Code of Federal Regulations Title 28. Judicial Administration § 28.22.23 Privacy certification

(1) Data identifiable to a private person will not be used or revealed, except as authorized under §§ 22.21, 22.22.

(2) Access to data will be limited to those employees having a need therefore and that such persons shall be advised of and agree in writing to comply with these regulations.

(3) All subcontracts which require access to identifiable data will contain conditions meeting the requirements of § 22.24.

(4) To the extent required by § 22.27 any private persons from whom identifiable data are collected or obtained, either orally or by means of written questionnaire, shall be advised that the data will only be used or revealed for research or statistical purposes and that compliance with requests for information is not mandatory. Where the notification requirement is to be waived, pursuant to § 22.27(c), a justification must be included in the Privacy Certificate.

(5) Adequate precautions will be taken to insure administrative and physical security of identifiable data.

(6) A log will be maintained indicating that identifiable data have been transmitted to persons other than BJA, OJJDP, BJS, NIJ, or OJP or grantee/contractor staff or subcontractors, that such data have been returned, or that alternative arrangements have been agreed upon for future maintenance of such data.

(7) Project plans will be designed to preserve anonymity of private persons to whom information relates, including, where appropriate, name-stripping, coding of data, or other similar procedures.

(8) Project findings and reports prepared for dissemination will not contain information which can reasonably be expected to be identifiable to a private person except as authorized under § 22.22.