28 CFR 22.23 - Privacy certification.

§ 22.23 Privacy certification.

(a) Each applicant for BJA, OJJDP, BJS, NIJ, or OJP support either directly or under a State plan shall submit a Privacy Certificate as a condition of approval of a grant application or contract proposal which has a research or statistical project component under which information identifiable to a private person will be collected.

(b) The Privacy Certificate shall briefly describe the project and shall contain assurance by the applicant that:

(1) Data identifiable to a private person will not be used or revealed, except as authorized under §§ 22.21, 22.22.

(2) Access to data will be limited to those employees having a need therefore and that such persons shall be advised of and agree in writing to comply with these regulations.

(3) All subcontracts which require access to identifiable data will contain conditions meeting the requirements of § 22.24.

(4) To the extent required by § 22.27 any private persons from whom identifiable data are collected or obtained, either orally or by means of written questionnaire, shall be advised that the data will only be used or revealed for research or statistical purposes and that compliance with requests for information is not mandatory. Where the notification requirement is to be waived, pursuant to § 22.27(c), a justification must be included in the Privacy Certificate.

(5) Adequate precautions will be taken to insure administrative and physical security of identifiable data.

(6) A log will be maintained indicating that identifiable data have been transmitted to persons other than BJA, OJJDP, BJS, NIJ, or OJP or grantee/contractor staff or subcontractors, that such data have been returned, or that alternative arrangements have been agreed upon for future maintenance of such data.

(7) Project plans will be designed to preserve anonymity of private persons to whom information relates, including, where appropriate, name-stripping, coding of data, or other similar procedures.

(8) Project findings and reports prepared for dissemination will not contain information which can reasonably be expected to be identifiable to a private person except as authorized under § 22.22.

(c) The applicant shall attach to the Privacy Certification a description of physical and/or administrative procedures to be followed to insure the security of the data to meet the requirements of § 22.25.

[ 41 FR 5486, Dec. 15, 1976, as amended at 51 FR 6401, Feb. 24, 1986]

Title 28 published on 10-Apr-2018 03:56

The following are ALL rules, proposed rules, and notices (chronologically) published in the Federal Register relating to 28 CFR Part 22 after this date.

  • 2016-06-30; vol. 81 # 126 - Thursday, June 30, 2016
    1. 81 FR 42491 - Civil Monetary Penalties Inflation Adjustment
      GPO FDSys XML | Text
      Interim final rule with request for comments.
      Effective date: This rule is effective August 1, 2016. Public comments: Written comments must be postmarked and electronic comments must be submitted on or before August 29, 2016. Commenters should be aware that the electronic Federal Docket Management System (FDMS) will accept comments submitted prior to Midnight Eastern Time on the last day of the comment period.
      28 CFR Parts 20, 22, 36, 68, 71, 76, and 85
The section you are viewing is cited by the following CFR sections.