Chapter 140-2 PRACTICE AND PROCEDURE
|(1)||These Rules apply to Georgia criminal justice agencies and all other agencies or persons with access to criminal justice information as defined in Georgia law and Rule 140-1-.02(c).|
|(2)|| These Rules do not restrict any criminal
justice agency from publicly disclosing certain information to include:
|(3)|| A criminal justice agency may release
prior CHRI to the news media or any other person if the CHRI is based on data
|(4)||The names of living victims of sexual offenses and juveniles involved in police investigations are not to be released.|
|(5)||Nothing in these Rules shall close any record that is now or hereafter made public by law.|
|(6)||Nothing in these Rules shall mandate the exchange of criminal justice information except where specifically required by these Rules.|
|(2)||Secret information, CHRI or restricted information is a "Secret of State", which is required by State policy, the interest of the community and the right of privacy of the citizens of this State to be confidential. Such information shall not be divulged except as permitted by Georgia law and these Rules. Criminal justice agencies must destroy documents containing secret information, CHRI or restricted information no longer required for operations in a manner precluding access to the information by unauthorized persons.|
|(3)||Criminal justice agencies shall disseminate CHRI only to agencies or persons requiring such information to perform duties serving the administration of criminal justice or as otherwise provided by statute, executive order or these Rules. Under no circumstances will CHRI be transmitted via the CJIS network to devices not authorized to access such information, which may exist in the GCIC computerized files, FBI Interstate Identification Index (III) or computerized files maintained in other states.|
|(4)||Local agency heads shall provide the GCIC Director with written notification of security policy violations for criminal justice information committed by employees of their agencies or agencies over which they exercise management control.|
|(5)||The Director shall establish an information security structure that provides for an ISO. The Director shall also ensure that each local agency having access to the CJIS network designates a LASO.|
|(1)|| Each law enforcement agency is
responsible for obtaining fingerprints of persons charged with criminal
offenses described in O.C.G.A. § 35-3-33. Additionally, O.C.G.A.
§ 15-11-83 requires agencies charging juveniles (16 years of age and
younger) with felony offenses to submit criminal cards to GCIC in the same
manner prescribed for adult offenders. Fingerprint images may be transmitted
electronically to GCIC utilizing GCIC certified livescan/cardscan devices, or
submitted manually (rolled, inked prints) on FBI provided fingerprint cards
preprinted with the arresting agency's Originating Agency Identifier (ORI).
Only black printer's ink or an alternative medium authorized by the FBI is
acceptable for fingerprint images submitted manually to GCIC; additionally, two
original arrest fingerprint cards are required for manual submissions. Agencies
should seek GCIC approval before using other criminal fingerprint
cards, or buying/using any alternative medium or system.
|(2)|| Each law enforcement agency arresting
persons under paragraph (1) above is also responsible for forwarding the
Offender Tracking Number (OTN) and Charge Tracking Number (CTN), and other
associated information, along with arrest warrants, citations or charges to
appropriate prosecutors or courts. Prosecutors and courts use the OTN and CTN
to report the final disposition of charges to GCIC. Agencies may electronically
transmit disposition information to GCIC via systems and programs meeting GCIC
requirements. Final disposition reporting is required for complete and accurate
adult and juvenile criminal history records.
|(3)||Responsible agencies must forward final disposition information to GCIC within 30 days of the final disposition decision.|
|(4)||GCIC will publish a list of fingerprintable offenses as prescribed by Georgia law and the Attorney General of Georgia and revise the list when necessary as determined by the Attorney General.|
|(1)|| Exchange and dissemination of criminal
justice information by criminal justice agencies:
|(2)|| Exchange and dissemination of criminal
justice information by GCIC.
Documents containing criminal justice information, regardless of its source, shall not be altered, obtained, copied, destroyed, delayed, misplaced, misfiled, given, bought or sold when the intent of such action is to obstruct justice or facilitate the violation of any law or these Rules.
|(1)||GCIC will maintain computer system logs of all criminal history record inquiries and record requests transmitted to GCIC.|
|(2)|| The following minimum information shall
be maintained in GCIC computer system logs.
|(3)||Criminal justice agencies that access Georgia's CJIS network may establish local paper or computer system logs to control and document requests for criminal history records, CJIS inquiries and/or secondary disseminations within their agencies. These agencies may request printouts of GCIC system logs when required for internal investigations or other special circumstances. Agencies establishing computer system logs may record information items listed above; detailed criminal history record information shall not be recorded in computer system logs.|
|(1)|| The Director
shall appoint auditors to conduct performance audits of criminal justice
agencies that access Georgia's CJIS network to assess and enforce compliance
with these Rules, O.C.G.A. §§ 35-3-34 through
35-3-38, other relevant Georgia
code sections and pertinent federal statutes and regulations.
|(2)|| Agencies scheduled for audit
shall make the following available to GCIC auditors:
|(1)||Criminal justice agencies, governmental dispatch centers and other governmental agencies approved by the Director for direct CJIS network access shall provide secure areas out of public view in which criminal justice information is handled.|
|(2)||Such agencies shall place CJIS network devices in secure areas with adequate physical security to protect at all times against any unauthorized viewing or access to computer terminals, access devices or stored/printed data. This includes locations or vehicles housing Mobile Data Terminals (MDTs) or personal/laptop computers capable of accessing criminal justice information.|
|(3)||Such agencies shall institute reasonable procedures to protect any central depository of CHRI from unauthorized access, theft, sabotage or damage resulting from fire, wind, flood, power failure or other natural or manmade disaster s .|
|(4)||Such agencies operating computer systems connected to the Georgia CJIS network should provide adequate backup and recovery plans to protect these systems and ensure system recovery within minimal time. Recovery should focus on hardware and software.|
|(5)||Authorized personnel must accompany visitors to CJIS computer centers and/or terminal areas at all times. Access to terminal areas should be restricted to the minimum number of authorized employees required for operations.|
|(1)||Criminal justice agency employees, and other personnel as identified by the GCIC Director, who handle criminal justice information shall consent to investigations of their moral character, reputation and honesty. All applicants, including appropriate information technology (IT) personnel having access to CJIS systems information, shall submit to a state and national fingerprint-based identification check to be conducted within 30 days of employment, assignment or subsequent re-employment. Investigations should produce information sufficient to determine applicants' suitability and fitness for employment.|
|(2)||Criminal justice agencies, governmental dispatch centers and other governmental agencies handling criminal justice information shall disqualify applicants convicted by any state or the federal government of any felony, or have convictions of sufficient misdemeanors to establish a pattern of disregard for the law. If the applicant appears to be a fugitive or have an arrest history without conviction for a felony or serious misdemeanor, the Director or criminal justice agency head, or his/her designee, will review the matter and decide if access/employment is appropriate.|
|(3)||Giving false information shall disqualify applicants and be cause for employee dismissal.|
|(4)||Agencies identified in subparagraph (2) of this Rule shall establish security constraints for all personnel who work in secure areas where criminal justice information is stored, collected or disseminated. Terminal operators and practitioners shall access the CJIS network only for purposes within their authority. Each criminal justice agency authorized to access CJIS network information must have a written disciplinary policy for violators of GCIC Council Rules and GCIC/FBI CJIS Security Policy as amended.|
|(5)||Within their political subdivisions, criminal justice agencies must monitor the selection, utilization and retention of non-criminal justice personnel who are authorized direct access to criminal justice information in support of criminal justice operations.|
|(6)||All personnel whose jobs require them to access or process criminal justice information shall sign an Awareness Statement for permanent filing in the employees' personnel file. Should the content of the Awareness Statement change by act of law, action by the Director or other official act, agency heads shall direct their employees to sign amended Awareness Statement forms when provided by GCIC.|
|(1)|| GCIC processing procedures:
|(2)||An attorney may, upon written application and payment of fees, inspect and obtain a copy of his or her client's criminal history record maintained by GCIC.|
|(3)|| General processing procedures:
|(4)||Criminal history records determined by GCIC or other criminal justice agencies to be in error shall be corrected without undue delay; the record subject or attorney of representation shall be notified when record corrections have been made.|
|(5)||For criminal history records determined by GCIC or other criminal justice agencies as accurate, the individual may initiate further actions under the provisions of Georgia law.|
Rule 140-2-.11 Security Requirements for Criminal Justice Information in a Data Processing Environment
|(1)||Computers used to collect, store or disseminate CHRI shall be protected from unauthorized access by means of software or hardware control systems, which log all access attempts. Each individual authorized to store, process and/or transmit CJIS information will use a unique identifier. The unique identification is also required for personnel who administer and maintain the system. The unique identification can take the form of a full name, badge number, serial number or other unique alphanumeric identifier. The identifier shall be authenticated.|
|(2)|| CHRI transmitted
from one point to another by computer shall be protected from unauthorized
access by means of software or hardware control systems. Standards for control
systems outlined here must meet FBI CJIS Security Policy requirements.
|(3)||Computers storing or disseminating CHRI may perform logging activities pursuant to Rule 140-2-.06.|
|(4)||Computers and the agencies operating or administratively responsible for the operation of computers utilized in whole or part for the collection, storage, dissemination or message switching of CHRI shall be subject to GCIC audits pursuant to Rule 140-2-.07.|
|(5)||Physical security standards for these computers shall be maintained pursuant to Rule 140-2-.08.|
|(6)|| Personnel security standards for persons
employed to operate, program or maintain these computers shall be established
pursuant to Rule
140-2-.09 as follows:
|(7)||Secret data or CHRI contained in a computer system, whether dedicated or shared, shall be kept under maximum-security conditions. Documents containing secret data or CHRI no longer required to support criminal justice operations, must be destroyed in a secure manner that precludes unauthorized access to the information.|
|(8)||The agency administratively responsible for the supervision of persons, computer hardware or software assumes liability for any misuse of secret data or CHRI stored in a shared computer environment.|
|(1)||Each law enforcement agency is required by Georgia law (O.C.G.A. § 35-3-36) to participate in the Uniform Crime Reporting (UCR) program. GCIC is similarly required (O.C.G.A. § 35-3-33) to manage Georgia's UCR program and participate in the FBI's national UCR program.|
|(2)||Law enforcement agencies are required to submit UCR and Family Violence reports to GCIC in a manner prescribed by GCIC.|
|(3)||GCIC will provide general crime and offender data derived from UCR reports to the Governor, the General Assembly, state and local criminal justice agencies and the public.|
|(4)||Law enforcement agencies shall retain case file copies (or an equivalent) of incident and Family Violence reports in manual or automated format that supports active wanted/missing person and/or stolen serial numbered property records entered in GCIC/NCIC computerized files until these records are cleared, canceled or purged.|
|(5)||Local agency UCR program procedures, records and supporting documents are subject to GCIC and FBI audit.|
Responsible agencies shall enter (or cause entry of) information in GCIC and/or NCIC computerized files pertaining to wanted/missing persons, protected persons, sex offenders, unidentified deceased persons and serial-numbered property reported as stolen; entries shall be made when required data elements become available. O.C.G.A. § 35-3-36 requires agencies to enter records within 12 hours of determining that persons should be arrested or serial-numbered property was stolen. Provisions for entry of GCIC/NCIC computerized records regarding missing persons are contained in GCIC Council Rule 140-2-.15.
|(a)|| Criminal justice agencies accessing
Georgia's CJIS network shall use GCIC/NCIC codes, formats and operating
procedures when making record entries. GCIC will provide procedural manuals and
operations bulletins containing codes, procedures and guidance for record
entry. GCIC will also provide updates and revisions as needed.
|(b)||Criminal justice agencies accessing Georgia's CJIS network shall assist criminal justice and other authorized agencies by providing controlled and monitored network access.|
|(c)|| Each record entered in GCIC/NCIC
computerized files shall contain the ORI of the agency responsible for the
|(d)||Record entries shall be made within 12 hours of a determination by the investigating criminal justice agency that a wanted person should be arrested or serial-numbered property is stolen. Missing person record entries shall be made in accordance with Rule 140-2-.15(2)(a). Record entries shall be made within the above period as soon as minimum information for records is obtained. Agencies responsible for record entries shall take necessary actions to obtain minimum data to meet the 12-hour entry requirement.|
|(e)|| All record entries must have supporting
official documents that reflect initial and continuing efforts to apprehend
wanted persons, validate registered sex offender information, protect victims
of domestic violence, or recover identifiable, serial-numbered stolen property.
Arrest warrants must be available to support GCIC/NCIC wanted person record
|(f)|| Any agency with records entered in
GCIC/NCIC computerized files shall respond to hit confirmation request
messages. Responses may include notification that a specific amount of time
will be required for record verification or deemed as official verification.
record entries that are no longer valid must be removed immediately from
GCIC/NCIC computerized files.
|(h)||GCIC provides a computerized file for entry of abandoned motor vehicles recovered by law enforcement agencies and/or reported to them by wrecker service operators or vehicle storage facilities. Georgia law requires a law enforcement agency to make record entries, or have record entries made if the law enforcement agency does not have access to Georgia's CJIS network, in the designated GCIC computerized file. Georgia law also requires law enforcement agencies to furnish wrecker service operators, or vehicle storage facilities, with the name and address of the last known registered owner and title/lien holder information. Such information is available from the Georgia Department of Revenue via the CJIS network. The name and address of the last known owner of an abandoned vehicle registered in another state is available from that state's motor vehicle file through Nlets via a CJIS network inquiry. Georgia law further requires owners of abandoned motor vehicles, which later are determined as stolen, to receive recovery notification from law enforcement agencies after receiving reports that such vehicles were stolen. GCIC abandoned vehicle file records are automatically purged 90 days after entry if not removed sooner by entering agencies. NCIC does not maintain an abandoned vehicle file.|
All criminal justice agencies with wanted/missing persons, protected persons and/or stolen property record entries in GCIC and NCIC computerized files are required to participate in the record validation program established and administered by GCIC and NCIC.
|(a)||Record entries subject to validation are wanted/missing persons, protected persons, unidentified deceased persons, stolen vehicles, stolen guns, stolen boats, stolen securities, protection order records, records on violent gangs and terrorist organizations, persons on supervised released and abandoned vehicles.|
|(b)||GCIC produces monthly listings of record entries for validation. Specifically, a CJIS network terminal agency will receive a validation package for its own records and records established for another agency under a Holder of Record Agreement. When a CJIS network terminal agency establishes GCIC/NCIC records for another criminal justice agency the agency of record, not the terminal agency, will receive validation packages.|
|(c)||Agencies of record shall review validation listings by (1) comparing each record to supporting documentation such as the original arrest warrant (has it been served) and the court of jurisdiction; criminal case file (is information accurate, complete and valid); protection order; missing persons report, including available criminal history records; documented extradition limit changes, if any, from the District Attorney; wanted persons record; (2) checking with issuing authorities or prosecutors to determine if warrants remain valid or cases will be prosecuted; (3) determining from owners of stolen serial-numbered property if recovery has been made or ownership has changed; (4) verifying that missing persons have not returned; and, (5) contacting the Clerk of Superior Court to ensure Protection Orders are valid.|
|(d)||Agencies shall cancel record entries that are no longer valid.|
|(e)||Agencies shall modify record entries that contain erroneous information or are incomplete and create supplemental record entries as required when additional information becomes available.|
|(f)||When record entries are verified as accurate and current or have been modified or canceled, persons responsible for processing validation packages shall complete validation certification using procedures prescribed by GCIC.|
|(g)||Non-receipt of certification messages by GCIC cited suspense dates will result in the removal of all record entries contained in validation listings processed from GCIC/NCIC files.|
|(h)||Validation procedures, records and supporting documents are subject to GCIC and NCIC audits.|
|(1)||All law enforcement agencies shall collect information about each person reported missing by a parent, guardian or next of kin. Information about unknown deceased persons shall also be collected and preserved for identification purposes. Information collected includes physical descriptions, descriptions of clothing, dental charts, fingerprints if available and other personal data useful in identifying missing or unknown deceased persons.|
receiving missing person reports shall enter appropriate records in GCIC/NCIC
computerized files. Agencies investigating unknown deceased cases shall enter,
or authorize entry of, unidentified deceased persons in NCIC. In compliance
with federal law ( 42 USC
3701), GCIC will advise the
Georgia Missing Person Clearinghouse of all such record entries.
|(3)||Agencies authorizing entry of missing person and unidentified deceased person records shall cause these record entries to be removed from GCIC/NCIC computerized files immediately upon identification of missing or unidentified deceased persons.|
|(1)|| Criminal justice officials and agency
heads shall provide training and retraining, as required by policy, to ensure
their employees' effective performance of job-specific tasks relating to
|(2)||All personnel directly associated with maintaining, processing or disseminating CHRI shall be specially trained. The training shall provide a working knowledge of federal and state regulations and laws governing the security and processing of criminal justice information. Agency heads are responsible for ensuring their personnel receive such training as supported by the GCIC Policy Manual. In cases where agency head requests for training cannot be accommodated within a reasonable time, employees are required to read the Rules of the GCIC Council as contained herein. This will provide basic knowledge regarding the access, use, control and dissemination of criminal justice information until training occurs.|
|(3)||Managers of computer centers and governmental dispatch centers shall ensure that employees supporting criminal justice operations are trained to perform job-specific tasks relating to the functions described in paragraph (1) above.|
|(4)||Each CJIS network terminal agency head shall immediately appoint a TAC to serve as the agency point of contact on GCIC/NCIC record validations, hit confirmations, training and all other NCIC/CJIS network related matters. GCIC shall provide job-specific training for TACs and any assistant TACs.|
|(5)||TACs must be trained as CJIS terminal operators before admission to the TAC certification course. The minimum requirement is terminal operator practitioner.|
|(6)||TACs shall be subject to certification training and testing within 90 days of appointment.|
|(7)||Each TAC must attend a TAC refresher course, as required by GCIC policy, to maintain TAC certification.|
|(8)||Agency heads and TACs are responsible for developing agency specific policies and procedures relating to CJIS network operations and the administration of terminal operator and practitioner training programs developed by GCIC. Agency heads have discretion to designate CJIS network terminals users as either terminal operators or practitioners.|
|(9)||Terminal operators are subject to certification testing within six months of their employment or assignment of terminal operator duties and subject to re-certification testing every two years thereafter for the duration of their employment as terminal operators. Additionally, practitioners must receive training in the components of CJIS network operations they use in performing their official duties. Practitioners must also successfully complete performance tests administered by TACs and are subject to retesting every two years thereafter for the duration of their employment in which CJIS network access in necessary to complete job assignments.|
|(10)||The appointment of a TAC, the immediate appointment of a new TAC when required to fill a TAC vacancy, the training, testing and certification of the TAC, and the training, testing, certification and recertification of terminal operators and practitioners are mandatory for initial and on-going terminal agency status on the Georgia CJIS network.|
|(1)||Effective November 1998, the Federal Brady Law established a National Instant Criminal Background Check System (NICS) that Federal Firearms Licensees (FFLs) must contact before transferring any firearm to an unlicensed individual. GCIC has authority to provide criminal history, wanted person and involuntary hospitalization records information to the FBI in conjunction with the NICS and in accordance with the federal 'Brady Handgun Violence Prevention Act'.|
|(2)||GCIC records shall include information as to whether a person has been involuntarily hospitalized. Notwithstanding any other provisions of law, and in order to carry out O.C.G.A § 16-11-172, GCIC shall be provided - in a manner agreed upon by the Probate Judges Training Council and the Georgia Bureau of Investigation (GBI) - such information and no other mental health information, to preserve the confidentiality of patient's rights in all other respects, from the involuntary hospitalization records of the probate courts concerning persons involuntarily hospitalized after March 22, 1995. Further, notwithstanding any other provisions of law and in order to carry out the provisions of O.C.G.A. § 16-11-172, GCIC shall be provided information as to whether a person has been adjudicated mentally incompetent to stand trial or not guilty by reason of insanity at the time of the crime, has been involuntarily hospitalized or both from the records of the clerks of the superior courts concerning persons involuntarily hospitalized after March 22, 1995, in a manner agreed upon by the Council of Superior Court Clerks of Georgia and the GBI to preserve the confidentiality of patient's rights in all other respects. Five years from the date that GCIC receives a person's involuntary hospitalization information, the center shall purge its records of such information as soon as practicable and, in any event, within 30 days of the expiration of such five-year period.|
|(1)|| Georgia law places responsibility for the
establishment, operation and management of a sexually violent offender registry
within the Georgia Bureau of Investigation and principally, GCIC. Accordingly,
GCIC will perform the following functions:
|(2)||The Department of Corrections, State Board of Pardons and Paroles and the Director of Private Probation agencies will enter sex offender records on the registry. They will submit updates including photos to the CJIS file as prescribed by statute and GCIC policy.|
sheriff must maintain accurate information on all registered sex offenders
residing within their jurisdiction, as required by law.
Georgia law places responsibility for the establishment, operation and
management of a protective order registry within the GBI and principally, GCIC.
Accordingly, GCIC will perform the following functions:
Superior Court Clerk will scan the protective orders issued by the judge and
enter data requested, if available, required by NCIC.
|(3)|| Each Sheriff shall be responsible for the
validation of all NCIC protective order entries made on its behalf by the
Superior Court Clerks office.
|(4)|| The Courts
of this state shall use a standardized form or forms for the issuance of any
|(1)||Criminal justice agencies, governmental dispatch centers and other governmental agencies are subject to GCIC administrative sanctions for violating laws governing operation of the CJIS network, these Rules or CJIS network policies published by GCIC pursuant to O.C.G.A. § 35-3-33(13). Administrative sanctions for terminal agencies may include, but not limited to purging wanted/missing person and stolen property serial-numbered records entered in GCIC/NCIC computerized files by CJIS network agencies or established by these agencies for non-terminal agencies pursuant to signed service agreements; restricted access to the CJIS network; and suspension/revocation of an agency's CJIS network access.|
|(2)||Administrative sanctions may be imposed on individual violators. Such sanctions may include mandatory re-training and/or re-certification of TACs, terminal operators and/or practitioners and suspension from access to the CJIS network.|
|(3)||Individual violators are also subject to criminal prosecution when their actions constitute violations of applicable state or federal statutes.|