Exhibit B
Portland Police Data System
Security Policy
I. PURPOSE
It is the purpose of this policy to assure that criminal history information, wherever it appears is collected, stored, accessed, and disseminated in a manner to insure the completeness, integrity, accuracy, and security of such information, and to protect individual privacy.
II. DEFINITION OF TERMS
As used in this statement of policy:
Access means the authority to review or receive information from files, records, and information systems, whether manual or automated.
Criminal history record information means information collected by criminal justice agencies on individuals consisting of identifiable descriptions and notations of arrests, detentions, indictments, information, or other formal criminal charges and any dispositions arising therefrom, including sentencing, correctional supervision, and release. The term does not include identification information such as fingerprint records to the extent that such information does not indicate involvement of the individual in the criminal justice system.
Criminal justice administration means the performance of any of the following activities: detection, apprehension, detention, pre-trial release, post-trial release, prosecution, adjudication, correctional supervision, or rehabilitation of accused persons or criminal offenders. The administration of criminal justice shall include criminal identification activities and the collection, storage, and dissemination of criminal history record information.
Criminal justice information means information collected by criminal justice agencies that is needed for their legally authorized and required functions. This is the broadest information term and includes criminal history record information and investigative and intelligence information. It does not include agency personnel or administrative records used for agency operations or management.
Disposition means information disclosing that criminal proceedings have been concluded, including information disclosing that the police have elected not to refer a matter to a prosecutor, or that a prosecutor has elected not to commence criminal proceedings, and also disclosing the nature of the termination in the proceedings, or information disclosing that proceedings have been indefinitely postponed and also disclosing the reason for such postponement. Disposition shall include, but not be limited to, acquittal by reason of mental incompetence, case continues without finding, charge dismissed, charge dismissed due to insanity, charge dismissed due to mental incompetence, charge still pending due to insanity, charge still pending due to mental incompetence, guilty plea nolle prosequi, no paper, nolo contendere plea, convicted, youthful offender determination, deceased, deferred disposition, dismissal - civil action, defendant discharged, executive clemency, placed on probation, paroled, or released from correctional supervision.
Person means an individual of any age, concerning whom criminal history record information is contained in Portland Police Data System (PPDS), or a person's attorney or authorized representative.
Attorney means an attorney at law empowered by a person to assert the confidentiality of right to access the criminal history record information under this policy.
Authorized representative means a parent, or a guardian or conservator, other than an attorney, appointed to act on behalf of a person and empowered by such a person to assert the confidentiality of or right of access to personal data under this policy.
Dissemination means the transmission of information, whether orally, in writing, or electronically, to anyone outside the agency that maintains the information, except reports to an authorized repository.
Intelligence and investigative information means information compiled in an effort to anticipate, prevent, or monitor possible criminal activity, or compiled in a course of investigation of known or suspected crimes.
PPDS is an automated criminal justice information system that is operated by the Portland Police Bureau. Through electronic communication devices, PPDS provides for storage and retrieval of criminal justice information stored in local computer data bases and to criminal justice information which are accessible through the Oregon Law Enforcement Data System (LEDS).
III. LIMITS ON ACCESS
Access to PPDS criminal justice information shall be limited to criminal justice agencies that have executed formal written agreements with Portland Police Bureau, which commit the agencies to abide by the Security Policy herein described.
IV. LIMITS ON DISSEMINATION
Criminal justice agencies, which are authorized, access to PPDS criminal justice information may disseminate any PPDS criminal justice information directly under the following conditions:
1.) the intended recipient of the information is a criminal justice agency or agent under the definition contained herein: or
2.) The intended recipient of the information is legally authorized access to the specific information pursuant to statute, government regulation, or court order. Any liability that may arise from improper dissemination of PPDS criminal justice information shall rest entirely with the criminal justice agency and individuals that disseminated the information improperly.
Dissemination of juvenile criminal justice information shall be restricted as follows:
1.) Information related to warrants, verified suspects, runaways, missing persons, witnesses, or complainants may be disseminated to criminal justice agencies.
2.) All other information about juveniles shall not be disseminated.
Not withstanding any other provisions herein contained, intelligence and investigative information shall not be publicly disclosed so long as there is a clear need in a particular case to delay disclosure in the course of an investigation in accordance with ORS 192.501 et seq.
V. ACCURACY AND COMPLETENESS
Each criminal justice agency which stores, collects, or disseminates PPDS criminal history record information shall establish procedures to ensure the accuracy and completeness of criminal history record information. No criminal justice history information shall be disseminated until the information has been verified against Computerized Criminal History (CCH) records of the Oregon Law Enforcement Data System (LEDS). All dispositions by a PPDS user agency should be reported to LEDS-CCH within sixty (60) days of their occurrence. No information shall be added to a person's criminal history record in PPDS unless the data is based upon a readily identifiable numbered source document and upon assurance that the information pertains to the individual whose criminal history record is affected.
VI. RIGHT TO ACCESS AND CHALLENGE
Any individual shall have the right of access to their own criminal history record information that is contained in the PPDS files for the purpose of review and challenge.
The Portland Police Bureau shall establish procedures that:
1.) Inform an individual in writing, upon written request, the PPDS criminal history record information concerning her/him;
2.) Make available to a person, upon written request, the PPDS criminal history report information concerning her/him;
3.) Allow a person to contest the accuracy, completeness, or relevancy of her/his PPDS criminal history record information;
4.) Allow PPDS criminal history record information to be corrected upon written request of a person when Portland Police Bureau concurs in the proposed correction;
5.) Allow a person who believes that PPDS maintains inaccurate or incomplete criminal history record information concerning herself/himself to submit a written statement to the Portland Police Bureau setting forth what she/he believes to be an accurate or complete version of that criminal history record information. If, after a review of the statement, the Portland Police Bureau does not concur and does not make the corrections requested in the statement, the statement shall be filed in a manual file in the Portland Police Bureau Records Division under the appropriate PPDS identification number and any subsequent response to a request for PPDS criminal history record information shall disclose the existence of the statement challenging the accuracy or completeness of the PPDS criminal history record information.
VII. INFORMATION CONTROL AND RESPONSIBILITY
Additions, modifications, and deletions of information stored in the PPDS databases shall be restricted to specifically authorized individuals and electronic devices. Each PPDS user agency will provide the Portland Police Bureau with a list of the persons and the devices within the agency that will be permitted to access the PPDS files.
VIII. SECURITY
A. Physical Security - Each PPDS user agency shall be responsible for maintaining the physical security of all electronic devices that are capable of accessing PPDS, as well as any printed output or system documentation which might permit unauthorized access to or use of PPDS from within the agency.
B. On-Line Security - The PPDS system provides software to ensure that only authorized individuals and electronic devices can access the PPDS databases or the information available through LEDS. This software may require PPDS users to enter special identification codes and passwords before being allowed to make any inquiry into PPDS files.
C. Personnel Security - Any persons having authorized access to PPDS criminal history record information shall be required to complete a personal history statement. After completion of the form, the person will be fingerprinted and a background investigation will be conducted by the user agency. That investigation shall include, but not be limited to, verification of information provided by the person and to public record information, including a check of the PPDS persons file, the Oregon LEDS files, the National Crime Information Center files, and FBI Criminal Identification files. Upon investigation, any person found to have provided intentionally false information in their personal statements, or who are shown to have been arrested and convicted for committing an offense which, under Oregon law, can result in a sentence to a state penal institution for adults, or who are shown to have been arrested and convicted of committing a Class A or B felony as a juvenile in the State of Oregon within the past five (5) years shall be immediately denied all access to PPDS criminal history record information and shall be notified by the investigating agency, in writing, of this action. The person denied access may challenge the denial. If not successfully challenged within thirty (30) days of receipt of notice, the employer of the person shall provide the Portland Police Bureau with written notice that said person is denied access to all devices with access to PPDS files. Portland Police Bureau shall have the right to remove any individual from the list authorized to access criminal history record information. By itself, denial of access to PPDS shall not constitute grounds for dismissal of any employee from her/his employment.
IX. POLICY ENFORCEMENT
The Portland Police Bureau shall be responsible for the enforcement of this Security Policy. The Portland Police Bureau may delegate certain responsibilities to the Bureau of Information Technology. If the Portland Police Bureau determines that there has been a violation of this Security Policy it may take, but not limited to the following actions:
1.) It may remove individuals from the list of authorized users;
2.) It may restrict an agency's access to PPDS information;
3.) It may temporarily suspend an agency as a PPDS user;
4.) It may terminate all PPDS access by an individual or agency.
Willful violation of the provisions contained in paragraphs III and IV of this Security Policy with regard to the dissemination and use of criminal history record information contained in or obtained through PPDS by any employee or agent of the City or any PPDS user agency may result in sanctions by the employer against the individual or individuals who committed the violation.