Microsoft Word - 20.16_Non-Criminal Justice Agency Fingerprint Compliance

ARIZONA

Department of Emergency and Military Affairs

POLICY

POLICY LETTER NO. 20.16

DATE 09 Nov 21

OPR NGAZ-HRZ

SUBJECT: Non-Criminal Justice Agency

Fingerprint Compliance

REGULAR POLICY LETTER

DISTRIBUTION (POLICY LETTER 10.01)

1. Applicability: This policy applies to all applicants for state employment, including former State

employees, contractors, authorized personnel in the State HRO, and hiring authorities with the Department

of Emergency and Military Affairs (DEMA).

2. Purpose: Outline the procedures for requesting and maintaining Criminal Justice Information or

Criminal History Record Information from the Arizona Department of Public Safety.

3. References:

a. A.R.S. §26-103, Department of Emergency and Military Affairs employees; fingerprints; exemptions;

definition

b. A.R.S. §38-511, Cancellation of Political Subdivision and State Contracts; definition

c. A.R.S. §41-1750, Central State Repository; Department of Public Safety; duties; funds; accounts;

definitions

d. A.R.S. §41-1751, Reporting court dispositions to Department of Public Safety

e. A.R.S.§41-1756, Unauthorized Access to Criminal History; classifications; definitions

f. A.R.S.§41-2204, System manager; powers and duties

g. 28 C.F.R., Part 20, Criminal Justice Information Systems

h. Arizona State Personnel System Rule R2-5A-303, Reference and Background Checks

4. Definitions:

a. “Agency” means the Arizona Department of Emergency and Military Affairs (DEMA).

b. “Agency Security Contact” means the designated agency liaison with Department of Public Safety

(DPS) responsible for performing all necessary duties and ensuring compliance.

c. “Authorized Personnel List” means a list of individuals authorized to view, handle, use, discuss,

disseminate, or dispose of criminal history.

d. “Authorized Purposes” means as a noncriminal justice agency, the use of criminal history record

information is restricted to the particular purpose for which the finger prints were submitted; employment,

volunteers.

e. “Candidate” means a person whose education, experience, competencies and other qualifications

meet the requirements of a position and who may be considered for employment.

f. “Criminal Justice Information” means criminal justice information that includes persons, warrants,

and sex offender registration information.

g. “Criminal History Record Information” means criminal justice information that contains arrest-based

data and information that stems from arrest records.

h. “CJIS Systems Officer (CSO)” means the Director of DPS who is recognized by the FBI and is

responsible for administering and ensuring statewide compliance with the FBI CJIS Security Policy

CONTINUATION POLICY LETTER NO. 20.16

SUBJECT: Non-Criminal Justice Agency

Fingerprint Compliance

5. Policy: The Arizona Department of Emergency and Military Affairs (DEMA), may use the Criminal Justice

Information (CJI) or Criminal History Record Information (CHRI) obtained from the Arizona Department of

Public Safety (DPS) to evaluate the fitness of current or prospective licensees, employees, contract

employees, and/or volunteers pursuant to 28 C.F.R., Part 20, and A.R.S. §41-1750.

a. Procedure:

i. As outlined in the Noncriminal Justice User Agreement between the Arizona Department of Public

Safety and DEMA, the agency has the authorization to submit fingerprints to DPS for Fee-Based State and

Federal Criminal History Checks pursuant to A.R.S. §26-103. All applicants must be fingerprinted if they are

employees or contractors. Applicants that have disclosed a conviction will also be fingerprinted. All job offers

are contingent upon the successful completion of all background and reference checks and required

documents.

ii. During the on-boarding process all applicants must provide a valid, unexpired form of government-

issued photo identification prior to fingerprinting to verify their identity. Accepted forms of primary and

secondary identification have been approved through the National Crime Prevention and Privacy Compact

Council Identity Verification Program Guide.

iii. Prior to fingerprinting, the employee will be notified in writing that the fingerprints will be used to

check the criminal history records of the FBI. The written notification will be provided in a format that allows

the employee to read and sign acknowledging receipt and understanding of the document and to take a

copy of the notification. The notification will inform the employee/applicant that the fingerprints will be used

to check the criminal history record of the FBI, that DEMA provides all employees/applicants a reasonable

opportunity to review and challenge the accuracy of the criminal history record as well as how to obtain a

copy of the FBI record and the guidelines for these procedures as well as the contact information for the

Arizona Department of Public Safety Criminal History Records Unit to obtain a copy of their Arizona criminal

history record for review.

iv. If an employee elects to review/challenge the criminal history record, the applicant/employee will

have fourteen calendar days upon notification to provide DEMA authentic documentation that reports the

criminal history information accurately and completely before a final determination of employment suitability

is made. Any requests for extensions to the fourteen-calendar day requirement will be reviewed on a case

by case basis and will be approved by The Adjutant General or designee.

v. Upon receipt and acknowledgement of the required notifications and disclosures, unless the

employee has elected to obtain their own fingerprints, the new employee will be taken to the Personnel

Security Office to have their fingerprints taken by DEMA designated State Human Resources Staff which

will then take possession of the fingerprint card and will ensure the correct purpose and authority (see

above) are written on the fingerprint cared in the “reason for fingerprinted” box. Once the fingerprint card is

completed and at no point in time is the fingerprint card to be returned to the applicant. Chain of custody

procedures are maintained to protect the integrity of the applicant’s fingerprints prior to submission to DPS

and/or the FBI. The fingerprint cards are then placed in a manila envelope and then into a locked drawer

with the inventory sheet to DPS. Only authorized personnel have access to this locked drawer and the

keys is stored the ASC’s office. If the applicant/employee elects to obtain their own fingerprints, the State

Human Resources Office will provide the fingerprint card to the applicant to be taken to their local police

department for fingerprinting.

CONTINUATION POLICY LETTER NO. 20.16

SUBJECT: Non-Criminal Justice Agency

Fingerprint Compliance

b. Authorized Personnel:

i. Only authorized individuals will have access to view/handle criminal justice information and criminal

history report information after completing the required training (CJIS Online Security & Awareness

training and reading our agency specific policies and procedures) and one-time signing of

acknowledgement statement. DEMA authorized employees are staff within the State Human Resources

Office. These individuals include the HR Director, HR Operations Manager, HR Personnel Analyst II

(Employee Relations) and HR Administrative Assistant. Upon termination of authorized personnel, the

Agency Security Contact (ASC) will update and provide the list to DPS as soon as possible.

ii. The personnel listed on the current Authorized Personnel List on file with the DPS Access Integrity

Unit (AIU) are the only personnel authorized to access, discuss, use, handle. disseminate, file, log and

destroy the CJI/CHRI. To prevent tampering, all terminated personnel, the public, all outside persons and

entities are prohibited from handling or having any access to CJI/CHRI for any reason. Secondary

dissemination to an outside agency is prohibited.

c. Requirements:

i. Authorized personnel may discuss the contents of the criminal history record with the individual in a

private and secure place. Care should be taken to prevent overhearing, eavesdropping, or interception of

communication. Criminal history cannot be copied, emailed, faxed, scanned, stored electronically or sent

electronically via cell phone or another handheld device. Casual unauthorized release of information is not

allowed, i.e., social networks, discussions with friends and family members. Criminal history cannot be

further disseminated to any other agency or individual. The individual may not be given a copy of the

record; the record is for agency use only. The individual should be informed that if he/she wishes to

challenge the content of the record, a Review and Challenge packet for Arizona criminal history can be

obtained from DPS Criminal History Records. The information on challenging an FBI record can be

obtained by contacting the FBI (current phone numbers and more information is available on the FBI

website).

ii. Criminal history report information (CHRI) shall not be shared nor is it to be released in any form to

the public. State Human Resources employees will not confirm or deny the existence of an individual’s

criminal history record to the public or to any unauthorized individual or agency.

iii. The results of the criminal history from DPS will be delivered in a sealed envelope clearly labelled

“Arizona Department of Public Safety”. The mail should be considered to contain CJI/CHRI and will only

be provided to and opened by authorized staff within the State Human Resources office. All criminal

history checks that are returned with a disqualifying factor will be handled and housed by approved

personnel in the State Human Resources Office and a discussion will be held to determine the next steps.

During the suitability determination, here are the steps that authorized personnel will follow: 1) Before

suitability is determined, the CJI/CHRI will be stored in a locked drawer for the authorized personnel to

review and make a suitability determination, 2) After suitability is determined, the CJI/CHRI is stored in a

separate employee fingerprinting file. These records cannot be release for any public records request and

are not archived with the Arizona State Library, Archives and Public Records. After final determination is

rendered, the CJI/CHRI are filed in the fingerprint filing cabinet which is locked throughout the day and all

visitors to the area are accompanied by designated HR staff or authorized personnel.

CONTINUATION POLICY LETTER NO. 20.16

SUBJECT: Non-Criminal Justice Agency

Fingerprint Compliance

d. Records Maintenance:

i. DEMA does not store CJI/CHRI electronically. To prevent unauthorized access or tampering, the

results of state and FBI criminal history reports and searches will be maintained in a filing cabinet that is

locked throughout the day and one key will be secured with the ASC and one other key is secured with the

designated authorized personnel. All visitors to the area where CJI/CHRI are kept are accompanied by

authorized staff personnel as well. All criminal history results will be stored in a file separate from the

employee’s official personnel file or any other file that may be released as a public record.

ii. The Non-Criminal Justice Applicant Fingerprint Card Inventory Sheet(s) must be retained for auditing

purposes. The Arizona Department of Public Safety is on a three-year auditing cycle and can request to see

the previous year’s inventory sheets. For example, if the audit is being conducted in 2019, the inventory

sheets from 2018 must be made available if requested.

iii. The CJI/CHRI filing cabinet does not contain any other employment records or any files which may

be considered public record to prevent unauthorized access or dissemination. The filing cabinet is locked

throughout the day to prevent unauthorized access by non-authorized personnel. The keys to the filing

cabinet are kept secure by the ASC and another back-

up key is kept secure with other authorized personnel.

Only authorized personnel are allowed access to the filing cabinets that contain the CJI/CHRI. If a key to

the filing cabinet that contains the records is lost, the filing cabinet will be re-keyed to prevent unauthorized

access. Authorized personnel are responsible for safeguarding the confidentiality of the information at all

times and may not disclose or allow ac

cess to the information to anyone except authorized personnel.

CJI/CHRI is always secured and never left unattended.

iv. Once the CJI/CHRI has met its purpose, it is filed by authorized personnel in a secured locked filing

cabinet in the State Human Resources Office in a secure location. CJI/CHRI will be maintained for 5 years

following the employees’ separation from state service. Once the CJI/CHRI has met the destruction date,

authorized State Human Resources Personnel will shred the CJI/CHRI. In the event of a third-party

contractor that performs the shredding, authorized personnel will accompany the vendor to oversee the

shredding and handling of the CJI/CHRI. The authorized personnel will observe the contractor from the time

the shredding receptacle is picked up through the complete destruction of the CJI/CHRI.

e. Roles and Responsibilities: The DEMA Agency Security Contact (ASC) is the person through which

all communication with DPS regarding audits, agency/personnel information changes, training, and

security is conducted. Maintains all authorized personnel training on the NCJA Training Documentation

Form (or similar document) and receives/disseminates communication updates from DPS. The ASC is the

first point of contact for DPS in the event of an allegation of criminal history misuse or a security issue

involving the criminal history check process. The ASC responsibilities can be located on the Agency

Security Contact Basic Responsibility worksheet in the training handouts.

f. Training Requirements:

i. Authorized personnel must complete two types of training: Criminal Justice Information System

(CJIS) online training which is the minimum basic security awareness training required for all individuals

who view or handle criminal history information. All authorized personnel must receive CJIS online

training within six months of hire or being placed on the Authorized Personnel List and then every two

years thereafter.

ii. Authorized Personnel must receive training on the agency’s internal policies and procedures for

the proper access, use, handling, dissemination, and destruction of CJI/CHRI and on the consequences

of misuse of CJI/CHRI. It is a class 6 felony in Arizona for a person to misuse CJI/CHRI per Arizona

Revised Statues (A.R.S. § 41-1756).

CONTINUATION POLICY LETTER NO. 20.16

SUBJECT: Non-Criminal Justice Agency

Fingerprint Compliance

iii. All training and acknowledgement statements will be recorded on a training documentation log.

This log is reviewed during audits by DPS.

a. Non-Compliance/Misconduct:

i. In the event of deliberate, reckless or unintentional misuse of criminal history and criminal

record history, the employees will be subject to disciplinary action, up to and including termination, as

outlined in the agency’s current Progressive Disciplinary and Corrective Action policy and Arizona State

Personnel System Rules.

ii. All authorized personnel must sign a statement acknowledging notification of the penalties

for misuse of the information. The acknowledgement statement will contain a summary of state, federal

and agency consequences and a statement that the undersigned “acknowledges notification for penalties

for misuse of criminal justice and criminal history record information”.

6. Administration: Point of contact for this policy is the State Human Resources Officer, 602-267-2731.

KERRY L. MUEHLENBECK

Major General, AZ ANG

The Adjutant General

This policy letter supersedes Policy Letter 20.16 dated 14 February 2020