Federal Bureau of Investigation (FBI)

Published a SORN

including Routine Use notices

at [k still looking for official citation]

#FAS posted it (or a compilation) at:

#In recent years, FBI has exempted CRS from many of the Privacy Act requirements

#See, 28 CFR Section 16.96

#However, this material - required by 5 USC 552a(e)(4) would not be exempt

Additional Routine Uses

have been published at

70 FR 7513


is the owner of a System of Records

called "Central Records System"


or "FBI-002"

Data-category includes

people, including but not limited to

a) subjects, suspects, victims, witnesses, close family and associates,

who relate to official FBI investigations;

b) applicants for employment and people relevant to them;

c) subjects of unsolicited information, offerors of information, requestors of information, requestors of assistance

Data-source is

investigation or

information voluntarily provided by

government agencies

law enforcement agencies

general public



public source material

#"public source" is anything that a member of the general public could access

Authorized-purposes are

criminal law enforcement


FBI Legal-authority is

28 USC 533

#Congress grants US Attorney General authority to appoint people to detect crimes

28 CFR 0.85

#US Attorney General delegates that authority to the FBI

EO 12333

#President delegates authority to the FBI for foreign counterintelligence within the borders of the US

FBI has published

10 Blanket Routine Uses (BRUs)

#BRUs cover more than one SOR

#These are described as being for the purpose of standardizing wording!

at 66 FR 33558


BRU-1 data-recipient

any government entity

if it has enforcement authority

to which the data relates

#"[any] appropriate entity (whether federal, state, local, joint, tribal, foreign, or international), that is charged with the responsibility of investigating,

#prosecuting, and/or enforcing such law, regulation, rule, order, or contract."

BRU-1 data-category is

any record

# "any system record [which] on its face or in conjunction with other information, indicates a violation or potential violation of law (whether civil or

# criminal), regulation, rule, order, or contract,"

BRU -1 authorized-purpose

criminal law enforcement

civil law enforcement


BRU-2 data-recipient is

Non-FBI Employees, including






or others performing or working on a contract, service, grant, cooperative agreement, or other assignment for the Federal Government,

BRU-2 data-category is

any record necessary to perform an FBI function

BRU-2 authorized-purpose is

criminal law enforcement

foreign counterintelligence

agency administration

# "when necessary to accomplish an agency function"


BRU-3 data-receipient is

news media or

members of the general public

BRU-3 data-category is

#not stated explicitly

BRU-3 authorized-purpose

criminal law enforcement

public safety

sub-purpose examples:

to assist in locating fugitives; to provide notifications of arrests; to communicate information on potential threats to life, health, or property

provide alerts, assessments, or similar information on X or to keep the public appropriately informed of other law enforcement or FBI matters or other

matters of legitimate public interest


unwarranted invasion of personal privacy

# The availability of information in pending criminal or civil cases will be governed by the provisions of 28 CFR 50.2.


BRU-4 data-recipient is

Courts or Adjudicative Bodies.

BRU-4 data-category is

any record arguably relevant to a litigation

BRU-4 authorized-purpose is

is or could be party to the litigation, likely to be affected by the litigation, or has an

official interest in the litigation

Parties include:

(a) the FBI or any FBI employee in his or her official capacity,

(b) any FBI employee in his or her individual capacity where the Department of Justice has agreed to represent the employee, or

(c) the United States, is or could be a party to the litigation

(d) non-FBI employees included under BRU-2 recipients


BRU-5 data-recipient is

Parties, potential parties, and their attorneys in litigation

BRU-5 data-category is

any record arguably relevant to a litigation

if the FBI FBI has an official interest in the litigation

BRU-5 authorized-purpose is

litigation settlement negotiation

informal discovery


BRU-6 data-recipient is

any person or organization

BRU-6 data-category is

any record

BRU-6 authorized-purpose is

Mandated by Law.

#"under such circumstances and procedures as are mandated by Federal statute or treaty"


BRU-7 data-recipient is

Member of Congress

person on Member's staff

BRU-7 data-category is

record about an individual

BRU-7 authorized-purpose is

direct representation of the individual who is the subject of the record

#"when the request is made on behalf and at the request of the individual who is the subject of the record"


BRU-8 data-recipient is

National Archives (also called "NARA")

General Services Administration (also called "GSA")

BRU-8 data-category is

any data

BRU-8 authorized-purpose is

records management

BRU-8 legal-authority is

44 USC 2904

44 USC 2906


BRU-9 data-recipient is

Anyone from any agency, organization, or individual

BRU-9 data-category is

any data

BRU-9 authorized-purpose

authorized audit of the FBI

authorized oversight operations of the FBI

and meeting related reporting requirements


BRU-10 data-recipient is

former DOJ employee

BRU-10 data-category is

any data, relevant and necessary

BRU-10 authorized-purpose is

a) responding to an official inquiry from US government, state government, local government, professional licensing authority

in accordance with applicable Department regulations

b) facilitating communications with a former employee that may be necessary for personnel-related or other official purposes

where the Department requires information and/or consultation assistance regarding a matter within that person's former area of responsibilites

Procedures in 28 CFR sections 16.300-301 and DOJ Order 2710.8C