LIS

Administrative Code

Virginia Administrative Code
11/6/2024

Chapter 120. Regulations Relating to Criminal History Record Information Use and Security

Part I
General

6VAC20-120-10. (Repealed.)

Historical Notes

Derived from VR240-02-1, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; repealed, Virginia Register Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-20. Definitions.

The following words and terms, when used in this chapter, shall have the following meanings, unless the context clearly indicates otherwise.

"Access" means the ability to obtain, directly or through an intermediary, criminal history record information contained in manual or automated files.

"Board" means the Criminal Justice Services Board, as defined in § 9.1-108 of the Code of Virginia.

"Central Criminal Records Exchange" means the repository in this Commonwealth that receives, identifies, maintains, and disseminates individual criminal history records, in accordance with Chapter 23 (§ 19.2-387 et seq.) of Title 19.2 of the Code of Virginia.

"Challenge" means an individual's objection to his criminal history record information.

"Conviction data" means information in the custody of any criminal justice agency relating to a judgment of conviction, and the consequences arising therefrom, in any court.

"Correctional status information" means records and data concerning each condition of a convicted person's custodial status, including probation, confinement, work release, study release, escape, or termination of custody through expiration of sentence, parole, pardon, or court decision.

"Criminal history record information" means records and data collected by criminal justice agencies on adult individuals consisting of identifiable descriptions and notations of arrests, detentions, indictments, information, or other formal charges and any disposition arising therefrom. The term shall not include juvenile record information which is controlled by §§ 16.1-299 and 19.2-389.1 of the Code of Virginia, criminal justice investigative information, or correctional status information.

"Criminal history record information area" means any office, room, or space in which criminal history record information is regularly collected, processed, stored, or disseminated to an authorized user. This area includes computer rooms, computer terminal workstations, file rooms, and any other rooms or space in which those activities are carried out.

"Criminal intelligence information" means data that has been evaluated and determined to be relevant to the identification and criminal activity of individuals or organizations that are reasonably suspected of involvement in criminal activity. Criminal intelligence information shall not include criminal investigative files.

"Criminal investigative information" means information on identifiable individuals compiled in the course of the investigation of specific criminal acts.

"Criminal justice agency" means a court or any other governmental agency or subunit thereof that as its principal function performs the administration of criminal justice and any other agency or subunit thereof that performs criminal justice activities.

"Criminal justice information system" means a system, including the equipment, facilities, procedures, agreements, and organizations thereof, that is used for the collection, processing, preservation, or dissemination of criminal history record information. The operations of the system may be performed manually or by using electronic computers or other automated data processing equipment.

"Department" means the Department of Criminal Justice Services.

"Destroy" means to totally eliminate and eradicate by various methods, including, but not limited to, shredding, incinerating, or pulping.

"Director" means the chief administrative officer of the department.

"Dissemination" means any transfer of information, whether orally, in writing, or by electronic means. The term does not include access to the information by officers or employees of a criminal justice agency maintaining the information who have both a need and a right to know the information.

"Expunge" means to remove, in accordance with a court order, a criminal history record or a portion of a record from public inspection or normal access.

"Modify" means to add or delete information from a record to accurately reflect the reported facts of an individual's criminal history record. (See § 9.1-132 of the Code of Virginia.) This includes eradicating, supplementing, updating, and correcting inaccurate and erroneous information.

"Noncriminal justice agencies or individuals" means those agencies or individuals authorized to receive limited criminal history record information pursuant to a specific agreement with a criminal justice agency under the provisions of subsection A of § 19.2-389 of the Code of Virginia.

"Originating agency identifier" or "ORI" means a unique nine-character designation used to identify the agency that places records in the Virginia Criminal Information Network (VCIN).

"Seal" means to physically prevent access to a criminal history record or portion of a criminal history record.

"Superintendent" means the chief administrative officer of the Virginia Department of State Police.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 1.1, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

Part II
Criminal History Record Information Use

6VAC20-120-30. Applicability.

A. This chapter governs originals and copies of manual or automated criminal history record information that are used, collected, stored, or disseminated by state or local criminal justice agencies or other agencies receiving criminal history record information in the Commonwealth. This chapter also sets forth the required procedures that ensure the proper processing of the expungement of criminal history record information. The provisions of this chapter apply to the following groups, agencies, and individuals:

1. State and local criminal justice agencies and subunits of these agencies in the Commonwealth; and

2. The United States Government or the government of another state or its political subdivisions that exchange such information with criminal justice agencies in the Commonwealth, but only to the extent of that exchange.

B. The provisions of this chapter do not apply to (i) original or copied records of entry, such as police blotters maintained by a criminal justice agency on a chronological basis and permitted to be made public, but only if such records are not indexed or accessible by name; (ii) offense and dispatch records maintained by a criminal justice agency on a chronological basis and permitted to be made public, if such records are not indexed or accessible by name or do not contain criminal history record information; (iii) court records of public criminal proceedings, including opinions and published compilations thereof; (iv) records of traffic offenses disseminated to or maintained by the Department of Motor Vehicles for the purpose of regulating the issuance, suspension, revocation, or renewal of drivers' or other operators' licenses; (v) statistical or analytical records or reports in which individuals are not identified and from which their identities are not ascertainable; (vi) announcements of executive clemency; (vii) posters, announcements, or lists for identifying or apprehending fugitives or wanted persons; and (viii) criminal justice intelligence information or criminal justice investigative information.

C. Nothing in this chapter shall be construed as prohibiting a criminal justice agency from disclosing to the public factual information concerning the status of an investigation; the apprehension, arrest, release or prosecution of an individual; the adjudication of charges; or the correctional status of an individual, which is related to the offense for which the individual is currently within the criminal justice system.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 2.1, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-40. Collection.

A. Responsibility. Responsibility for collecting and updating criminal history record information rests with:

1. State officials and criminal justice agencies having the power to arrest, detain, or hold convicted persons in correctional facilities;

2. Sheriffs of cities or counties;

3. Police officials of cities, counties, and towns;

4. Other local law-enforcement officers or conservators of the peace who have the power to arrest for a felony (see § 19.2-390 of the Code of Virginia);

5. Clerks of court and court agencies or officers of the court; and

6. Other criminal justice agencies or agencies having criminal justice responsibilities which generate criminal history record information.

B. Reportable offenses. The officials listed in subsection A of this section and their representatives are required to submit to the Central Criminal Records Exchange, on forms provided by the Central Criminal Records Exchange, a report on every arrest they complete for:

1. Treason;

2. Felonies or offenses punishable as a misdemeanor under Title 18.2 of the Code of Virginia;

3. Class 1 and 2 misdemeanors under Title 18.2 except an arrest for a violation of Article 2 (§ 18.2-266 et seq.) of Chapter 7 of Title 18.2; a violation of Article 2 (§ 18.2-415 et seq.) of Chapter 9 of Title 18.2, or § 18.2-119; or a violation of any similar ordinance of a county, city or town.

In addition to those offenses enumerated in this subsection, the Central Criminal Records Exchange may receive, classify, and file any other fingerprints and records of arrest or confinement submitted to it by any law-enforcement agency or correctional institution.

The chief of police, sheriff, or criminal justice agency head is responsible for establishing a system to ensure that arrest forms are completed and submitted in a timely and accurate fashion.

C. Timelines of submission.

1. Arrests. Arrest reports for all offenses noted in subsection B of this section, except as provided in this section, and a fingerprint card for the arrested individual shall be forwarded to the Central Criminal Records Exchange in accordance with the time limits specified by the Department of State Police. A copy of the Central Criminal Records Exchange arrest form shall also be sent to the local court (a copy of the form is provided for the courts) at the same time.

The link between the arrest report and the fingerprint card shall be established according to Central Criminal Records Exchange requirements. Arrests that occur simultaneously for multiple offenses need only be accompanied by one fingerprint card.

2. Convictions. For persons arrested and released on summonses under § 19.2-74 of the Code of Virginia, the chief law-enforcement officer or his designee, who may be the arresting officer, shall furnish a fingerprint card and a completed copy of the Central Criminal Records Exchange form to the Central Criminal Records Exchange. The form shall be completed immediately upon conviction unless an appeal is noted. In the case of an appeal, officials responsible for reporting the disposition of charges shall report the conviction within 30 days after final action of the case.

3. Final disposition. State correctional officials shall submit to the Central Criminal Records Exchange the release status of an inmate of the state correctional system within 20 days of the release.

D. Updating and accuracy.

1. Arresting officers and court clerks noted in subsection A of this section are responsible for notifying the Central Criminal Records Exchange in a timely manner, and always within 30 days, of changes or errors and necessary corrections in arrests, convictions, or other dispositions concerning arrests and dispositions that the criminal justice agency originated. In the case of correctional status or release information, correctional officials are responsible for notifying the Central Criminal Records Exchange within the same time limits of updates or changes in correctional status information. Forms for updating and correcting information are provided by the Central Criminal Records Exchange.

2. Each criminal justice agency is required to supply timely corrections of criminal history record information the agency has provided to a criminal justice or a noncriminal justice agency for a period of two years after the date of dissemination.

E. Locally maintained and nonreportable offenses. Criminal history record information generated by a criminal justice agency and maintained in a locally used and maintained file, including criminal history record information on offenses not required to be reported to the Central Criminal Records Exchange but maintained in local files, as well as criminal history record information maintained by the Central Criminal Records Exchange, shall adhere to the standards of collection, timeliness, updating, and accuracy as required by this chapter. Arrests shall be noted and convictions or adjudications recorded within 30 days of court action or the elapse of time to appeal.

F. Except as provided in §§ 15.2-1722, 16.1-299, and 19.2-390 of the Code of Virginia, nothing contained in this article shall be construed as requiring any criminal justice agency to collect, maintain, or update criminal history record information, as defined in § 9.1-101 of the Code of Virginia, when such information is already available and readily accessible from another criminal justice agency.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 2.2, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 23, Issue 25, eff. September 19, 2007; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-50. Dissemination.

A. Authorization.

1. No criminal justice agency or individual shall confirm or deny the existence or nonexistence of a criminal history record to persons or agencies that would not be eligible to receive the information. No dissemination of a criminal history record is to be made to a noncriminal justice agency or individual if an interval of one year has elapsed from the date of arrest and no disposition of the charge has been recorded and no active prosecution of the charge is pending.

2. Criminal history record information or portions of an individual's record both maintained and used by criminal justice agencies and eligible recipients, maintained either at the Central Criminal Records Exchange or by the originating criminal justice agency, or both, shall only be disseminated as provided by § 19.2-389 of the Code of Virginia.

3. Upon receipt of a request for criminal history record information, by personal contact, mail, or electronic means from an agency or individual claiming to be authorized to obtain such information, the person responding to the request shall determine whether the requesting agency or individual is authorized to receive criminal history record information.

4. Criminal justice agencies shall determine what positions in their agency require regular access to criminal history record information as part of the position's job responsibilities. These positions will be exempt from the provisions of subsection B of this section. Use of criminal history record information by a member of a criminal justice agency not occupying a position authorized to receive criminal history record information, or for a purpose or activity other than one for which the person is authorized to receive criminal history record information, will be considered a dissemination and shall meet the provisions of this section. If the user of criminal history record information does not meet the procedures in subsection B of this section, the use of the information will be considered an unauthorized dissemination.

5. The release of criminal history record information to an individual or entity not included in § 19.2-389 of the Code of Virginia is unlawful and unauthorized. An individual or criminal justice agency that releases criminal history record information to a party which does not clearly belong to one of the categories of agencies and individuals authorized to receive the information as outlined in § 19.2-389 is subject to being denied access to state and national criminal history record information on a temporary or permanent basis and to the administrative sanctions described in 6VAC20-120-100. Unlawful dissemination contrary to the provisions of this chapter is also a Class 2 misdemeanor (see § 9.1-136 of the Code of Virginia).

B. Procedures for responding to requests. A criminal justice agency disseminating criminal history record information shall adhere to the following provisions:

1. Allowable responses to requests. Local and regional criminal justice agencies may respond to requests for criminal history record information in two ways:

a. For offenses required to be reported to the Central Criminal Records Exchange (CCRE), they shall refer the requester to the Central Criminal Records Exchange, which will directly provide the requester with the information. (See § 19.2-389 of the Code of Virginia.)

When an inquiry to the exchange is not made, the record provided by the local law-enforcement agency should be accompanied by an appropriate disclaimer indicating that the record may not be complete.

b. For nonreportable offenses (i.e., those offenses not reported to the Central Criminal Records Exchange), the law-enforcement agency shall provide the information requested, following the dissemination procedures as required by subdivisions 2 through 8 of this subsection.

2. Prior to dissemination. Prior to disseminating criminal history record information a criminal justice agency shall:

a. Verify requester identity.

(1) Individual requester. For an individual requesting his own record and not known to the person responding to the request, the individual shall provide proper identification, to include at least two of the following, one of which must be a photo identification: (i) a valid passport, (ii) drivers' license with photo, (iii) social security card, (iv) birth certificate, (v) military identification, or (vi) state issued identification card with photo, if there is more than one name match. Fingerprints or other additional information shall be required if the disseminating criminal justice agency deems it appropriate or necessary to ensure a match of the record and the requesting subject.

(2) Criminal justice agencies. For personnel of criminal justice agencies requesting a record, the requester shall provide valid agency identification unless the disseminator recognizes the requesting individual as having previously been authorized to receive the information for the same purpose.

(3) Noncriminal justice agencies or individuals. For an individual requesting the record of another, as in the case of an attorney requesting the record of his client, the individual shall provide a sworn written request from the record subject naming the requester as a recipient, as provided in subsection A of § 19.2-389 of the Code of Virginia. The written request shall include the full name, date of birth, race, and sex of the record subject. Identification of the attorney or individual shall also be required unless the attorney or individual is known to the official responding to the request.

b. Verify record subject identity. Because serious harm could come from the matching of criminal history record information to the wrong individual, verification procedures shall be carefully managed, particularly when dissemination will be to noncriminal justice recipients. The following information shall be reviewed to verify the record subject's identity:

(1) The full name, date of birth, race, and sex of the record subject. Fingerprint identification may be required prior to dissemination if there is any doubt as to the match. If a criminal justice agency does not have the capability to classify fingerprints, it may submit them by mail to the Central Criminal Records Exchange. Only when the information supplied and the information in the Central Criminal Records Exchange or local files satisfactorily match shall information be disseminated.

(2) Criminal history record information which reasonably corresponds to the name, aliases, and physical identity of the subject can be disseminated to a legitimate requester when time is of the essence or if criminal justice interests will be best served by the dissemination. This includes the dissemination of records with similar but not identical name spellings, similar physical characteristics, and similar but not identical aliases. When criminal history record information is obtained in this manner and results in an apparent match between the identity of the subject and the record, the criminal history record should be verified using fingerprint identification prior to prosecution, adjudication or sentencing of the record subject. If a criminal justice agency does not have the capability to classify fingerprints, it may submit them by mail to the Central Criminal Records Exchange.

c. Notify requester of costs and restrictions. The official responsible for aiding the requester shall notify the requester of the costs involved and of restrictions generally imposed on use of the data, or be reasonably assured that the requester is familiar with the costs and restrictions, prior to beginning the search for the requested criminal history record information and shall obtain the consent of the requester to pay any charges associated with the dissemination.

3. Locating and disseminating information requested. Once a request for a criminal history record has been made, and the responsible official is satisfied as to the legitimacy of the request and the identity of the subject and has informed the requester of costs and restrictions, the responsible official conducting the search for the record shall supply the information contained in the local files on offenses not required to be reported to the Central Criminal records Exchange (see § 19.2-389 of the Code of Virginia).

4. Instructions regarding dissemination to requesters. The disseminated record must be accompanied by the message "UNAUTHORIZED DISSEMINATION WILL SUBJECT THE DISSEMINATOR TO CRIMINAL AND CIVIL PENALTIES" in printed form, for the following requesters:

a. Record subjects. Record subjects have a right to receive and disseminate their own criminal history record information, subject to this chapter and subdivision 11 of § 19.2-389 of the Code of Virginia. If a record subject or his attorney complies with the requirements of this section, he shall be given the requested criminal history record information. However, if an agency or individual receives a record from the record subject, that agency or individual shall not further disseminate the record.

b. Criminal justice agencies.

c. Noncriminal justice agencies and individuals other than record subjects. Even with the sworn consent of the record subject, only criminal history record information that is conviction data shall be disseminated to a noncriminal justice agency or an individual in compliance with the existing laws and shall not be disseminated further.

5. Maintaining a dissemination log. A record of all secondary disseminations shall be maintained at the disseminating criminal justice agency or shall be accessible electronically for a period of at least two years from the date of the dissemination.

The dissemination log must list all requests for criminal history record information. The log may be automated or manual.

Records will include the following information on each dissemination:

a. Date of inquiry;

b. Requesting agency name and address or the agency ORI;

c. Identifying name and number (either FBI or state identification number of record subject, or notification of "no record found");

d. Name of requester within the agency requesting criminal history record information; and

e. Name of disseminator (officer or civilian who provides the criminal history record information to the requester).

6. Reporting unauthorized disseminations. While individual criminal justice agencies are not expected to audit agencies that receive criminal history record information that they provide, in order to identify unauthorized releases, individual criminal justice agencies shall notify the department of any violations observed of this section. The department will investigate and respond to the violation in a manner deemed appropriate by the department.

A criminal justice agency that knowingly fails to report a violation may be subject to immediate audit of its entire dissemination log to ensure that disseminations are being appropriately managed.

7. Interstate dissemination. Interstate dissemination of criminal history record information shall be subject to the procedures described in this section. Dissemination to an agency outside of the Commonwealth shall be carried out in compliance with Virginia law and this chapter, as if the agency were within the jurisdiction of the Commonwealth.

8. Fees. Criminal justice agencies may charge a reasonable fee for search and copying time expended when dissemination of criminal history record information is requested by a noncriminal justice agency or an individual. The criminal justice agency shall post the schedule of fees to be charged and shall obtain approval from the requester to pay such costs prior to initiating the search.

C. Limitations on use. Use of criminal history record information disseminated to noncriminal justice agencies shall be limited to the purposes for which the information was given and may not be disseminated further.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 2.3, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-60. Access and review.

A. Who can review. An individual or his attorney, upon providing proper identification and in the case of an attorney representing a client, with a sworn written request from the record subject, shall have the right to inspect criminal history record information being maintained on that individual by the Central Criminal Records Exchange or other criminal justice agencies. Completing a request form shall be required by the Central Criminal Records Exchange or the local criminal justice agency.

B. Review at local law-enforcement agency or central criminal records exchange.

1. An individual or his attorney may review the individual's criminal history record information arising from arrests for felonies and Class 1 and 2 misdemeanors maintained in the Central Criminal Records Exchange through a request to the Virginia Criminal Information Network or to the Central Criminal Records Exchange of the Virginia Department of State Police during normal working hours. An individual or his attorney may review the individual's criminal history record regarding offenses not required to be reported to the Central Criminal Records Exchange at the arresting law-enforcement agency.

2. The law-enforcement agency to which the request is directed shall inform the individual or his attorney of the procedures associated with the review.

3. Individuals shall be provided, at cost, one copy of their record. If no record can be found, a statement shall be furnished to this effect.

C. Timeliness and completeness.

1. An individual requesting his own record shall be advised when the record will be available. In no case shall the time between request and availability of the record exceed one week, except where fingerprint identification is required; then it shall not exceed 30 days. Criminal justice agencies should seek to provide the record as soon as reasonably possible unless there are questions of identification.

2. The criminal justice agency locating an individual's criminal history record information shall examine its own files for the most up-to-date criminal history record information and supply the criminal history record information to the requester.

D. Assistance.

1. The criminal justice agency to which the request is directed shall provide reasonable assistance to the individual or his attorney to help understand the record.

2. The official releasing the record shall also inform the individual of his right to challenge the record.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 2.4, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-70. Challenge.

A. Individuals who desire to challenge their own criminal history record information must complete documentation provided by the criminal justice agency maintaining the record and forward it to the Central Criminal Records Exchange or the criminal justice agency maintaining the record. A duplicate copy of the form and the challenged record may be maintained by the individual initiating the challenge or review. The individual's record concerning arrests for felonies and Class 1 and 2 misdemeanors may be challenged at the Central Criminal Records Exchange of the Department of the State Police. For offenses not required to be reported to the Central Criminal Records Exchange, the challenge shall be made at the arresting law-enforcement agency or the criminal justice agency maintaining the records.

B. A challenge to a record maintained by the Central Criminal Records Exchange will be processed as follows:

1. Message flags. If the challenge is made of a record maintained by the Central Criminal Records Exchange, both the manual and the automated record shall be flagged with the message "CHALLENGED RECORD." A challenged record shall carry this message when disseminated while under challenge.

2. Review at exchange. The Central Criminal Records Exchange shall compare the information contained in the repository files as reviewed by the individual with the original arrest or disposition form. If no error is located, the Central Criminal Records Exchange (i) shall forward a copy of the challenge form, a copy of the Central Criminal Records Exchange record, and other relevant information to the criminal justice agency or agencies which the Central Criminal Records Exchange records indicate as having originated the information under challenge and (ii) shall request them to examine the relevant files to determine the validity of the challenge.

3. Examination. The criminal justice agency or agencies responsible for originating the challenged record shall conduct an examination of their source data, the contents of the challenge, and information supplied by the Central Criminal Records Exchange for any discrepancies or errors and shall advise the Central Criminal Records Exchange of the results of the examination.

4. Correction. If any modification of a Central Criminal Records Exchange record is required, the Central Criminal Records Exchange shall modify the record and shall then notify the criminal justice agency in which the record was originally reviewed of its action and supply it and other agencies involved in the review with a copy of the corrected record.

5. Notification by Central Criminal Records Exchange. The Central Criminal Records Exchange shall also provide notification of the correction to all recipients of the record within the last 24 months.

6. Notification by other criminal justice agencies. Criminal justice agencies that have disseminated an erroneous or incomplete record shall in turn notify agencies that have received the disseminated record or portion of the record in the last two years from the date of the Central Criminal Records Exchange modifications of the records. Notification shall consist of sending a copy of the original record and corrections made to the recipients of the erroneous record noted in the dissemination log for the two-year period prior to the date of correction by the Central Criminal Records Exchange. (See § 9.1-132 of the Code of Virginia.) The criminal justice agency in which the review and challenge occurred shall notify the individual or his attorney of the action of Central Criminal Records Exchange.

7. Appeal. The record subject or his attorney, upon being told of the results of his record review, shall also be informed of his right to review and appeal those results.

C. A challenge to a record maintained by a criminal justice agency other than the central Criminal Records Exchange will be processed as follows:

1. Message flags. If a challenge is made of a record maintained by a criminal justice agency, both the manual and the automated record shall be flagged with the message "CHALLENGED RECORD." A disseminated record shall contain this message while under challenge.

2. Examination and correction agency. If the challenged record pertains to the criminal justice agency's arrest information, the arresting agency shall examine the relevant files to determine the validity of the challenge. If the review demonstrates that modification is in order, the modification shall be completed and the erroneous information destroyed. If the challenged record pertains to the disposition information, the arresting agency shall compare contents of the challenge with information originally supplied by the clerk of the court.

3. Review by clerk of court. If no error is found in the criminal justice agency's records, the arresting agency shall forward the challenge to the clerk of the court who submitted the original disposition. The clerk of the court shall examine the court records pursuant to the challenge and shall, in turn, notify the arresting agency of its findings. The arresting agency shall then proceed as described in subdivision C 2 of this section.

4. Notification. The criminal justice agency in which the challenge occurred shall notify the individual or his attorney of the action taken and shall notify the Central Criminal Records Exchange and other criminal justice agencies receiving the erroneous information of the necessary corrections if required, as well as the noncriminal justice agencies to which it has distributed the information in the last 24 months, as noted in its dissemination log.

5. Correction. The Central Criminal Records Exchange will correct its records and notify agencies that received erroneous information within the past 24 months. The agencies will be requested to correct their files and to notify agencies that have the disseminated information, as provided in subdivision B 6 of this section.

6. Appeal. The record subject or his attorney, upon receiving the results of the record review, shall be informed of the right to review and appeal.

D. Administrative review of challenge results.

1. Review by criminal justice agency head. After the review and challenge, in accordance with this section, concerning a record either in the Central Criminal Records Exchange or another criminal justice agency, the individual or his attorney may within 30 days request in writing that the head of the criminal justice agency in which the challenge was made review the challenge if the individual is not satisfied with the results of the review and challenge.

2. Thirty-day review. The criminal justice agency head or his designated official shall review the challenge by reviewing the action taken by the agency, the Central Criminal Records Exchange, and other criminal justice agencies and shall notify the individual or his attorney in writing of the decision within 30 days of the receipt of the written request to review the challenge. The criminal justice agency head shall also notify the individual of the option to request an administrative appeal through the department within 30 days of the postmarked date of the notification of the decision. This notification of the appeal shall include the address of the Department of Criminal Justice Services.

3. Correction and notification. If required, correction and notification shall follow the procedures outlined in subsections B and C of this section.

4. Notification of the department. A copy of the notice required in subdivision D 2 of this section shall be forwarded to the department by the criminal justice agency at the same time it is provided to the individual.

E. Administrative appeal.

1. Departmental assessment. The individual or his attorney challenging his record, within 30 days of the postmark of his notification of the decision of the administrative review, may request that the Director of the Department of Criminal Justice Services review the challenge and conduct an informal hearing. The director may designate a hearing officer for this purpose.

2. Determination of merits of case. The director or his designee shall contact the criminal justice agencies involved and request any and all information needed. Criminal justice agencies shall supply the information requested in a timely manner to allow the department to respond to the individual within 30 days. The director will then rule on the merits of a hearing and notify the individual or his attorney that such hearing will or will not be held.

3. Hearing. The hearing, if held, shall be conducted within 30 days of the receipt of the request, and the decision of the hearing officer communicated to the individual or his attorney within 30 days of the hearing.

4. Finding. If the director or the hearing officer determines that correction and modification of the records are required, correction of the record and notification of all involved parties shall proceed according to the procedures outlined in subsections B and C of this section.

5. Removal of a challenge designation. When records and relevant action taken by the criminal justice agencies involved are deemed to be correct, the department shall notify the affected criminal justice agencies to remove the challenge designation from their files.

F. Department notification following corrections. For audit purposes, the Central Criminal Records Exchange shall annually forward the names and addresses of the agencies that originated erroneous record information or received erroneous information from the exchange in that year to the Department of Criminal Justice Services.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 2.5, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-80. Expungement and sealing.

A. The expungement of a criminal history record or portion thereof is only permitted on the basis of a court order. Upon receipt of a court order, petition, and other supporting documents for the expungement of a criminal history record, the superintendent, pursuant to § 19.2-392.2 of the Code of Virginia, shall by letter with an enclosed copy of the order direct the Central Criminal Records Exchange and those agencies and individuals known to maintain or to have obtained such a record to remove the electronic or manual record or portion thereof from its repository and place it in a physically sealed, separate file. The file shall be properly indexed to allow for later retrieval of the record if required by court order, and the record shall be labeled with the following designation: "EXPUNGED RECORD TO BE UNSEALED ONLY BY COURT ORDER."

B. Responsibility of agencies with a record to be expunged. The record named in the Virginia Department of State Police's letter shall be removed from normal access. The expunged information shall be sealed but remain available, as the courts may call for its reopening at a later date. (See § 19.2-392.3 of the Code of Virginia.) Access to the record shall be possible only through a name index of expunged records maintained either with the expunged records or in a manner that will allow subsequent retrieval of the expunged record as may be required by the court or as part of the department's audit procedures. Should the name index make reference to the expunged record, it shall be apart from normally accessed files.

C. Procedure for expungement and sealing of electronic and hard copy records.

1. The expungement and sealing of hard copy original records of entry (arrest forms) is accomplished by physically removing them from a file and filing them in a physically secure location elsewhere, apart from normally accessed files. This file should be used only for expunged records and should be accessible only to the manager of records.

2. If the information to be expunged is included among other information that has not been expunged on the same form or piece of paper, the expunged information shall be obliterated on the original or the original shall be retyped eliminating the expunged information. The expunged information shall then be placed in the file for expunged records, in its original or copied form, and shall be accessible only to the manager of records.

3. If the expunged information is located on a criminal history record provided by the Central Criminal Records Exchange (i.e., "RAP sheet"), the criminal history record information shall be destroyed, and a new copy, not containing the expunged data, shall be obtained when necessary.

D. Procedure for expunging automated records. Should the record to be expunged be maintained in an automated system, the Central Criminal Record Exchange or the agency known to possess such a record shall copy the automated record onto an off-line medium such as hard disk drive, USB flash drive, or hard copy printouts. The expunged record, regardless of the type of medium on which it is maintained, shall then be kept in a file used for expunged records and sealed from normal use, accessible only to the manager of records. No notification that expunged data exists shall be left in the normally accessed files.

Notwithstanding any other provisions of this section, any imaged case records maintained in any circuit court, general district court, or juvenile and domestic relations district court case imaging system operated by the Office of the Executive Secretary for the Supreme Court of Virginia that are to be expunged may be transferred to a confidential and secure area inaccessible from normal use within the case imaging system and shall be considered sealed. Access to the expunged, imaged case records shall be limited to the manager of records for the court with the exception of designated staff within the Office of the Executive Secretary who are responsible for the operation of such case imaging systems and have access to the confidential and secure area for the discrete purpose of providing the manager of the records access to the secure area. No notification that expunged data exists shall be left in the normally accessed case imaging system. Any related records that are maintained in an electronic order book shall also be deleted.

E. Department to be notified following expungement. Upon receipt of a request from the Virginia Department of State Police to expunge and seal a record, the affected agency or agencies shall perform the steps of this section, and notify the Virginia Department of State Police of their action in writing within 60 days of their receipt of the request.

F. Expungement order not received by department. Should a court ordered expungement be directed to a criminal justice agency other than the Virginia Department of State Police, the directed criminal justice agency shall comply as outlined in this section and advise the superintendent without delay of such order. The superintendent shall, upon receipt of such notification, obtain a copy of the order from the appropriate circuit court.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 2.6, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 22, Issue 20, eff. July 12, 2006; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-90. Audit.

The department shall annually conduct an audit of a random representative sample of state and local criminal justice agencies to ensure and verify adherence to these regulations and to ensure that criminal history records are accurate and complete.

The audits may include, but will not be limited to: (i) examination of record accuracy, (ii) completeness, (iii) timely submission of information, (iv) evidence of dissemination limitation and adequate dissemination logs, (v) security provisions, (vi) evidence of notification of the individual's right of access and challenge, (vii) appropriate handling of record challenges, (viii) timely modification of erroneous records, (ix) evidence of timely notifications of required changes, and (x) appropriate notifications of the department as required.

Statutory Authority

§ 9.1-102 and Article 3 (§ 9.1-126 et seq.) of Chapter 1 of Title 9.1 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 2.7, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994.

6VAC20-120-100. Administrative sanctions.

Discovery of violations or failure to comply with this chapter in whole or in part will occasion the following sanctions. Additional criminal penalties and other sanctions may be invoked as provided in 6VAC20-120-50 should the violation involve an unauthorized dissemination.

1. Law-enforcement agencies.

a. Should a law-enforcement agency fail to comply with this chapter, a letter will be forwarded by the department to either the chief of police or sheriff, citing the problem and notifying the police department or the sheriff's department that the matter will be referred to the chief official of the locality or local commonwealth's attorney, respectively, if a satisfactory result is not forthcoming. The criminal justice agency shall have 10 business days to respond with a letter describing how the situation was remedied or explaining why there is no need to do so.

b. Should there be no satisfactory response after the 10 business day period, the matter will be referred to the offices of the city, county, or town manager or the local commonwealth's attorney requesting resolution of the matter within 30 days.

c. If 30 days have passed and the matter fails to be resolved to the satisfaction of the department, the matter will be referred to the Criminal Justice Services Board and the Office of the Attorney General for action.

2. Courts.

a. Should a court or officer of the court fail to comply with this chapter, a letter will be forwarded by the department to the court, citing the problem and notifying the court clerk that the matter will be referred to the chief judge of the locality and the local commonwealth's attorney if a satisfactory result is not forthcoming. The court shall have 10 business days to respond with a letter describing how the situation was remedied or explaining why there is no need to do so.

b. Should there be no satisfactory response after the 10 business day period, the matter will be referred to the chief judge requesting resolution of the matter within 30 days. The Executive Secretary of the Supreme Court of Virginia will also be notified.

c. If 30 days have passed and the matter fails to be resolved to the satisfaction of the department, the matter will be referred to the Criminal Justice Services Board and the Chief Justice of Virginia.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 2.8, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

Part III
Criminal History Record Information Security

6VAC20-120-110. Applicability.

A. This chapter is applicable to criminal justice information systems operated within the Commonwealth of Virginia. These regulations on security are not applicable to court records or other records expressly excluded by § 9.1-126 of the Code of Virginia.

B. This part establishes a minimum set of security standards that shall apply to any manual or automated recordkeeping system that collects, stores, processes, or disseminates criminal history record information.

C. Where individuals or noncriminal justice agencies are authorized to have direct access to criminal history record information pursuant to a specific agreement with a criminal justice agency to provide service required for the administration of criminal justice, the service support agreement will embody the restrictions on dissemination and the security requirements contained in this chapter and the Code of Virginia.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 3.1, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-120. Responsibilities.

A. In addition to those responsibilities mandated by state and federal laws, the Department of State Police shall have the responsibility for the implementation of this chapter in regard to the operation of the Central Criminal Records Exchange.

B. The implementation of this chapter, except as set forth in subsection A of this section, shall be the responsibility of the criminal justice agency as designated and authorized by the county or municipality in cases of political subdivisions. Nothing in this chapter shall be deemed to affect in any way the exercise of responsibility conferred on counties and municipalities of the state under Title 15.2 of the Code of Virginia. The determination of the suitability of the actual procedures instituted by the criminal justice agency will be the subject of study in any audit by the department, mandated by § 9.1-131 of the Code of Virginia.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 3.2, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-130. Physical access.

A. Access to areas in which criminal history record information is collected, stored, processed, or disseminated shall be limited to authorized persons. Control of access shall be ensured through the use of locks, guards, or other appropriate means. Authorized personnel shall be clearly identified.

B. Procedures shall be established to detect an unauthorized attempt or access. Furthermore, a procedure shall be established to be followed in those cases in which an attempt or unauthorized access is detected. Such procedures shall become part of the orientation of employees working in criminal history record information area or areas and shall be reviewed periodically to ensure their effectiveness.

C. Criminal justice agencies shall provide direct access to criminal history record information only to authorized officers or employees of a criminal justice agency and, as necessary, other authorized personnel essential to the proper operation of the criminal history record information system.

D. Criminal justice agencies shall institute, where computer processing is not utilized, procedures to ensure that an individual or agency authorized to have direct access is responsible for (i) the physical security of criminal history record information under its control or in its custody and (ii) the protection of such information from unauthorized access, disclosure, or dissemination.

E. Procedures shall be instituted to protect any central repository of criminal history record information from unauthorized access, theft, sabotage, fire, flood, wind, or other natural or man-made disasters.

F. For criminal justice agencies that have their criminal history files automated, it is highly recommended that "backup" copies of criminal history information be maintained, preferably off-site. Further, for larger criminal justice agencies having automated systems, it is recommended that the criminal justice agencies develop a disaster recovery plan. The plan should be available for inspection and review by the department.

G. System specifications and documentation shall be carefully controlled to prevent unauthorized access and dissemination.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 3.3, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-140. Personnel.

In accordance with applicable law, ordinances, and regulations, the criminal justice agency shall:

1. Screen and have the right to reject for employment, based on good cause, personnel to be authorized to have direct access to criminal history record information;

2. Have the right to initiate or cause to be initiated administrative action leading to the transfer or removal of personnel authorized to have direct access to this information where these personnel violate the provisions of this chapter or other security requirements established for the collection, storage, or dissemination of criminal history record information; and

3. Ensure that all employees working with or having access to criminal history record information shall be made familiar with the substance and intent of this chapter. Designated employees shall be briefed on their roles and responsibilities in protecting the information resources in the criminal justice agency. Special procedures connected with security shall be reviewed periodically to ensure their relevance and continuing effectiveness.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 3.4, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

6VAC20-120-150. Telecommunications.

Direct or remote access to computer systems for the purpose of accessing criminal history record information shall require that the direct or remote access device use dedicated telecommunication lines. The use of any nondedicated means of data transmission to access criminal history record information shall generally be prohibited. Exceptions may be granted for systems which obtain expressed approval of the department based on a determination that the system has adequate and verifiable policies and procedures in place to ensure that access to criminal history record information is limited to authorized system users. The Department of State Police shall further approve of any access to the Virginia Criminal Information Network (VCIN), in accordance with State Police regulations governing the network. Nothing in this regulation shall be construed to affect the authority of the Department of State Police to regulate access to VCIN.

In those systems where remote access of criminal history record information is permitted, remote access devices must be secure. Remote access devices capable of receiving or transmitting criminal history record information shall be attended during periods of operation. In cases in which the remote access device is unattended, the device shall, through security means, be made inoperable, for purposes of accessing criminal history record information.

Telecommunications facilities used in connection with the remote access device shall also be secured. The remote access device shall be identified on a hardware basis to the host computer. In addition, appropriate identification of the remote access device operator shall be required. Equipment associated with the remote access device shall be reasonably protected from possible tampering or tapping.

Statutory Authority

§ 9.1-102 and Article 3 (§ 9.1-126 et seq.) of Chapter 1 of Title 9.1 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 3.5, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994.

6VAC20-120-160. Computer operations.

A. Where computerized data processing is employed, effective and technologically advanced software and hardware design shall be instituted to prevent unauthorized access to this information.

B. Computer operations, whether dedicated or shared, that support criminal justice information systems shall operate in accordance with procedures developed or approved by the participating criminal justice agencies.

C. Criminal history record information shall be stored by the computer in such a manner that it cannot be modified, destroyed, accessed, changed, purged, or overlaid in any fashion by noncriminal justice terminals.

D. Operational programs shall be used that will prohibit inquiry, record updates, or destruction of records from terminals other than criminal justice system terminals that are so designated.

E. The destruction of record shall be limited to designated terminals under the direct control of the criminal justice agency responsible for creating or storing the criminal history record information.

F. Operational programs shall be used to detect and log all unauthorized attempts to penetrate criminal history record information systems, programs, or files.

G. Programs designed (i) for the purpose of prohibiting unauthorized inquiries, unauthorized record updates, or unauthorized destruction of records or (ii) for the detection and logging of unauthorized attempts to penetrate criminal history record information systems shall be known only to the criminal justice agency employees responsible for criminal history record information system control or individuals and agencies pursuant to a specific agreement with the criminal justice agency to provide such security programs. The program or programs shall be kept under maximum security conditions.

H. Criminal justice agencies having automated criminal history record files shall designate a system administrator to maintain and control authorized user accounts, system management, and the implementation of security measures.

I. The criminal justice agency shall have the right to audit, monitor, and inspect procedures established pursuant to this chapter.

Statutory Authority

§§ 9.1-102 and 9.1-131 of the Code of Virginia.

Historical Notes

Derived from VR240-02-1 § 3.6, eff. April 1, 1986; amended, Virginia Register Volume 6, Issue 4, eff. January 1, 1990; Volume 10, Issue 7, eff. February 1, 1994; Volume 33, Issue 3, eff. November 4, 2016.

Website addresses provided in the Virginia Administrative Code to documents incorporated by reference are for the reader's convenience only, may not necessarily be active or current, and should not be relied upon. To ensure the information incorporated by reference is accurate, the reader is encouraged to use the source document described in the regulation.

As a service to the public, the Virginia Administrative Code is provided online by the Virginia General Assembly. We are unable to answer legal questions or respond to requests for legal advice, including application of law to specific fact. To understand and protect your legal rights, you should consult an attorney.