http://foia.fbi.gov/vaf.htm
FEDERAL BUREAU OF INVESTIGATION
PRIVACY IMPACT ASSESSMENT (PIA)
NICS - Voluntary Appeal File (VAF)
January 6, 2006
I. BACKGROUND
This PIA is conducted pursuant to the E-Government Act of 2002, P.L. 107-347, the accompanying guidelines issued by the Office of Management and Budget (OMB) on September 26, 2003, and the FBI's PIA guidelines.
In November 1993, the Brady Handgun Violence Prevention Act (Brady Act) was signed into law. [1] The Brady Act required that federal firearms licensees conduct background checks on individuals attempting to purchase firearms. The permanent provisions of the Brady Act, which became effective November 30, 1998, required the Attorney General to establish the National Instant Criminal Background Check System (NICS). NICS is a national name check system that queries available records in the National Crime Information Center (NCIC), the Interstate Index (III), and the NICS Index to determine if prospective purchasers are disqualified from receiving firearms. NICS provides federal firearms licensees with an immediate determination as to whether the transfer of a firearm may proceed or if more research is required to determine whether the transfer would violate federal or state law. Firearms purchasers who are denied may request the reason for the denial and may challenge the accuracy of the record upon which the denial is based. [2]
Pursuant to a final rule published on July 20, 2004, the NICS must destroy identifying information by or on behalf of any person who has been determined not to be prohibited from receiving a firearm no more than twenty four (24) hours after the system advises a federal firearms licensee that the transfer would not violate the Brady Act. [3] Accordingly, NICS must destroy all identifying information on allowed transactions prior to the start of the next business day. If a potential purchaser is delayed or denied a firearm and successfully appeals the decision, NICS cannot retain the record of the appeal or the supporting documentation. To that end, individuals who wish to make subsequent purchases may be delayed or denied again until the record has been re-reviewed or until the purchaser has appealed the denial by resubmitting the same documentation/information. In order to prevent future delays or erroneous denials, the final rule permits lawful transferees to request that NICS maintain information about themselves in a
Voluntary Appeal File (VAF), a separate computer file that will be checked by NICS.
The NICS has developed a brochure which fully explains Brady Act requirements and includes a VAF application. Through the VAF application, potential purchasers will have the option to request that the NICS maintain personal identifying information about them which would otherwise be destroyed. This information includes, but is not limited to, fingerprint cards, [4] photographs, court documentation, correspondence, and information contained in the applicant’s appeal file if one exists. [5] The VAF permits applicants to voluntarily submit personal identifying information for the limited purpose of clarifying existing records or proving identity.
On November 12, 2004, the FBI submitted the VAF information request to the Office of Management and Budget (OMB) for notice and public comment. [6]
II. ASSESSMENT
A. What information is being collected?
The VAF contains information voluntarily submitted by firearms purchasers via the VAF application. Purchasers have the option of supplying the NICS with personal identifying information such as their name, sex, race, height, weight, sex, date of birth, alien registration number, and social security number. Further, purchasers have the option of supplying other identifying numbers such as military identification numbers, driver license numbers, FBI numbers and state identification numbers. Documents or information which clarify records or prove identity (e.g., fingerprint cards, photographs, court records, pardons, etc.) are entered into the VAF. Paper copies are retained and filed accordingly by the NICS.
B. Why is the information being collected?
The information is being collected for the limited purpose of providing applicants with a means by which they can submit information to the VAF to prevent future erroneous denials or extended delays of firearms purchases or transfers.
C. What is the intended use of the information?
Because the final rule mandates that the NICS destroy all identifying information on allowed transactions within twenty four (24) hours, applicants who are delayed or denied a firearm purchase, and who successfully appeal the denials, would be required to resubmit documentation/information for every subsequent firearms purchase without the VAF. The VAF permits individuals to submit documentation which proves or clarifies identity. Upon receipt of a VAF application, NICS staff conducts research to determine whether an applicant has a disqualifying record which would prohibit the applicant from purchasing a firearm. NICS employees input the results of the research in the "comments and hit" summary field. The hit and comment summary includes NCIC, III, NICS, and ICE hits. Non-identifiable and identifiable hits are duly noted in the VAF. If the NICS determines that there is no disqualifying information which would prevent the applicant from purchasing the firearm and validates the information supplied by the applicant, the application is approved and the applicant is assigned a Unique Personal Identification Numbers (UPIN). NICS notifies these applicants in writing. NICS retains paper files of the other data submitted by successful applicants. NICS notifies unsuccessful applicants that their applications have been denied via letter. Other data submitted by unsuccessful applicants are destroyed. [7] However, the NICS may retain records as long as needed to pursue cases of identified misuse of the system.
D. With whom will the information be shared?
FBI personnel (Legal Instruments Examiners, Program Analysts, Supervisors, Management Staff) and state points of contact have access to the information in the VAF for the purpose of conducting NICS checks. [8] State points of contact are able to obtain a numeric and alphabetic list of entrants in the VAF through Law Enforcement Online (LEO). Access is "read-only" for all users with the exception of NICS staff responsible for adding/deleting information from the VAF. Information may be disclosed in accordance with applicable regulations and routine uses.
E. What opportunities will individuals have to decline to provide information or to consent to particular uses of the information?
Submission of information to the VAF is strictly voluntary. Successful applicants who have supplied information and who wish to have the information removed may make a written request to have the information removed. Upon receipt, the NICS will destroy all documentation/information entered in the VAF. However, the FBI may retain records as long as needed to pursue cases of identified misuse of the system. [9]
F. How will the information be secured?
Until the VAF becomes an integrated part of the NICS computer system, the NICS is using a VAF prototype which resides in a separate electronic system folder. The folder is solely accessible to employees within the NICS and select NICS staff have modification privileges. Authorized users have "read only" access. Physical security protections include guards and locked facilities requiring badges and passwords for access. Records are accessed by authorized government personnel and are protected by appropriate physical and technological safeguards to prevent unauthorized access.
During the implementation stage, federal, state and local law enforcement agencies that seek access to records located in the VAF obtain VAF information through LEO via password. [10]
VAF information is contained within a closed special interest group. Federal, state and local points of contact must specifically request entry into the special interest group. Three (3) members, two (2) program analysts and one (1) liaison of the NICS staff approve membership applications to the special interest group. Currently, state and local law enforcement agencies who query the VAF database via LEO are able to view a listing of all VAF participants. NICS advised that, in order to restrict access in LEO, the NICS would have to expend between $ 500,000 and $ 1,000,000. The NICS advised that such an expenditure would impact the NICS' other current high priority operations and maintenance efforts. Thus, the NICS' advises that restricting access to individualized queries in LEO is not feasible at this time.
In CY 2006, the VAF will become an integrated part of the NICS computer system. The NICS advises that queries in the VAF will limited to individualized queries at that time. Information maintained in the NICS is stored electronically in a secure FBI computer environment. [11] Access to information in the NICS is restricted to authorized personnel of federal, state, and local law enforcement agencies. [12] These agencies must have adequate physical security to protect against any unauthorized personnel gaining access to computer equipment. [13] Further, employees who have access to NICS information must be thoroughly screened. [14]
G. Is this a system of records?
Yes, the VAF contains personally identifiable information regarding individuals and information is retrieved by name or personal identifier. The NICS Privacy Act system notice is being amended to reflect the VAF. [15]
H. What choices did the FBI make regarding an IT system or collection of information as a result of performing the PIA?
NICS has determined that the collection of information is necessary to prevent delays and denials of firearms purchases. Thus, there is no reasonable alternative to the VAF. Applicants to the VAF voluntarily submit personal identifying information which is verified and retained by NICS for the limited purpose of facilitating the purchase of firearms. Applicants who submit this information may request in writing that the information be removed from the VAF. Thus, the VAF does not involve any new collection techniques or processes that may be controversial or invasive of personal privacy.
As a result of conducting the PIA, the Senior Privacy Official [16] determined that the fact that state and local law enforcement agencies who query the VAF database via LEO are able to view a listing of all VAF participants created limited privacy risks. The Senior Privacy Official discussed this issue with the NICS and the NICS advised that because of the tremendous costs associated with restricting access in LEO, it is unable to restrict access at this time. The Senior Privacy Official determined that because access to the VAF, via LEO is temporary, and because access will be restricted once the VAF becomes part of the NICS computer system, the privacy risks associated with access to VAF information via LEO are sufficiently mitigated.
III. APPROVAL
The FBI's Senior Privacy Official has reviewed this system for privacy policy issues, perceives no unusual privacy concerns at stake here, and approves the FBI's implementation of this system. Specifically, applicants to the VAF voluntarily submit personal identifying information which is verified and retained by NICS for the limited purpose of facilitating the purchase of firearms. Applicants who submit this information may request in writing that the information be removed from the VAF. The dissemination of the information is limited to legitimate purposes in compliance with allowable disclosures for information contained in the NICS system of records. Further, information submitted to the VAF is verified by NICS personnel who contact the contributing agencies to verify that information is accurate. Moreover, NICS verifies data by performing scheduled assessments and audits. Ultimately, the VAF is a simple system containing routine information which is voluntarily submitted and involves limited use and access. A new Privacy Act systems notice is not required, but the NICS notice will be amended to reflect the VAF.
[1] 18 U.S.C. § 923 (2004).
[2] 28 C.F.R. § 25.10(a), (c) (2004).
[3] National Instant Criminal Background Check System Regulation, 69 FR 43892 (July 23, 2004) (to be codified at 28 C.F.R. pt. 25).
[4] Fingerprint impressions must be prepared by a law enforcement agency who must stamp their agency name, address, and telephone number in the designated area.
[5] NICS maintains paper copies of information submitted for entry into the VAF.
[6] Sixty (60) Day Emergency Notice of Collection Under Review Voluntary Appeal File, 69 Fed. Reg. 65455 (proposed Nov. 12, 2004). On May 2, 2005, the FBI resubmitted the VAF information request to OMB for public comment. See Thirty (30) Day Notice of Information Collection Under Review, 70 Fed. Reg. 22704 (proposed May 2, 2005). The notice provided an additional thirty (30) days for public comment. See id.
[7] NICS returns fingerprint cards to unsuccessful applicants.
[8] The folder is also accessible to information technology personnel who provide technical support to the NICS.
[9] 25 C.F.R. § 25.10(g).
[10] Access to LEO is subject to FBI approval. LEO is accessed via password and all network traffic is monitored and recorded by personnel authorized by the FBI.
[11] 28 C.F.R. § 25.8(a)-(b).
[12] 28 C.F.R. § 25.8(c)(1)-(5),(d)(1)-(3).
[13] Id.
[14] Id.
[15] See 63 FR 30514 (June 4, 1998).
[16] This position is currently held by Deputy General Counsel Patrick W. Kelley.
