DEPARTMENT OF STATE POLICE

CRIMINAL JUSTICE INFORMATION CENTER

CRIMINAL JUSTICE INFORMATION SYSTEMS

Filed with the secretary of state on March 19, 2021

These rules take effect immediately upon filing with the secretary of state unless adopted

under section 33, 44, or 45a(6) of the administrative procedures act of 1969, 1969 PA

306, MCL 24.233, 24.244, or 24.245a. Rules adopted under these sections become

effective 7 days after filing with the secretary of state.

(By authority conferred on the department of state police by section 4 of the C.J.I.S.

policy council act, 1974 PA 163, MCL 28.214, and Executive Reorganization Order No.

2008-2, MCL 28.162)

R 28.5101, R 28.5201, R 28.5202, R 28.5208, R 28.5209, R 28.5401, R 28.5402, and R

28.5414 of the Michigan Administrative Code are amended, R 28.5102, R 28.5210, and

R 28.5211 are added, and R 28.5404 is rescinded, as follows:

PART 1. GENERAL PROVISIONS

R 28.5101 Definitions.

Rule 101. As used in these rules:

(a) "Access" means the physical or electronic ability, right, or privilege to view,

modify, or make use of CJIS and CJI.

(b) "Administration of criminal justice" or "criminal justice purpose" means the

performance of any of the following activities:

(i) Detection, apprehension, detention, pretrial release, post-trial release, prosecution,

adjudication, correctional supervision, or rehabilitation of accused persons or criminal

offenders.

(ii) Identification of criminals.

(iii) Collection, storage, and dissemination of CJI.

(iv) Criminal justice agency employment.

(c) “Automated Fingerprint Identification System” (AFIS) means the system

maintained and operated by the department that collects and processes fingerprints and

palm prints and disseminates related information.

(d) "Automated Law Enforcement Information Access System” (ALIAS) means the

system maintained by the department that collects and disseminates criminal and juvenile

identification and records, pursuant to 1925 PA 289, MCL 28.241 to 28.248.

(e) "Biometric data" means data derived from 1 or more intrinsic physical or behavioral

traits of humans typically for the purpose of uniquely identifying individuals, including

fingerprints, palm prints, iris scans, and facial images.

(f) "CJI" means criminal justice information.

(g) "CJIS" means criminal justice information systems.

August 10, 2020

2

(h) "CJIS Information Security Officer" means the person designated to administer the

CJI security program. The CJIS Information Security Officer is an employee of the CSA.

The CJIS Information Security Officer serves as the internal and external point of contact

for all CJIS information security matters and ensures that each agency having access to

CJI has a security point of contact.

(i) "CJIS Systems Agency" means the criminal justice agency that provides access to

CJI from systems managed by the FBI Criminal Justice Information Services Division

within a district, state, territory, or federal agency, as designated by the FBI, and has

overall responsibility for establishing and administering an information technology

security program throughout the CSA’s user community. The CSA for this state is the

department.

(j) "CJIS Systems Officer" means a member of the CSA, selected by the head of the

CSA, having the ultimate responsibility for the administration of the CJIS network on

behalf of the CSA, including setting and enforcing standards for personnel accessing CJI

and policies governing components of CJIS and related systems used to process, store, or

transmit CJI; ensuring appropriate use of CJIS and CJI, compliance with approved

polices, and that the CJIS Information Security Officer and Local Agency Security

Officers are appointed; and approving access to CJIS and FBI criminal justice

information services systems.

(k) "CSA" means the CJIS Systems Agency.

(l) "CSO" means the CJIS Systems Officer.

(m) "Criminal justice agency" means a court or other governmental agency, or any

subunit of the court or governmental agency, that engages in the administration of

criminal justice pursuant to a statute or executive order and that allocates a substantial

part of its annual budget for the administration of criminal justice. The federal and state

Inspectors General Offices are considered criminal justice agencies.

(n) "Criminal justice information" means data (electronic or hard copy) obtained from

LEIN, AFIS, ALIAS, or SNAP, including, but not limited to, biometric, identity history,

person, organization, and property data.

(o) "Criminal justice information systems" means the LEIN, AFIS, ALIAS or SNAP

systems.

(p) "Department" means the Michigan department of state police.

(q) "Dissemination" means the transmission, distribution, and disclosure of CJI.

(r) "FBI" means the Federal Bureau of Investigation.

(s) "Hot files" means databases maintained by the department that collects and

disseminates information pertaining to wanted and missing persons, probation orders,

mental health orders, jail or lockup information, and stolen, abandoned, or impounded

property.

(t) "Law Enforcement Information Network" means the communication network that

collects and disseminates CJI to authorized Michigan CJIS user agencies; is the message

switch that provides access to various state and national databases; and is the hot files and

PPO databases.

(u) "LEIN" means the Law Enforcement Information Network.

(v) "National Crime information Center" means the nationwide, computerized

information system established as a service to all criminal justice agencies operated by

the FBI Criminal Justice Information Services Division.

3

(w) "NCIC" means the National Crime Information Center.

(x) "Personally Identifiable Information" means information that can be used to

distinguish or trace an individual’s identity, such as social security number, or biometric

records, alone; or name, when combined with other personal or identifying information

that is linked or linkable to a specific individual, such as date and place of birth, or

mother’s maiden name.

(y) "PII" means personally identifiable information.

(z) "PPO database" means the database maintained by the department that collects and

disseminates information pertaining to personal protection orders, pursuant to section

2950 and 2950a of the revised judicature act of 1961, 1961 PA 236, MCL 600.2950 and

600.2950a; conditional bond release orders, pursuant to section 6b of chapter V of the

code of criminal procedure, 1927 PA 175, MCL 765.6b; and child abuse prevention

orders, pursuant to section 13a of chapter XIIA of the probate code of 1939, 1939 PA

288, MCL 712A.13a.

(aa) "SNAP" means the Statewide Network of Agency Photos.

(bb) "Statewide Network of Agency Photos" means the system maintained by the

department that collects and disseminates images and related information.

R 28.5102. Noncriminal justice agency access to certain CJI for noncriminal justice

purposes.

Rule 102. (1) Notwithstanding any provision within these rules, access to CJI that is

criminal history record information for a noncriminal justice purpose is not subject to

these rules but remains subject to all applicable federal and state law, the FBI Criminal

Justice Information Services Security Policy, the Michigan Addendum to the FBI

Criminal Justice Information Services Security Policy, and any procedures or

requirements established by the department.

(2) As used in this rule, "noncriminal justice purpose" means access to CJI that is

criminal history record information for use in connection with licensing or employment,

or for a purpose unrelated to the administration of criminal justice that is not otherwise

regulated under these rules, as authorized under federal law or a state statute pursuant to

Public Law 92-544.

PART 2. ACCESS, ELIGIBILITY, AND DATA DISSEMINATION PROVISIONS

R 28.5201 Agency authorization for CJIS and CJI access.

Rule 201. (1) Access to CJIS and CJI is restricted to the following:

(a) A criminal justice agency.

(b) A nongovernmental agency that is statutorily vested with arrest powers and has

the primary function of the administration of criminal justice.

(c) A governmental agency or private contractor designated to perform criminal

justice functions, as described under the following sections of the FBI Criminal Justice

Information Services Security Policy, if the agency or contractor and the designating

agency enter into an agreement that incorporates a management control agreement or

CJIS Security Addendum, as applicable, and otherwise complies with any procedure or

requirement prescribed by the department:

(i) Section 5.1.1.4, Interagency and Management Control Agreements.

4

(ii) Section 5.1.1.5, Private Contractor User Agreements and CJIS Security

Addendum.

(d) The department of state.

(e) An agency authorized by statute.

(f) An agency approved by the CSO for criminal justice or official law enforcement

purposes.

(2) To obtain CSO approval as an authorized agency to access CJIS, CJI, or both, an

agency shall do all the following:

(a) Complete an application and user agreement as required by the department.

(b) Assume all costs associated with the agency’s connection to CJIS, including, but

not limited to, the leasing of hardware from the department.

(c) Agree to pay fees for access or dissemination, as required in R 28.5414.

(d) Agree to comply with applicable state and federal statutes, these rules, the FBI

Criminal Justice Information Services Security Policy, the Michigan Addendum to the

FBI Criminal Justice Information Services Security Policy, and any procedures or

requirements prescribed by the department.

(3) An authorized agency shall notify the CSO in writing to obtain approval before

making any changes affecting the agency’s access or connection to CJIS, as required by

the department.

R 28.5202 CJIS or CJI access; deny, limit, or terminate.

Rule 202. The CSO may deny, limit, or terminate an individual's or agency's access to

CJIS, CJI, or both for 1 or more of the following reasons:

(a) Failure to cooperate with a request from the CSO or the department for investigation

of misuse of CJIS or CJI.

(b) Violation of, or noncompliance with, these rules, applicable federal and state law,

the FBI Criminal Justice Information Services Security Policy, the Michigan Addendum

to the FBI Criminal Justice Information Services Security Policy, or any procedures or

requirements prescribed by the department.

R 28.5208 CJIS and CJI access and dissemination.

Rule 208.

(1) Agencies that access CJIS and CJI shall comply with these rules.

(2) CJIS and CJI must only be accessed and used for the following purposes:

(a) The administration of criminal justice or official law enforcement purposes.

(b) For purposes consistent with the registration and regulation of vehicles, the

licensing of drivers, and the REAL ID Act of 2005, Public Law 109-13, as authorized by

law.

(c) For purposes consistent with the enforcement of child support laws, child

protection laws, or vulnerable adult protection laws, as authorized by law.

(d) For any other purposes if, and to the extent, authorized by law.

(3) Except as permitted in these rules or if authorized by statute, CJI must not be

disseminated to an unauthorized agency, entity, or person, unless any of the following

apply and a printout produced from LEIN or NCIC is not provided:

(a) A criminal justice agency may communicate CJI to an individual or his or her

legal representative regarding an active warrant, personal protection order, conditional

5

bond order, or probation order pertaining to that individual, if the individual is identified

to the satisfaction of the criminal justice agency.

(b) A criminal justice agency may communicate CJI to an individual or his or her

legal representative regarding an active order or disposition entered under section 464a of

the mental health code, 1974 PA 258, MCL 330.1464a, for involuntary hospitalization or

treatment, or under section 5107 of the estates and protected individuals code, 1998 PA

386, MCL 700.5107, for legal incapacitation, if the individual or his or her legal

representative appears in-person and has been identified to the satisfaction of the criminal

justice agency.

(c) For the purpose of resolving outstanding warrants, a criminal justice agency may

communicate warrant information, excluding PII, to an individual when a warrant from

any jurisdiction is active in either LEIN or NCIC regarding an individual that is under the

jurisdiction or supervision of that criminal justice agency.

(4) Subject to subrule (5) of this rule, a person shall not access or disseminate CJI for

personal use or gain.

(5) In the absence of a criminal justice purpose a criminal justice agency may only

confirm to an individual whether an active warrant, a missing person, or report of stolen

property exists in LEIN or NCIC from any jurisdiction if all of the following conditions

are met:

(a) The person or property being queried has been identified to the satisfaction of the

criminal justice agency.

(b) A printout produced from LEIN or NCIC is not provided.

(c) A request for information in bulk is not processed.

(6) A criminal justice agency may charge a nominal fee for information provided under

subrule (5) of this rule.

(7) A court may disseminate CJI to the extent necessary for the creation and

maintenance of a court record, as defined by MCR 1.109 and 8.119. Any further

dissemination of CJI that is, or is part of, a court record must be otherwise authorized by

law or these rules.

(8) Images and associated name, sex, and age obtained from SNAP may be publicly

disseminated by a federal, state, or local governmental agency for an official law

enforcement purpose or as necessary to comply with a law of this state or of the United

States.

(9) Statistical information obtained from CJIS may be released by the department to

any individual or public or private entity upon approval by the CSO, whether or not for a

purpose otherwise expressed in these rules. Statistical information must not contain PII

or identifying information of any property.

R 28.5209 Transaction Logs; release.

Rule 209. (1) Subject to subrule (3) of this rule, an authorized agency's transaction logs

may only be released if the information is released under R 28.5208(2)(a) for a criminal

justice or official law enforcement purpose and either of the following conditions apply:

(a) Upon written request from a local, county, state, or federal criminal justice agency

that specifies that the information is required for a criminal justice or official law

enforcement purpose.

6

(b) As required under a search warrant or court order authorized by a judge or

magistrate.

(2) Subject to subrule (3) of this rule, an authorized agency listed under R 28.5201(1)

that is not a criminal justice agency may only receive information from transaction logs if

the information is released under R 28.5208(2)(b) or (c) and the agency's receipt of the

information is authorized by law or rule.

(3) An authorized agency's transaction logs may be released for a purpose not listed

under R 28.5208(2) if the records are essential to issues raised in an administrative

hearing or civil action related to the misuse or accuracy of CJIS, and the records are

sought pursuant to a court order or subpoena authorized by a judge, magistrate, or

administrative hearing officer.

(4) Information or records released under this rule must not be accessed or disseminated

for any other purpose unless authorized by law or rule.

R 28.5210 Department release of CJI for certain research, statistical, or governmental

projects.

Rule 210. (1) The department may disseminate CJI from AFIS, ALIAS, or SNAP for

research, statistical, or governmental projects in accordance with this rule.

(2) The department shall not disseminate CJI under this rule unless all of the following

apply:

(a) The CSO has approved of the proposed dissemination of CJI upon determination

that the criteria described in subrule (3) of this rule have been met.

(b) The recipient of the CJI is an agency or entity listed under R 28.5201, an

academic institution, or a government entity.

(c) The recipient of the CJI has submitted to the department a completed user

agreement, in a manner determined by the department, stipulating to all of the following:

(i) Any CJI disseminated by the department shall only be used for the proposed

project, and the recipient of the CJI shall not disseminate the CJI for any purpose.

(ii) The recipient of the CJI shall destroy the CJI immediately after the CJI is no

longer needed for the approved project or the approved project has concluded, whichever

occurs first.

(iii) The recipient of the CJI shall comply with any applicable federal and state law,

these rules, the FBI Criminal Justice Information Services Security Policy, the Michigan

Addendum to the FBI Criminal Justice Information Services Security Policy, and any

procedures or requirements prescribed by the department.

(iv) The department shall not disseminate CJI that is non-public or is otherwise

prohibited from being disseminated by state or federal law.

(v) Any CJI disseminated by the department shall not contain PII, unless the

dissemination of the PII is lawful and approved by the CSO.

(3) The CSO may approve or deny a proposal for the dissemination of CJI under this

rule. The CSO shall ensure the following criteria are met before approving the proposed

dissemination of CJI:

(a) The proposed project is funded in full or in part with grant or public funds.

(b) The proposed project is for the purpose of developing and measuring, evaluating,

or otherwise advancing the state of knowledge in a particular area, or if the recipient of

7

the CJI is a governmental entity, the purpose is intended to advance a public purpose

related to the government entity's official functions.

(c) The department would not be unreasonably burdened by the proposed project or

adequately processing the proposed dissemination of CJI. An unreasonable burden

includes, but is not limited to, any of the following:

(i) Excessive financial or operational resources are required to adequately process

the proposed dissemination of CJI or to provide oversight of the proposed project to

ensure compliance with this rule, including the user agreement under subrule (2) of this

rule.

(ii) The proposed project's direct or indirect benefit to the department does not

justify the financial or operational resources necessary to adequately process the

proposed dissemination of CJI or to oversee the proposed project to ensure compliance

with this rule, including the user agreement under subrule (2) of this rule.

(iii) The proposed project or dissemination of CJI may cause undue disruption to

the department or bring the department or its employees or agents into disrepute.

(4) The determination of the CSO under subrule (3) of this rule is final and is not

subject to appeal or challenge. The CSO shall, within a reasonable period of time,

provide to the department and the proposed recipient of the CJI a written explanation for

the reason or reasons supporting the CSO's denial or approval of the proposed

dissemination of CJI.

R 28.5211 Dissemination of CJI for certain mass casualty, catastrophic, or unforeseen

events.

Rule 211. The department may disseminate CJI, with the approval of the CSO and the

director, for the following purposes:

(a) A mass casualty or catastrophic event where the dissemination of CJI is necessary

for the identification of victims. As used in this subdivision:

(i) “Mass casualty” means any number of casualties or victims that exceed the

resources normally available from local resources.

(ii) “Catastrophic event” includes, but is not limited to, a governor’s or Presential

declaration of a disaster or state of emergency, natural disaster, etc.

(b) Any unforeseen circumstances where the disclosure of CJI is immediately

necessary in the interest of homeland security.

PART 4. RECORDS

R 28.5401 Records responsibility.

Rule 401. (1) An agency is responsible for the accuracy and completeness of any

record it enters into CJIS. Each record must be identified with the agency that entered

the record. Each agency shall validate records as required by Michigan and FBI CJIS

policies. Both of the following apply:

(a) An agency that fails to comply with the validation and certification requirements

within the prescribed time period shall have its records removed from CJIS as required by

Michigan and FBI CJIS policies.

(b) An agency that requires more than the specified time to validate its records shall

submit a written request to the CSO for a reasonable time extension.

8

(2) Agencies may execute an agreement to allow an agency to enter records for another

agency.

(3) An agency shall maintain complete and accurate files of all active records that are

entered into CJIS and shall ensure that the files are readily accessible to any person who

is responsible for confirming the validity of records upon inquiry. Both of the following

apply:

(a) An agency shall establish procedures to ensure that, upon inquiry, all records that

are entered into either LEIN or NCIC files can be promptly confirmed as valid.

(b) An agency shall either maintain a 24-hour-a-day, seven-days-a-week operation or

shall establish an alternative record verification procedure.

R 28.5402 Timely entry and removal of records.

Rule 402. (1) An agency shall ensure all records are immediately entered into CJIS,

unless immediate entry may jeopardize a criminal investigation.

(2) All records must be entered into CJIS pursuant to the procedures provided by the

CSO and any applicable statute. Agencies shall ensure records are successfully entered

into the appropriate CJIS.

(3) An agency shall immediately remove a record from CJIS when the record is no

longer valid. Agencies shall ensure records are successfully removed from the

appropriate CJIS.

(4) A court may enter or remove a record if there is a mutual agreement of all agencies

involved.

(5) Pursuant to section 26a of chapter IV of the code of criminal procedure, 1927 PA

175, MCL 764.26a, and section 3 of 1925 PA 289, MCL 28.243, upon receipt of an

appropriate order entered by district or circuit court in a case in which any criminal

charge resulting in an arrest is dismissed before trial, the department shall destroy and

expunge the arrest record and biometric data existing because of the dismissed charge or

charges and remove any LEIN entry concerning the dismissed charge or charges. As

used in this subrule, an "appropriate order" is a written order that explicitly directs the

department to destroy and expunge the arrest record and biometric data and remove any

LEIN entry concerning the charge or charges dismissed before trial and identifies the

charged individual and the applicable case number.

(6) A record may be removed from CJIS if the CSO has a substantial question

concerning the record's validity or accuracy. Immediately upon the removal of any

record, the CSO shall notify the entering agency of the action taken.

R 28.5404 Rescinded.

R 28.5414 Fees for access to information from CJIS.

Rule 414. The department shall assess a one-time agency fee of $1.00 for access to

information from CJIS. The department may waive this fee.