Pegasus Program Privacy and Civil Liberties Policy
1.00 Statement of Purpose
The goal of developing,operating, and participating in the Pegasus Program, a multijurisdictional information sharing system, is to further the following purposes:
(a) Increase public safety and improve national security;
(b) Minimize the threat and risk of injury to specific individuals;
(c) Minimize the threat and risk of injury to law enforcement and others responsible for public protection, safety, or health;
(d) Minimize the threat and risk of damage to real or personal property;
(e) Protect individual privacy, civil rights, civil liberties, and other protected interests;
(f) Protect the integrity of the criminal investigatory, criminal intelligence, and justice system processes and information;
(g) Minimize reluctance of individuals or groups to use or cooperate with the justice system;
(h) Support the role of the justice system in society;
(i) Promote governmental legitimacy and accountability;
(j) Not unduly burden the ongoing business of the justice system; and
(k) Make the most effective use of public resources allocated to justice agencies.
2.00 Definitions
2.10 Definition of Participating Agency
Participating Agency refers to any agency that executes an agreement with Pegasus Research Foundation for participation in the Pegasus Program.
2.20 Definition of Information
Information includes any data about people, organizations, events, incidents, or objects, regardless of the medium in which it exists.
2.30 Definition of Law
As used in this policy, law includes any local, state, tribal, territorial, or federal statute, ordinance, regulation, executive order, policy, or court rule, decision, or order, as construed by appropriate local, state, tribal, territorial, or federal officials or agencies.
2.40 Definition of Public
Public includes:
(a) Any person and any for-profit or nonprofit entity, organization, or association;
(b) Any governmental entity for which there is no existing specific law authorizing access to the agency’s information;
(c) Media organizations; and
(d) Entities that seek, receive, or disseminate information for whatever reason, regardless of whether it is done with the intent of making a profit, and without distinction as to the nature or intent of those requesting information from the agency.
Public does not include:
(e) Employees, contractors or subcontractors of, or service providers to, Pegasus Research Foundation or a Participating Agency;
(f) People or entities, private or governmental, who assist the Pegasus Program or a Participating Agency in providing data to, or in accessing, the Pegasus Program.
3.00 Compliance With Laws
All Pegasus Program and Participating Agency personnel, personnel providing information technology services to the Pegasus Program or a Participating Agency, and all users of the Pegasus Program will comply with all applicable laws, including all applicable laws protecting privacy, civil rights, and civil liberties in the collection, use, analysis, retention, destruction, sharing, and disclosure of information.
4.00 Seeking and Retaining Information From the Pegasus Program
4.10 Information That May Be Sought or Retained
(a) The Pegasus Program will operate as a multijurisdictional information sharing system that principally operates to provide query to and response from distributed law enforcement databases, using minimal data storage, to provide access to traditional law enforcement information. The Pegasus Program will not operate as a criminal intelligence system subject to 28 CFR Part 23.
(b) A Participating Agency will seek or retain from the Pegasus Program only information that is:
(1) Relevant to the investigation and prosecution of suspected criminal (including terrorist) incidents; the resulting justice system response; the enforcement of sanctions, orders, or sentences; or the prevention of crime or that is useful in crime analysis or in the administration of criminal justice;
(2) Collected by criminal justice agencies on specific individuals, consisting of official identifiable descriptions and notations of arrests, detentions, warrants, complaints, indictments, information, or other formal criminal charges and any disposition relating to these charges, including acquittal, sentencing, pre- or
post-conviction supervision, correctional supervision, and release. Participating Agencies will exercise caution in seeking or retaining law enforcement information, such as victim or witness names and address, where such information does not indicate the individual’s own engagement in criminal activity; or
(3) Where there is reasonable suspicion that a specific individual or organization has committed a criminal offense or is involved in or is planning criminal (including terrorist) conduct or activity that presents a threat to any individual, the community, or the nation and the information is relevant to the criminal (including terrorist) conduct or activity.
(c) A Participating Agency will not seek or retain from the Pegasus Program information about an individual or organization solely on the basis of religious, political, or social views or activities; participation in a particular organization or event; or race, ethnicity, citizenship, place of origin, age, disability, gender, or sexual orientation.
(d) A Participating Agency will not seek or retain from the Pegasus Program information about the political, religious, or social views; participation in a particular organization or event; or activities of any individual or his or her race, ethnicity, citizenship, place of origin, age, disability, gender, or sexual orientation unless such information is:
(1) Relevant to whether an individual or organization has engaged in, is engaging in, or is planning a criminal (including terrorist) activity; or
(2) Needed by the Participating Agency:
i) To identify an individual,
ii) In order for the Participating Agency to operate effectively, or
iii) To provide services to the individual or accommodate an individual’s religious, ethnic, or cultural requests or obligations.
4.20 Methods of Seeking or Receiving Information by the Pegasus Program
(a) Information gathering and investigative techniques used by the Pegasus Program will comply with all applicable laws.
(b) The Pegasus Program will not directly or indirectly receive, seek, accept, or retain information from a Participating Agency, if the Pegasus Program knows or has reason to believe that:
(1) The Participating Agency is legally prohibited from obtaining the specific information sought or disclosing it to the Pegasus Program;
(2) The Participating Agency used methods for collecting the information that the Pegasus Program itself could not legally use;
(3) The specific information sought from the Participating Agency could not legally be collected by the Pegasus Program; or
(4) The Participating Agency has not taken the steps necessary to be authorized to collect the information.
(c) Information gathering and investigative techniques used by a Participating Agency will be no more intrusive or broad-scale than is necessary in the particular circumstance to gather information it is authorized to seek or retain pursuant to Section 4.10.
5.00 Information Quality
(a) A Participating Agency will make every reasonable effort to ensure that only authorized users are allowed to add, change, or delete information accessible by the Pegasus Program.
(b) A Participating Agency will make every reasonable effort to ensure that information made accessible by the Pegasus Program is no longer accessible by the Pegasus Program from the Participating Agency’s system, when the Participating Agency learns that:
(1) The information is erroneous, misleading, obsolete, or otherwise unreliable;
(2) The source of the information did not have authority to gather the information or to provide the information to the Participating Agency; or
(3) The source of the information used prohibited means to gather the information.
6.00 Collation and Analysis of Information
(a) Information sought or received by a Participating Agency from the Pegasus Program will only be analyzed:
(1) By qualified individuals;
(2) To provide tactical and/or strategic intelligence on the existence, identification, and capability of individuals and organizations suspected of having engaged in or engaging in criminal, including terrorist, activities generally; and
(3) To further crime (including terrorism) prevention, enforcement, force deployment, or prosecution objectives and priorities established by the Participating Agency.
(b) Information sought or received by the agency or from other sources will not be analyzed or combined in a manner or for a purpose that violates Subsection 4.10(c).
7.00 Sharing and Disclosure of Pegasus Program Information
7.10 Sharing Pegasus Program Information Within a Participating Agency
Access to information obtained from the Pegasus Program and retained by the Participating Agency will only be provided to persons within the Participating Agency who are authorized to have such access, and only for legitimate law enforcement, public protection, public prosecution, public health, or justice purposes and only for the performance of official duties in accordance with the law and procedures applicable to the agency for whom the person is working. Information provided by the Pegasus Program may not be further disseminated within a Participating Agency without the permission of the originating agency.
7.20 Sharing Pegasus Program Information With Those Responsible for Public Protection, Safety, or Public Health
(a) Information provided by the Pegasus Program may not be further disseminated outside a Participating Agency without the permission of the originating agency, provided that the foregoing shall not limit the dissemination, including unsolicited, of information or an assessment of information to a government official or to any other individual, when necessary to avoid imminent danger or certain danger to life or property.
(b) A Participating Agency shall not confirm the existence or nonexistence of information to any person or agency that would not be eligible to receive the information itself.
(d) An audit trail will be kept of the access by or dissemination of information to persons when necessary to avoid imminent danger or certain danger to life or property.
7.30 Disclosing Pegasus Program Information to the Public or the Individual About Whom Information Has Been Gathered
(a) Information provided by the Pegasus Program may not be further disseminated outside a Participating agency without the permission of the originating agency. A Participating Agency shall refer inquiries from the public or individuals to the Pegasus Program or originating agencies for response.
(b) A Participating Agency shall not confirm the existence or nonexistence of information to any person or agency that would not be eligible to receive the information itself.
(c) In any event, the existence, content, and source of the information will not be made available to an individual when:
(1) Disclosure would interfere with, compromise, or delay an ongoing investigation or prosecution;
(2) Disclosure would endanger the health or safety of an individual, organization, or community;
(3) The information qualifies as criminal intelligence, even though not subject to 28 CFR Part 23; or
(4) Disclosure would violate other legal requirements or Pegasus Program policy, as determined by Pegasus Research Foundation on an individualized basis.
(d) An audit trail will be kept of all information disclosed to a member of the public or an individual about whom information has been gathered.
(d) A Participating Agency may charge individuals or entities requesting information a fee for locating and reproducing the information that the Participating Agency may lawfully charge for locating and reproducing the information.
8.00 Accountability and Enforcement
8.10 Pegasus Program Transparency
(a) This policy will be made available to the public by the Pegasus Program on request and through any public Web sites providing information about the Pegasus Program.
(b) The Participating Agency will designate a Public Information Officer or other person responsible for receiving and responding to inquiries and complaints about privacy, civil rights, and civil liberties protections in the Pegasus Program and will provide to the public the contact information for such person.
8.20 Accountability for Activities
(a) A Participating Agency will require any individuals authorized to use the Pegasus Program to agree in writing to comply with the provisions of this policy and Pegasus Program User Terms & Conditions.
(b) A Participating Agency will periodically review and update the provisions protecting privacy, civil rights and civil liberties in its policies and make appropriate changes in response to changes in applicable law and public expectations.
8.30 Enforcement
If a Participating Agency’s authorized user is suspected of or found to be not complying with the provisions of this policy, the Participating Agency will:
(a) Suspend or discontinue access to information by the user;
(b) Suspend, demote, transfer, or terminate the person as permitted by applicable personnel policies, or apply other sanctions or administrative actions as provided in Participating Agency personnel policies;
(c) Request the organization, contractor, or service provider employing the user to initiate proceedings to discipline the user or enforce the policy’s provisions; or
(e) Refer the matter to appropriate authorities for civil action or criminal prosecution, as necessary, to effectuate the purposes of this policy as stated in Section 1.00.
9.00 Training
(a) A Participating Agency will require the following individuals to participate in training programs provided by the Pegasus Program regarding the implementation of and adherence to the privacy, civil rights, and civil liberties policy:
(1) Its personnel;
(2) Contractors and other personnel providing information technology services to the Participating Agency that may impact data accessed or retained by the Pegasus Program;
(3) Users who are employed by the Participating Agency.
(b) The training program will cover:
(1) Purposes of this policy;
(2) Substance and intent of the provisions of this policy;
(3) The impact of improper activities associated with information accessible through the Pegasus Program; and
(4) The nature and possible penalties for violations of this policy, including possible transfer, dismissal, and civil and criminal liability, and immunity applicability, if any.
THUS DONE effective this 1st day of September, 2010.
Pegasus Research Foundation
