request is directed shall inform the individual or his attorney of the procedures associated with the review.

3. Individuals shall be provided, at cost, one copy of their record. If no record can be found, a statement shall be furnished to this effect.

C. Timeliness and completeness.

1. An individual requesting his own record shall be advised when the record will be available. In no case shall the time between request and availability of the record exceed one week, except where fingerprint identification is required; then it shall not exceed 30 days. Criminal justice agencies should seek to provide the record as soon as reasonably possible unless there are questions of identification.

2. The criminal justice agency locating an individual's criminal history record information shall examine its own files and shall contact the Central Criminal Records Exchange for the most up-to-date criminal history record information, and supply both the criminal history record information to the requester.

D. Assistance.

1. The criminal justice agency to which the request is directed shall provide reasonable assistance to the individual or his attorney to help understand the record.

2. The official releasing the record shall also inform the individual of his right to challenge the record.

6VAC20-120-70. Challenge.

A. Individuals who desire to challenge their own criminal history record information must complete documentation provided by the criminal justice agency maintaining the record and forward it to the Central Criminal Records Exchange or the criminal justice agency maintaining the record. A duplicate copy of the form and the challenged record may be maintained by the individual initiating the challenge or review. The individual's record concerning arrests for felonies and Class 1 and 2 misdemeanors may be challenged at the Central Criminal Records Exchange or the criminal justice agency maintaining the record of the Department of the State Police. For offenses not required to be reported to the Central Criminal Records Exchange, the challenge shall be made at the arresting law-enforcement agency or the criminal justice agency maintaining the records.

A challenge will be processed as described below.

A. Record B. A challenge to a record maintained by the Central Criminal Records Exchange. will be processed as follows:

1. Message flags. If the challenge is made of a record maintained by the Central Criminal Records Exchange, both the manual and the automated record shall be flagged with the message "CHALLENGED RECORD." A challenged record shall carry this message when disseminated while under challenge.

2. Review at exchange. The Central Criminal Records Exchange shall compare the information contained in the repository files as reviewed by the individual with the original arrest or disposition form. If no error is located, the Central Criminal Records Exchange (i) shall forward a copy of the challenge form, a copy of the Central Criminal Records Exchange record, and other relevant information to the criminal justice agency or agencies which the Central Criminal Records Exchange records indicate as having originated the information under challenge, and (ii) shall request them to examine the relevant files to determine the validity of the challenge.

3. Examination. The criminal justice agency or agencies responsible for originating the challenged record shall conduct an examination of their source data, the contents of the challenge, and information supplied by the Central Criminal Records Exchange for any discrepancies or errors, and shall advise the Central Criminal Records Exchange of the results of the examination.

4. Correction. If any modification of a Central Criminal Records Exchange record is required, the Central Criminal Records Exchange shall modify the record and shall then notify the criminal justice agency in which the record was originally reviewed of its action, and supply it and other agencies involved in the review with a copy of the corrected record.

5. Notification by Central Criminal Records Exchange. The Central Criminal Records Exchange shall also provide notification of the correction to all recipients of the record within the last 24 months.

6. Notification by other criminal justice agencies. Criminal justice agencies which that have disseminated an erroneous or incomplete record shall in turn notify agencies which that have received the disseminated record or portion of the record in the last two years from the date of the Central Criminal Records Exchange modifications of the records. Notification shall consist of sending a copy of the original record, and corrections made, to the recipients of the erroneous record noted in the dissemination log for the two-year period prior to the date of correction by the Central Criminal Records Exchange. (See § 9- 192 C 9.1-132 of the Code of Virginia.) The criminal justice agency in which the review and challenge occurred shall notify the individual or his attorney of the action of Central Criminal Records Exchange.

7. Appeal. The record subject or his attorney, upon being told of the results of his record review, shall also be informed of his right to review and appeal those results.

B. Record C. A challenge to a record maintained by a criminal justice agency other than the central Criminal Records Exchange. will be processed as follows:

1. Message flags. If a challenge is made of a record maintained by a criminal justice agency, both the manual and the automated record shall be flagged with the message "CHALLENGED RECORD." A disseminated record shall contain this message while under challenge.

2. Examination and correction agency. If the challenged record pertains to the criminal justice agency's arrest information, the arresting agency shall examine the relevant files to determine the vailidity validity of the challenge. If the review demonstrates that modification is in order, the modification shall be completed and the erroneous information destroyed. If the challenged record pertains to the disposition information, the arresting agency shall compare contents of the challenge with information originally supplied by the clerk of the court.

3. Review by Clerk clerk of Court court. If no error is found in the criminal justice agency's records, the arresting agency shall forward the challenge to the clerk of the court that who submitted the original disposition. The clerk of the court shall examine the court records pursuant to the challenge and shall, in turn, notify the arresting agency of its findings. The arresting agency shall then proceed as described in [ subsection ] B [ subdivision ] C 2 of this section.

4. Notification. The criminal justice agency in which the challenge occurred shall notify the individual or his attorney of the action taken, and shall notify the Central Criminal Records Exchange and other criminal justice agencies receiving the erroneous information of the necessary corrections if required, as well as the noncriminal justice agencies to which it has distributed the information in the last 24 months, as noted in its dissemination log.

5. Correction. The Central Criminal Records Exchange will correct its records, and notify agencies that received erroneous information within the past 24 months. The agencies will be requested to correct their files and to notify agencies which that have the disseminated information, as provided in [ subsection ] A [ subdivision ] B 6 of this section.

6. Appeal. The record subject or his attorney, upon receiving the results of the record review, shall be informed of the right to review and appeal.

C. D. Administrative review of challenge results.

1. Review by criminal justice agency head. After the aforementioned review and challenge, in accordance with this section, concerning a record either in the Central Criminal Records Exchange or another criminal justice agency, the individual or his attorney may, within 30 days, request in writing that the head of the criminal justice agency in which the challenge was made, review the challenge if the individual is not satisfied with the results of the review and challenge.

2. Thirty-day review. The criminal justice agency head or his designated official shall review the challenge by reviewing the action taken by the agency, the Central Criminal Records Exchange, and other criminal justice agencies, and shall notify the individual or his attorney in writing of the decision within 30 days of the receipt of the written request to review the challenge. The criminal justice agency head shall also notify the individual of the option to request an administrative appeal through the department within 30 days of the postmarked date of the notification of the decision. This notification of the appeal shall include the address of the Department of Criminal Justice Services.

3. Correction and notification. If required, correction and notification shall follow the procedures outlined in subsections A B and B C of this section.

4. Notification of the department. A copy of the notice required in subsection C subdivision D 2 of this section shall be forwarded to the department by the criminal justice agency at the same time it is provided to the individual.

D. E. Administrative appeal.

1. Departmental assessment. The individual or his attorney challenging his record, within 30 days of the postmark of his notification of the decision of the administrative review, may request that the Director of the Department of Criminal Justice Services review the challenge and conduct an informal hearing. The director may designate a hearing officer for this purpose.

2. Determination of merits of case. The director of or his designee shall contact the criminal justice agencies involved and request any and all information needed. Criminal justice agencies shall supply the information requested in a timely manner, to allow the department to respond to the individual within 30 days. The director will then rule on the merits of a hearing and notify the individual or his attorney that such hearing will or will not be held.

3. Hearing. The hearing, if held, shall be conducted within 30 days of the receipt of the request, and the decision of the hearing officer communicated to the individual or his attorney within 30 days of the hearing.

4. Finding. If the director or the hearing officer determines that correction and modification of the records are required, correction of the record and notification of all involved parties shall proceed according to the procedures outlined in subsections A B and B C of this section.

5. Removal of a challenge designation. When records and relevant action taken by the criminal justice agencies involved are deemed to be correct, the department shall notify the affected criminal justice agencies to remove the challenge designation from their files.

E. F. Department notification following corrections. For audit purposes, the Central Criminal Records Exchange shall annually forward the names and addresses of the agencies which that originated erroneous record information or received erroneous information from the exchange in that year to the Department of Criminal Justice Services.

6VAC20-120-80. Expungement and sealing.

A. Responsibility of the Superintendent of the Virginia Department of State Police. The expungement of a criminal history record or portion thereof is only permitted on the basis of a court order. Upon receipt of a court order, petition, and other supporting documents for the expungement of a criminal history record, the superintendent, pursuant to § 19.2-392.2 of the Code of Virginia, shall by letter with an enclosed copy of the order, direct the Central Criminal Records Exchange and those agencies and individuals known to maintain or to have obtained such a record, to remove the electronic or manual record or portion thereof from its repository and place it in a physically sealed, separate file. The file shall be properly indexed to allow for later retrieval of the record if required by court order, and the record shall be labeled with the following designation: "EXPUNGED RECORD TO BE UNSEALED ONLY BY COURT ORDER."

B. Responsibility of agencies with a record to be expunged. The record named in the Virginia Department of State Police's letter shall be removed from normal access. The expunged information shall be sealed but remain available, as the courts may call for its reopening at a later date. (See § 19.2-392.3 of the Code of Virginia.) Access to the record shall be possible only through a name index of expunged records maintained either with the expunged records or in a manner that will allow subsequent retrieval of the expunged record as may be required by the court or as part of the department's audit procedures. Should the name index make reference to the expunged record, it shall be apart from normally accessed files.

C. Procedure for expungement and sealing of electronic and hard copy records.

1. The expungement and sealing of hard copy original records of entry (arrest forms) is accomplished by physically removing them from a file, and filing them in a physically secure location elsewhere, apart from normally accessed files. This file should be used only for expunged records and should be accessible only to the manager of records.

2. If the information to be expunged is included among other information that has not been expunged on the same form or piece of paper, the expunged information shall be obliterated on the original or the original shall be retyped eliminating the expunged information. The expunged information shall then be placed in the file for expunged records, in its original or copied form, and shall be accessible only to the manager of records.

3. If the expunged information is located on a criminal history record provided by the Central Criminal Records Exchange (i.e., "RAP sheet"), the criminal history record information shall be destroyed, and a new copy, not containing the expunged data, shall be obtained when necessary.

D. Procedure for expunging automated records. Should the record to be expunged be maintained in an automated system, the Central Criminal Record Exchange or the agency known to possess such a record shall copy the automated record onto an off-line medium such as [ tape, disk hard disk drive, USB flash drive ], or hard copy printouts. The expunged record, regardless of the type of medium on which it is maintained, shall then be kept in a file used for expunged records and sealed from normal use, accessible only to the manager of records. No notification that expunged data exists shall be left in the normally accessed files.

Notwithstanding any other provisions of this section, any imaged case records maintained in any circuit court, general district court, or juvenile and domestic relations district court case imaging system operated by the Office of the Executive Secretary for the Supreme Court of Virginia that are to be expunged may be transferred to a confidential and secure area inaccessible from normal use within the case imaging system and shall be considered sealed. Access to the expunged, imaged case records shall be limited to the manager of records for the court with the exception of designated staff within the Office of the Executive Secretary who are responsible for the operation of such case imaging systems and have access to the confidential and secure area for the discrete purpose of providing the manager of the records access to the secure area. No notification that expunged data exists shall be left in the normally accessed case imaging system. Any related records that are maintained in an electronic order book shall also be deleted.

E. Department to be notified following expungement. Upon receipt of a request from the Virginia Department of State Police to expunge and seal a record, the affected agency or agencies shall perform the steps above of this section, and notify the Virginia Department of State Police of their action in writing within 120 60 days of their receipt of the request.

F. Expungement order not received by department. Should a court ordered expungement be directed to a criminal justice agency other than the Virginia Department of State Police, the directed criminal justice agency shall comply as outlined herein in this section and advise the superintendent without delay of such order. The superintendent shall, upon receipt of such notification, obtain a copy of the order from the appropriate circuit court.

6VAC20-120-100. Administrative sanctions.

Discovery of violations or failure to comply with this chapter in whole or in part will occasion the following sanctions. Additional criminal penalties and other sanctions may be invoked as provided in 6VAC20-120-50 should the violation involve an unauthorized dissemination.

A. 1. Law-enforcement agencies.

1. a. Should a law-enforcement agency fail to comply with this chapter, a letter will be forwarded by the Department department to either the chief of police or sheriff, citing the problem and notifying the police department or the sheriff's department that the matter will be referred to the chief official of the locality or local commonwealth's attorney, respectively, if a satisfactory result is not forthcoming. The criminal justice agency shall have 10 working business days to respond with a letter describing how the situation was remedied or explaining why there is no need to do so.

2. b. Should there be no satisfactory response after the 10 working business day period, the matter will be referred to the offices of the city, county, or town manager or the local commonwealth's attorney requesting resolution of the matter within 30 days.

3. c. If 30 days have passed and the matter fails to be resolved to the satisfaction of the department, the matter will be referred to the Criminal Justice Services Board and the Office of the Attorney General for action.

B. 2. Courts.

1. a. Should a court or officer of the court fail to comply with these regulations this chapter, a letter will be forwarded by the department to the court, citing the problem and notifying the court clerk that the matter will be referred to the chief judge of the locality and the local commonwealth's attorney if a satisfactory result is not forthcoming. The court shall have 10 working business days to respond with a letter describing how the situation was remedied or explaining why there is no need to do so.

2. b. Should there be no satisfactory response after the 10 working business day period, the matter will be referred to the chief judge requesting resolution of the matter within 30 days. The Executive Secretary of the Supreme Court of Virginia will also be notified.

3. c. If 30 days have passed and the matter fails to be resolved to the satisfaction of the department, the matter will be referred to the Criminal Justice Services Board and the Chief Justice of Virginia.

Part III
Criminal History Record Information Security

6VAC20-120-110. Applicability.

These regulations are A. This chapter is applicable to criminal justice information systems operated within the Commonwealth of Virginia. These regulations on security are not applicable to court records or other records expressly excluded by § 9-184, B 9.1-126 of the Code of Virginia.

These regulations establish B. This part establishes a minimum set of security standards which that shall apply to any manual or automated recordkeeping system which that collects, stores, processes, or disseminates criminal history record information.

C. Where individuals or noncriminal justice agencies are authorized to have direct access to criminal history record information pursuant to a specific agreement with a criminal justice agency to provide service required for the administration of criminal justice, the service support agreement will embody the restrictions on dissemination and the security requirements contained in these regulations this chapter and the Code of Virginia.

6VAC20-120-120. Responsibilities.

A. In addition to those responsibilities mandated by state and federal laws, the Department of State Police shall have the responsibility for the implementation of these regulations this chapter in regard to the operation of the Central Criminal Records Exchange.

B. The implementation of these regulations this chapter, except as set forth in [ the ] above paragraph subsection A of this section, shall be the responsibility of the criminal justice agency as designated and authorized by the county or municipality in cases of political subdivisions. Nothing in these regulations this chapter shall be deemed to affect in any way the exercise of responsibility conferred on counties and municipalities of the state under Title [ 15.1 15.2 ] of the Code of Virginia. The determination of the suitability of the actual procedures instituted by the criminal justice agency will be the subject of study in any audit by the department, mandated by § 9-186 9.1-131 of the Code of Virginia.

6VAC20-120-130. Physical access.

A. Access to areas in which criminal history record information is collected, stored, processed, or disseminated shall be limited to authorized persons. Control of access shall be ensured through the use of locks, guards, or other appropriate means. Authorized personnel shall be clearly [ indentified identified ].

B. Procedures shall be established to detect an unauthorized attempt or access. Furthermore, a procedure shall be established to be followed in those cases in which an attempt or unauthorized access is detected. Such procedures shall become part of the orientation of employees working in criminal history record information area(s) area or areas and shall be reviewed periodically to ensure their effectiveness.

C. Criminal justice agencies shall provide direct access to criminal history record information only to authorized officers or employees of a criminal justice agency and, as necessary, other authorized personnel essential to the proper operation of the criminal history record information system.

D. Criminal justice agencies shall institute, where computer processing is not utilized, procedures to ensure that an individual or agency authorized to have direct access is responsible for: (i) the physical security of criminal history record information under its control or in its custody, and (ii) the protection of such information from unauthorized access, disclosure, or dissemination.

E. Procedures shall be instituted to protect any central repository of criminal history record information from unauthorized access, theft, sabotage, fire, flood, wind, or other natural or man-made disasters.

F. For criminal justice agencies that have their criminal history files automated, it is highly recommended that "backup" copies of criminal history information be maintained, preferably off-site. Further, for larger criminal justice agencies having automated systems, it is recommended that the criminal justice agencies develop a disaster recovery plan. The plan should be available for inspection and review by the department.

G. System specifications and documentation shall be carefully controlled to prevent unauthorized access and dissemination.

6VAC20-120-140. Personnel.

In accordance with applicable law, ordinances, and regulations, the criminal justice agency shall:

A. 1. Screen and have the right to reject for employment, based on good cause, personnel to be authorized to have direct access to criminal history record information;

B. 2. Have the right to initiate or cause to be initiated administrative action leading to the transfer or removal of personnel authorized to have direct access to this information where these personnel violate the provisions of these regulations this chapter or other security requirements established for the collection, storage, or dissemination of criminal history record information; and

C. 3. Ensure that all employees working with or having access to criminal history record information shall be made familiar with the substance and intent of these regulations this chapter. Designated employees shall be briefed on their roles and responsibilities in protecting the information resources in the criminal justice agency. Special procedures connected with security shall be reviewed periodically to ensure their relevance and continuing effectiveness.

6VAC20-120-160. Computer operations.

A. Where computerized data processing is employed, effective and technologically advanced software and hardware design shall be instituted to prevent unauthorized access to this information.

B. Computer operations, whether dedicated or shared, which that support criminal justice information systems shall operate in accordance with procedures developed or approved by the participating criminal justice agencies.

C. Criminal history record information shall be stored by the computer in such a manner that it cannot be modified, destroyed, accessed, changed, purged, or overlaid in any fashion by noncriminal justice terminals.

D. Operational programs shall be used that will prohibit inquiry, record updates, or destruction of records, from terminals other than criminal justice system terminals which that are so designated.

E. The destruction of record shall be limited to designated terminals under the direct control of the criminal justice agency responsible for creating or storing the criminal history record information.

F. Operational programs shall be used to detect and log all unauthorized attempts to penetrate criminal history record information systems, programs, or files.

G. Programs designed (i) for the purpose of prohibiting unauthorized inquiries, unauthorized record updates, or unauthorized destruction of records, or (ii) for the detection and logging of unauthorized attempts to penetrate criminal history record information systems shall be known only to the criminal justice agency employees responsible for criminal history record information system control or individuals and agencies pursuant to a specific agreement with the criminal justice agency to provide such security programs. The program(s) program or programs shall be kept under maximum security conditions.

H. Criminal justice agencies having automated criminal history record files should shall designate a system administrator to maintain and control authorized user accounts, system management, and the implementation of security measures.

I. The criminal justice agency shall have the right to audit, monitor, and inspect procedures established pursuant to these rules and regulations this chapter.