DEPARTMENT OF STATE POLICE  
CRIMINAL JUSTICE INFORMATION CENTER  
CRIMINAL JUSTICE INFORMATION SYSTEMS  
Filed with the secretary of state on March 19, 2021  
These rules take effect immediately upon filing with the secretary of state unless adopted  
under section 33, 44, or 45a(6) of the administrative procedures act of 1969, 1969 PA  
306, MCL 24.233, 24.244, or 24.245a. Rules adopted under these sections become  
effective 7 days after filing with the secretary of state.  
(By authority conferred on the department of state police by section 4 of the C.J.I.S.  
policy council act, 1974 PA 163, MCL 28.214, and Executive Reorganization Order No.  
2008-2, MCL 28.162)  
R 28.5101, R 28.5201, R 28.5202, R 28.5208, R 28.5209, R 28.5401, R 28.5402, and R  
28.5414 of the Michigan Administrative Code are amended, R 28.5102, R 28.5210, and  
R 28.5211 are added, and R 28.5404 is rescinded, as follows:  
PART 1. GENERAL PROVISIONS  
R 28.5101 Definitions.  
Rule 101. As used in these rules:  
(a) "Access" means the physical or electronic ability, right, or privilege to view,  
modify, or make use of CJIS and CJI.  
(b) "Administration of criminal justice" or "criminal justice purpose" means the  
performance of any of the following activities:  
(i) Detection, apprehension, detention, pretrial release, post-trial release, prosecution,  
adjudication, correctional supervision, or rehabilitation of accused persons or criminal  
offenders.  
(ii) Identification of criminals.  
(iii) Collection, storage, and dissemination of CJI.  
(iv) Criminal justice agency employment.  
(c) “Automated Fingerprint Identification System” (AFIS) means the system  
maintained and operated by the department that collects and processes fingerprints and  
palm prints and disseminates related information.  
(d) "Automated Law Enforcement Information Access System” (ALIAS) means the  
system maintained by the department that collects and disseminates criminal and juvenile  
identification and records, pursuant to 1925 PA 289, MCL 28.241 to 28.248.  
(e) "Biometric data" means data derived from 1 or more intrinsic physical or behavioral  
traits of humans typically for the purpose of uniquely identifying individuals, including  
fingerprints, palm prints, iris scans, and facial images.  
(f) "CJI" means criminal justice information.  
(g) "CJIS" means criminal justice information systems.  
August 10, 2020  
2
(h) "CJIS Information Security Officer" means the person designated to administer the  
CJI security program. The CJIS Information Security Officer is an employee of the CSA.  
The CJIS Information Security Officer serves as the internal and external point of contact  
for all CJIS information security matters and ensures that each agency having access to  
CJI has a security point of contact.  
(i) "CJIS Systems Agency" means the criminal justice agency that provides access to  
CJI from systems managed by the FBI Criminal Justice Information Services Division  
within a district, state, territory, or federal agency, as designated by the FBI, and has  
overall responsibility for establishing and administering an information technology  
security program throughout the CSA’s user community. The CSA for this state is the  
department.  
(j) "CJIS Systems Officer" means a member of the CSA, selected by the head of the  
CSA, having the ultimate responsibility for the administration of the CJIS network on  
behalf of the CSA, including setting and enforcing standards for personnel accessing CJI  
and policies governing components of CJIS and related systems used to process, store, or  
transmit CJI; ensuring appropriate use of CJIS and CJI, compliance with approved  
polices, and that the CJIS Information Security Officer and Local Agency Security  
Officers are appointed; and approving access to CJIS and FBI criminal justice  
information services systems.  
(k) "CSA" means the CJIS Systems Agency.  
(l) "CSO" means the CJIS Systems Officer.  
(m) "Criminal justice agency" means a court or other governmental agency, or any  
subunit of the court or governmental agency, that engages in the administration of  
criminal justice pursuant to a statute or executive order and that allocates a substantial  
part of its annual budget for the administration of criminal justice. The federal and state  
Inspectors General Offices are considered criminal justice agencies.  
(n) "Criminal justice information" means data (electronic or hard copy) obtained from  
LEIN, AFIS, ALIAS, or SNAP, including, but not limited to, biometric, identity history,  
person, organization, and property data.  
(o) "Criminal justice information systems" means the LEIN, AFIS, ALIAS or SNAP  
systems.  
(p) "Department" means the Michigan department of state police.  
(q) "Dissemination" means the transmission, distribution, and disclosure of CJI.  
(r) "FBI" means the Federal Bureau of Investigation.  
(s) "Hot files" means databases maintained by the department that collects and  
disseminates information pertaining to wanted and missing persons, probation orders,  
mental health orders, jail or lockup information, and stolen, abandoned, or impounded  
property.  
(t) "Law Enforcement Information Network" means the communication network that  
collects and disseminates CJI to authorized Michigan CJIS user agencies; is the message  
switch that provides access to various state and national databases; and is the hot files and  
PPO databases.  
(u) "LEIN" means the Law Enforcement Information Network.  
(v) "National Crime information Center" means the nationwide, computerized  
information system established as a service to all criminal justice agencies operated by  
the FBI Criminal Justice Information Services Division.  
3
(w) "NCIC" means the National Crime Information Center.  
(x) "Personally Identifiable Information" means information that can be used to  
distinguish or trace an individual’s identity, such as social security number, or biometric  
records, alone; or name, when combined with other personal or identifying information  
that is linked or linkable to a specific individual, such as date and place of birth, or  
mother’s maiden name.  
(y) "PII" means personally identifiable information.  
(z) "PPO database" means the database maintained by the department that collects and  
disseminates information pertaining to personal protection orders, pursuant to section  
2950 and 2950a of the revised judicature act of 1961, 1961 PA 236, MCL 600.2950 and  
600.2950a; conditional bond release orders, pursuant to section 6b of chapter V of the  
code of criminal procedure, 1927 PA 175, MCL 765.6b; and child abuse prevention  
orders, pursuant to section 13a of chapter XIIA of the probate code of 1939, 1939 PA  
288, MCL 712A.13a.  
(aa) "SNAP" means the Statewide Network of Agency Photos.  
(bb) "Statewide Network of Agency Photos" means the system maintained by the  
department that collects and disseminates images and related information.  
R 28.5102. Noncriminal justice agency access to certain CJI for noncriminal justice  
purposes.  
Rule 102. (1) Notwithstanding any provision within these rules, access to CJI that is  
criminal history record information for a noncriminal justice purpose is not subject to  
these rules but remains subject to all applicable federal and state law, the FBI Criminal  
Justice Information Services Security Policy, the Michigan Addendum to the FBI  
Criminal Justice Information Services Security Policy, and any procedures or  
requirements established by the department.  
(2) As used in this rule, "noncriminal justice purpose" means access to CJI that is  
criminal history record information for use in connection with licensing or employment,  
or for a purpose unrelated to the administration of criminal justice that is not otherwise  
regulated under these rules, as authorized under federal law or a state statute pursuant to  
Public Law 92-544.  
PART 2. ACCESS, ELIGIBILITY, AND DATA DISSEMINATION PROVISIONS  
R 28.5201 Agency authorization for CJIS and CJI access.  
Rule 201. (1) Access to CJIS and CJI is restricted to the following:  
(a) A criminal justice agency.  
(b) A nongovernmental agency that is statutorily vested with arrest powers and has  
the primary function of the administration of criminal justice.  
(c) A governmental agency or private contractor designated to perform criminal  
justice functions, as described under the following sections of the FBI Criminal Justice  
Information Services Security Policy, if the agency or contractor and the designating  
agency enter into an agreement that incorporates a management control agreement or  
CJIS Security Addendum, as applicable, and otherwise complies with any procedure or  
requirement prescribed by the department:  
(i) Section 5.1.1.4, Interagency and Management Control Agreements.  
4
(ii) Section 5.1.1.5, Private Contractor User Agreements and CJIS Security  
Addendum.  
(d) The department of state.  
(e) An agency authorized by statute.  
(f) An agency approved by the CSO for criminal justice or official law enforcement  
purposes.  
(2) To obtain CSO approval as an authorized agency to access CJIS, CJI, or both, an  
agency shall do all the following:  
(a) Complete an application and user agreement as required by the department.  
(b) Assume all costs associated with the agency’s connection to CJIS, including, but  
not limited to, the leasing of hardware from the department.  
(c) Agree to pay fees for access or dissemination, as required in R 28.5414.  
(d) Agree to comply with applicable state and federal statutes, these rules, the FBI  
Criminal Justice Information Services Security Policy, the Michigan Addendum to the  
FBI Criminal Justice Information Services Security Policy, and any procedures or  
requirements prescribed by the department.  
(3) An authorized agency shall notify the CSO in writing to obtain approval before  
making any changes affecting the agency’s access or connection to CJIS, as required by  
the department.  
R 28.5202 CJIS or CJI access; deny, limit, or terminate.  
Rule 202. The CSO may deny, limit, or terminate an individual's or agency's access to  
CJIS, CJI, or both for 1 or more of the following reasons:  
(a) Failure to cooperate with a request from the CSO or the department for investigation  
of misuse of CJIS or CJI.  
(b) Violation of, or noncompliance with, these rules, applicable federal and state law,  
the FBI Criminal Justice Information Services Security Policy, the Michigan Addendum  
to the FBI Criminal Justice Information Services Security Policy, or any procedures or  
requirements prescribed by the department.  
R 28.5208 CJIS and CJI access and dissemination.  
Rule 208.  
(1) Agencies that access CJIS and CJI shall comply with these rules.  
(2) CJIS and CJI must only be accessed and used for the following purposes:  
(a) The administration of criminal justice or official law enforcement purposes.  
(b) For purposes consistent with the registration and regulation of vehicles, the  
licensing of drivers, and the REAL ID Act of 2005, Public Law 109-13, as authorized by  
law.  
(c) For purposes consistent with the enforcement of child support laws, child  
protection laws, or vulnerable adult protection laws, as authorized by law.  
(d) For any other purposes if, and to the extent, authorized by law.  
(3) Except as permitted in these rules or if authorized by statute, CJI must not be  
disseminated to an unauthorized agency, entity, or person, unless any of the following  
apply and a printout produced from LEIN or NCIC is not provided:  
(a) A criminal justice agency may communicate CJI to an individual or his or her  
legal representative regarding an active warrant, personal protection order, conditional  
5
bond order, or probation order pertaining to that individual, if the individual is identified  
to the satisfaction of the criminal justice agency.  
(b) A criminal justice agency may communicate CJI to an individual or his or her  
legal representative regarding an active order or disposition entered under section 464a of  
the mental health code, 1974 PA 258, MCL 330.1464a, for involuntary hospitalization or  
treatment, or under section 5107 of the estates and protected individuals code, 1998 PA  
386, MCL 700.5107, for legal incapacitation, if the individual or his or her legal  
representative appears in-person and has been identified to the satisfaction of the criminal  
justice agency.  
(c) For the purpose of resolving outstanding warrants, a criminal justice agency may  
communicate warrant information, excluding PII, to an individual when a warrant from  
any jurisdiction is active in either LEIN or NCIC regarding an individual that is under the  
jurisdiction or supervision of that criminal justice agency.  
(4) Subject to subrule (5) of this rule, a person shall not access or disseminate CJI for  
personal use or gain.  
(5) In the absence of a criminal justice purpose a criminal justice agency may only  
confirm to an individual whether an active warrant, a missing person, or report of stolen  
property exists in LEIN or NCIC from any jurisdiction if all of the following conditions  
are met:  
(a) The person or property being queried has been identified to the satisfaction of the  
criminal justice agency.  
(b) A printout produced from LEIN or NCIC is not provided.  
(c) A request for information in bulk is not processed.  
(6) A criminal justice agency may charge a nominal fee for information provided under  
subrule (5) of this rule.  
(7) A court may disseminate CJI to the extent necessary for the creation and  
maintenance of a court record, as defined by MCR 1.109 and 8.119. Any further  
dissemination of CJI that is, or is part of, a court record must be otherwise authorized by  
law or these rules.  
(8) Images and associated name, sex, and age obtained from SNAP may be publicly  
disseminated by a federal, state, or local governmental agency for an official law  
enforcement purpose or as necessary to comply with a law of this state or of the United  
States.  
(9) Statistical information obtained from CJIS may be released by the department to  
any individual or public or private entity upon approval by the CSO, whether or not for a  
purpose otherwise expressed in these rules. Statistical information must not contain PII  
or identifying information of any property.  
R 28.5209 Transaction Logs; release.  
Rule 209. (1) Subject to subrule (3) of this rule, an authorized agency's transaction logs  
may only be released if the information is released under R 28.5208(2)(a) for a criminal  
justice or official law enforcement purpose and either of the following conditions apply:  
(a) Upon written request from a local, county, state, or federal criminal justice agency  
that specifies that the information is required for a criminal justice or official law  
enforcement purpose.  
6
(b) As required under a search warrant or court order authorized by a judge or  
magistrate.  
(2) Subject to subrule (3) of this rule, an authorized agency listed under R 28.5201(1)  
that is not a criminal justice agency may only receive information from transaction logs if  
the information is released under R 28.5208(2)(b) or (c) and the agency's receipt of the  
information is authorized by law or rule.  
(3) An authorized agency's transaction logs may be released for a purpose not listed  
under R 28.5208(2) if the records are essential to issues raised in an administrative  
hearing or civil action related to the misuse or accuracy of CJIS, and the records are  
sought pursuant to a court order or subpoena authorized by a judge, magistrate, or  
administrative hearing officer.  
(4) Information or records released under this rule must not be accessed or disseminated  
for any other purpose unless authorized by law or rule.  
R 28.5210 Department release of CJI for certain research, statistical, or governmental  
projects.  
Rule 210. (1) The department may disseminate CJI from AFIS, ALIAS, or SNAP for  
research, statistical, or governmental projects in accordance with this rule.  
(2) The department shall not disseminate CJI under this rule unless all of the following  
apply:  
(a) The CSO has approved of the proposed dissemination of CJI upon determination  
that the criteria described in subrule (3) of this rule have been met.  
(b) The recipient of the CJI is an agency or entity listed under R 28.5201, an  
academic institution, or a government entity.  
(c) The recipient of the CJI has submitted to the department a completed user  
agreement, in a manner determined by the department, stipulating to all of the following:  
(i) Any CJI disseminated by the department shall only be used for the proposed  
project, and the recipient of the CJI shall not disseminate the CJI for any purpose.  
(ii) The recipient of the CJI shall destroy the CJI immediately after the CJI is no  
longer needed for the approved project or the approved project has concluded, whichever  
occurs first.  
(iii) The recipient of the CJI shall comply with any applicable federal and state law,  
these rules, the FBI Criminal Justice Information Services Security Policy, the Michigan  
Addendum to the FBI Criminal Justice Information Services Security Policy, and any  
procedures or requirements prescribed by the department.  
(iv) The department shall not disseminate CJI that is non-public or is otherwise  
prohibited from being disseminated by state or federal law.  
(v) Any CJI disseminated by the department shall not contain PII, unless the  
dissemination of the PII is lawful and approved by the CSO.  
(3) The CSO may approve or deny a proposal for the dissemination of CJI under this  
rule. The CSO shall ensure the following criteria are met before approving the proposed  
dissemination of CJI:  
(a) The proposed project is funded in full or in part with grant or public funds.  
(b) The proposed project is for the purpose of developing and measuring, evaluating,  
or otherwise advancing the state of knowledge in a particular area, or if the recipient of  
7
the CJI is a governmental entity, the purpose is intended to advance a public purpose  
related to the government entity's official functions.  
(c) The department would not be unreasonably burdened by the proposed project or  
adequately processing the proposed dissemination of CJI. An unreasonable burden  
includes, but is not limited to, any of the following:  
(i) Excessive financial or operational resources are required to adequately process  
the proposed dissemination of CJI or to provide oversight of the proposed project to  
ensure compliance with this rule, including the user agreement under subrule (2) of this  
rule.  
(ii) The proposed project's direct or indirect benefit to the department does not  
justify the financial or operational resources necessary to adequately process the  
proposed dissemination of CJI or to oversee the proposed project to ensure compliance  
with this rule, including the user agreement under subrule (2) of this rule.  
(iii) The proposed project or dissemination of CJI may cause undue disruption to  
the department or bring the department or its employees or agents into disrepute.  
(4) The determination of the CSO under subrule (3) of this rule is final and is not  
subject to appeal or challenge. The CSO shall, within a reasonable period of time,  
provide to the department and the proposed recipient of the CJI a written explanation for  
the reason or reasons supporting the CSO's denial or approval of the proposed  
dissemination of CJI.  
R 28.5211 Dissemination of CJI for certain mass casualty, catastrophic, or unforeseen  
events.  
Rule 211. The department may disseminate CJI, with the approval of the CSO and the  
director, for the following purposes:  
(a) A mass casualty or catastrophic event where the dissemination of CJI is necessary  
for the identification of victims. As used in this subdivision:  
(i) “Mass casualty” means any number of casualties or victims that exceed the  
resources normally available from local resources.  
(ii) “Catastrophic event” includes, but is not limited to, a governor’s or Presential  
declaration of a disaster or state of emergency, natural disaster, etc.  
(b) Any unforeseen circumstances where the disclosure of CJI is immediately  
necessary in the interest of homeland security.  
PART 4. RECORDS  
R 28.5401 Records responsibility.  
Rule 401. (1) An agency is responsible for the accuracy and completeness of any  
record it enters into CJIS. Each record must be identified with the agency that entered  
the record. Each agency shall validate records as required by Michigan and FBI CJIS  
policies. Both of the following apply:  
(a) An agency that fails to comply with the validation and certification requirements  
within the prescribed time period shall have its records removed from CJIS as required by  
Michigan and FBI CJIS policies.  
(b) An agency that requires more than the specified time to validate its records shall  
submit a written request to the CSO for a reasonable time extension.  
8
(2) Agencies may execute an agreement to allow an agency to enter records for another  
agency.  
(3) An agency shall maintain complete and accurate files of all active records that are  
entered into CJIS and shall ensure that the files are readily accessible to any person who  
is responsible for confirming the validity of records upon inquiry. Both of the following  
apply:  
(a) An agency shall establish procedures to ensure that, upon inquiry, all records that  
are entered into either LEIN or NCIC files can be promptly confirmed as valid.  
(b) An agency shall either maintain a 24-hour-a-day, seven-days-a-week operation or  
shall establish an alternative record verification procedure.  
R 28.5402 Timely entry and removal of records.  
Rule 402. (1) An agency shall ensure all records are immediately entered into CJIS,  
unless immediate entry may jeopardize a criminal investigation.  
(2) All records must be entered into CJIS pursuant to the procedures provided by the  
CSO and any applicable statute. Agencies shall ensure records are successfully entered  
into the appropriate CJIS.  
(3) An agency shall immediately remove a record from CJIS when the record is no  
longer valid. Agencies shall ensure records are successfully removed from the  
appropriate CJIS.  
(4) A court may enter or remove a record if there is a mutual agreement of all agencies  
involved.  
(5) Pursuant to section 26a of chapter IV of the code of criminal procedure, 1927 PA  
175, MCL 764.26a, and section 3 of 1925 PA 289, MCL 28.243, upon receipt of an  
appropriate order entered by district or circuit court in a case in which any criminal  
charge resulting in an arrest is dismissed before trial, the department shall destroy and  
expunge the arrest record and biometric data existing because of the dismissed charge or  
charges and remove any LEIN entry concerning the dismissed charge or charges. As  
used in this subrule, an "appropriate order" is a written order that explicitly directs the  
department to destroy and expunge the arrest record and biometric data and remove any  
LEIN entry concerning the charge or charges dismissed before trial and identifies the  
charged individual and the applicable case number.  
(6) A record may be removed from CJIS if the CSO has a substantial question  
concerning the record's validity or accuracy. Immediately upon the removal of any  
record, the CSO shall notify the entering agency of the action taken.  
R 28.5404 Rescinded.  
R 28.5414 Fees for access to information from CJIS.  
Rule 414. The department shall assess a one-time agency fee of $1.00 for access to  
information from CJIS. The department may waive this fee.