Approved: CALEA Effective Date: July 5, 2013 CHAPTER 8 – SUPPORT SERVICES Protected Information 812.1 PURPOSE AND SCOPE The purpose of this policy is to provide guidelines for the access, transmission, release and security of protected information by members of the Burbank Police Department. This policy addresses the protected information that is used in the day-to-day operation of the Department and not the public records information covered in the Records Maintenance and Release Policy. 812.1.1 DEFINITIONS Protected information - Any information or data that is collected, stored or accessed by members of the Burbank Police Department and is subject to any access or release restrictions imposed by law, regulation, order or use agreement. This includes all information contained in federal, state or local law enforcement databases that is not accessible to the public Criminal Offender Record Information (CORI) – Shall include CII manual/automated rap sheets and abstracts, CII crime summaries, CII criminal history transcripts, FBI rap sheets, and any BPD documents containing a list of prior arrests. Criminal Justice Agency – A public agency or component thereof which performs a criminal justice activity as its principal function. Authorized Recipient – Any person or agency authorized by court order, statute or case law to receive CORI. Right to Know – Persons or agencies authorized by court order, statute or decisional case law to receive the information. Need to Know – A necessity exists to obtain CORI in order to execute official responsibilities. Members of the Burbank Police Department will adhere to all applicable laws, orders, regulations, use agreements and training related to the access, use, dissemination and release of protected information. 812.2 policy Members of the Burbank Police Department will adhere to all applicable laws, orders, regulations, use agreements and training related to the access, use, dissemination and release of protected information. 812.3 AUTHORITY This policy is established pursuant to the mandate of the Regulations Regarding Security of Criminal Offender Record Information in California, Title 11, California Code of Regulations. Other authority includes Penal Code §11105, which delineates who has access to Criminal Offender Record Information (CORI), and Penal Code §11140 through §11144, which establishes penalties for the improper use of rap sheets. 812.4 Responsibilities The Records Manager is designated to coordinate the use of protected information. His/her responsibilities include, but are not limited to: Ensuring member compliance with this policy and the requirements applicable to protected information, including requirements for the national Crime Information Center (NCIC) system, National Law Enforcement Telecommunications System (NLETS), Department of Motor vehicles (DMV) records and California Law Enforcement Telecommunications Systems (CLETS). Developing, disseminating and maintaining procedures that adopt or comply with the U.S. Department of Justice’s current Criminal Justice Information Services (CJIS) Security Policy. See the Burbank Police Department CJIS Access, Maintenance, and Security Policy for additional guidance. Developing, disseminating and maintaining any other procedures necessary to comply with any other requirements for access, use, dissemination, release and security of protected information. Developing procedures to ensure training and certification requirements are met. Resolving specific questions that arise regarding authorized recipients of protected information. Ensuring security practices and procedures are in place to comply with requirements applicable to protected information. 812.5 Access to protected information Protected information shall not be accessed in violation of any law, order, regulation, user agreement, Burbank Police Department policy or training. Only those members who have completed applicable training and have met any applicable requirements, such as a background check/fingerprints, may access protected information, and only when the member has a legitimate work-related reason for such access (right to know/need to know). Unauthorized access, including access for other than a legitimate work-related purpose, is prohibited and may subject a member to administrative action pursuant to the Personnel Complaints Policy and/or criminal prosecution. The California Department of Justice has issued a list of agencies authorized to receive criminal history information. Persons not included in the Department of Justice list are not authorized recipients and shall not receive CORI. 812.5.1 PENALTIES FOR MISUSE OF RECORDS It is a misdemeanor to furnish, buy, receive or possess Department of Justice criminal history information without authorization by law (Penal Code § 11143). Authorized persons or agencies violating state regulations regarding the security of Criminal Offender Record information maintained by the California Department of Justice may lose direct access to CORI (11 CCR 702). Divulging the content of any criminal record to anyone other than authorized personnel is a violation of the Conduct Policy (§340.3.7(a)). Employees who obtain, or attempt to obtain, information from the department files other than that to which they are entitled in accordance with their official duties is a violation of the Conduct Policy (§340.3.7(a)). 812.6 release or dissemination of protected information Protected information may be released only to authorized recipients who have both a right to know and a need to know. A member who is asked to release protected information that should not be released should refer the requesting person to a supervisor or to the Records Manager for information regarding a formal request. Only the persons listed below are authorized to release CORI. Each authorized person releasing CORI is responsible to ensure that each request granted appears legitimate and that the requester is an authorized recipient with a right and need to know. (a) Records Administrator. (b) Records Supervisors. (c) Records Bureau personnel. (d) Detective Bureau personnel (e.g. providing CORI to District Attorney’s Office/City Attorney’s Office when filing cases) Unless otherwise ordered or when an investigation would be jeopardized, protected information maintained by the Department may generally be shared with authorized persons from other law enforcement agencies who are assisting in the investigation or conducting a related investigation. Any such information should be released through the Records Bureau when applicable. 812.6.1 REVIEW OF CRIMINAL OFFENDER RECORD Individuals requesting to review their own California criminal history information shall be referred to the Department of Justice (Penal Code § 11121). Individuals wishing to review their local summary criminal history information compiled by the Department must make an application to do so as determined by the Records Manager and may have to submit to fingerprinting to verify their identity (Penal Code § 13321). The Department may require the application be accompanied by a fee not to exceed twenty-five dollars ($25.00) (Penal Code § 13322). Once an application is received and the applicant’s identity verified, the Records Manager or designee shall determine whether a record pertaining to the applicant is maintained. If such record is maintained, the Records Manager or designee shall at his/her discretion either inform the applicant by mail of the existence of the record and specify a time when the record may be examined at a suitable facility of the agency or shall mail the subject a copy of the record (Penal Code § 13323). 812.6.2 TRANSMISSION GUIDELINES Protected information, such as restricted Criminal Justice Information (CJI), which includes Criminal History Record Information (CHRI), should not be transmitted via unencrypted radio. When circumstances reasonably indicate that the immediate safety of officers, other department members, or the public is at risk, only summary information may be transmitted. In cases where the transmission of protected information, such as Personally Identifiable Information, is necessary to accomplish a legitimate law enforcement purpose, and utilization of an encrypted radio channel is infeasible, a MDT or department-issued cellular telephone should be utilized when practicable. If neither are available, unencrypted radio transmissions shall be subject to the following: Elements of protected information should be broken up into multiple transmissions, to minimally separate an individual’s combined last name and any identifying number associated with the individual, from either first name or first initial. Additional information regarding the individual, including date of birth, home address, or physical descriptions, should be relayed in separate transmissions. Nothing in this policy is intended to prohibit broadcasting warrant information. 812.7 security of protected information The Records Manager is the designated Criminal Record Security Officer for the Burbank Police Department. The responsibilities of this position include, but are not limited to: Developing and maintaining security practices, procedures and training for records. Ensuring federal and state compliance with CJIS Security Policy and the requirements of any state or local criminal history records systems. Working with Department IT, as needed, to establish procedures to provide for preparation, prevention, detection, analysis and containment of security incidents including computer attacks. Tracking, documenting and reporting all breach of security incidents to the Chief of Police and appropriate authorities. 812.7.1 MEMBER RESPONSIBILITIES Members accessing or receiving protected information shall ensure the information is not accessed or received by persons who are not authorized to access or receive it. This includes leaving protected information, such as documents or computer databases, accessible to others when it is reasonably foreseeable that unauthorized access may occur (e.g., on an unattended table or desk; in or on an unattended vehicle; in an unlocked desk drawer or file cabinet; on an unattended computer terminal). 812.8 JUVENILE RECORDS The Records Manager and/or designee is responsible for having a system that specifically identifies juvenile criminal and identification records from adult criminal records to prevent unauthorized access and release. Nothing in this policy is intended to alter existing statutes, case law, or the policies and orders of the Juvenile Court regarding the release of juvenile offender records. Refer to the Temporary Custody of Juveniles Policy for more specific information regarding cases involving juveniles. The Records Manager and/or designee shall be responsible for the sealing or expungement of juvenile records when ordered by the court as follows: Pull the report, inmate booking file, and all related records. If the subject referenced in the court order is the only person listed on the report, remove the entire report and all records from the physical file and RMS. Destroy all expunged records; place sealed records in a sealed envelope and store in the designated secure location. If other parties are listed in the report, redact the listed juveniles from the physical report and RMS, and return the redacted physical file to the designated secure location. Send documentation to the juvenile court, advising of action taken in accordance with the court order. Disposal of all sealed records in accordance with the approved retention schedule. 812.9 PROTECTION OF CORI CORI records are not stored in or by the Records Bureau. Investigators who may have CORI records in the case files shall purge such records upon the closure of the case. 812.9.1 COMPUTER TERMINAL SECURITY Computer terminal equipment capable of providing access to automated criminal offender record information is not to be accessed by unauthorized persons. Users with authorized access to CORI at independent work stations shall ensure the security of CORI by not leaving any access point unattended (after entering user name and password). No employee shall be authorized to operate computer terminal equipment with access to CORI until the operator has completed the appropriate training. 812.9.2 DESTRUCTION OF CORI When any document providing CORI has served the purpose for which it was obtained, it shall be destroyed by shredding. Each employee shall be responsible for destroying the CORI documents they receive. 812.10 CUSTODIAN OF CRIMINAL RECORDS The Records Manager and/or designee, unless otherwise directed by the Support Services Commander, shall be the Department's official Custodian of Criminal Records. The Custodian of Criminal Records shall be responsible for the security, storage, dissemination and destruction of criminal records, and will serve as a primary contact for the California Department of Justice for any related issues. The Support Services Division Commander may appoint other department employees to the role of Custodian of Criminal Records, who will share the same responsibilities regarding criminal records. The Support Services Division Commander will ensure that he/she makes the appropriate applications and notifications to the California Department of Justice regarding the Department's Custodian of Criminal Record appointments, per the requirements of Penal Code §11102.2. This subsection is not intended to interfere with any other employee acting as a custodian of records for other statutory purposes but is narrowly tailored to address issues of criminal history records. 812.11 california religious freedom act Members shall not release personal information from any agency database for the purpose of investigation or enforcement of any program compiling data on individuals based on religious belief, practice, affiliation, national origin or ethnicity (Government Code § 8310.3). 812.12 TRAINING All members authorized to access or release protected information shall complete a training program that complies with any protected information system requirements and identifies authorized access and use of protected information, as well as its proper handling and dissemination (e.g. CLETS re-certification Exam, Security Awareness Test).