DOJ Just Published a System of Records That Names Your BJS Award as a Disclosure Channel. Comments Close November 16

State Statistical Analysis Centers, university criminologists, and nonprofit evaluators holding BJS cooperative agreements have until November 16 to comment on a new Justice Department system of records — published October 15 at 91 FR 65598 — that names "award recipients" as a routine disclosure channel for $123 million in record-improvement data.

What JUSTICE/OJP-017 Actually Does

On October 15, the Office of Justice Programs published a new system of records notice for "Bureau of Justice Statistics (BJS) Statistical Data," JUSTICE/OJP-017. The notice is effective on publication, "subject to a 30-day period in which to comment on the routine uses," which puts the close of comments at November 16, 2026.

The system covers everything BJS "collects, acquires, or maintains through questionnaires, surveys, interviews, focus groups, and administrative records." The categories of individuals are broad: households participating in victimization surveys, people who have experienced or witnessed criminal victimization, "inmates currently incarcerated in federal prisons, state prisons, or local jails," and anyone whose records are held by the criminal and civil justice agencies that report to BJS. The categories of records are broader still — working statistical files, administrative data files, survey data files, and data contact files, containing names, addresses, Social Security numbers, criminal histories, victimization detail, civil proceedings, and employment information.

The authority is 34 U.S.C. 10132, carrying confidentiality obligations from 34 U.S.C. 10231 and 10134 and from 28 CFR Part 22, plus two statutes with their own collection mandates: the Prison Rape Elimination Act and the Death in Custody Reporting Act at 34 U.S.C. 30303.

None of the underlying collection is new. What is new is the instrument. A system of records notice is the document that defines, in writing, who may lawfully receive the data — and this one, establishing JUSTICE/OJP-017 as a new system, names grantees in its first routine use.

The Routine Use That Puts Award Recipients Inside the System

Routine use (1) authorizes disclosure "to contractors, award recipients, subcontractors, consultants, and other authorized individuals" performing work under BJS direction. Routine use (3) extends disclosure for statistical purposes to "another federal agency; the Congressional Budget Office; State, local, and Tribal governments; researchers." Five more cover congressional constituent inquiries, statutory mandates, two tiers of breach response, and National Archives records-management inspections.

Read routine use (1) as an access clause, not a privacy abstraction. If you hold a BJS cooperative agreement and your scope of work touches identifiable records, this notice is now the published basis on which BJS hands you the file. Two practical consequences follow. First, your Privacy Certificate and Data Management Plan are not closeout paperwork; they are the precondition for receiving data at all. Second, the eight numbered routine uses are the outer boundary of what you can do with it afterward. A subaward, a graduate research assistant, an outside statistical consultant, a cloud vendor — each has to fit inside "award recipients, subcontractors, consultants," and each has to be accounted for in your certificate.

A federal grant whose binding constraint is a records-access gate rather than a budget line is becoming the normal shape of DOJ money. The clearest recent version ran through BJA: in the Daniel Anderl Judicial Security and Privacy Act program, $6.5 million across 22 awards turns on whether the applicant actually operates the public record databases it proposes to scrub. OJP-017 is the same logic inverted. Anderl pays jurisdictions to pull identifiers out of public records; OJP-017 sets the conditions under which BJS puts identifiers into a grantee's hands.

$123 Million Moved Through O-BJS-2026-172688 Two Weeks Before Publication

The dollar figure that makes this notice consequential is not in the notice. It is in the FY 2026 solicitation calendar that closed days before publication.

O-BJS-2026-172688 — the BJS FY 2026 Consolidated National Criminal History Improvement Program — closed October 2, 2026 with $123,000,000 available, an award ceiling of $2,196,000, and 56 anticipated awards. "Consolidated" means three streams in one NOFO: roughly $59 million of NCHIP money for criminal-history record quality, completeness, and accessibility; $24 million of NARIP money for pushing mental-health adjudications, protection orders, and qualifying domestic-violence convictions into NICS; and $40 million in Bipartisan Safer Communities Act special funding aimed at the same national record systems. Eligible applicants were state governments, federally recognized tribal governments, and state court systems applying through a central administrative office.

Then O-BJS-2026-172687 — the FY 2026 State Justice Statistics Program for Statistical Analysis Centers — closed October 13, two days before the SORN published, with $3,000,000 available, a $225,000 award floor, up to 35 anticipated awards, no match requirement, and an eligibility gate narrow enough to quote: "State SACs are the only entities eligible to apply for funds under the SJS program."

Both competitions are record-handling programs. NCHIP and NARIP recipients will be improving the exact administrative files JUSTICE/OJP-017 describes. SJS recipients will be building state-level statistical products out of them. If you applied to either, your eventual award period runs under a routine-use framework that was published after your application went in — which means the compliance questions below are not hypothetical for FY 2027. They are live for the award you are waiting on.

The Privacy Certificate Is Now a Schedule Risk, Not a Paperwork Item

BJS guidance is explicit about sequencing, and the sequencing is where projects lose months.

Recipients that "collect, acquire, use, or maintain information identifiable to a private person" must submit a Privacy Certificate under the privacy certification requirements of 28 CFR Part 22. BJS requires that it be "signed by all project staff, including information technology personnel, contractors, subcontractors, and/or consultants, who have access to identifiable data." Separately, recipients working under BJS authority must maintain a BJS-approved Data Management Plan describing how they will "collect, store, protect, transfer, disseminate, and dispose of the information."

Then the sentence that belongs on the project manager's wall: "Data collection activities may not begin until BJS approves the DMP." Human-subjects documentation under 28 CFR Part 46 carries an equivalent gate — collection involving human subjects cannot start until BJS has the documentation and approves it.

For a 12-month SJS cooperative agreement at the $225,000 floor, an unbudgeted six-week DMP review is not an annoyance. It is a meaningful fraction of the collection window, and it compounds: the teams that lose the most time are the ones that filed the certificate as a submission attachment and then discovered at award that a newly named subcontractor, a replacement research assistant, or a change of cloud region required an amendment and a fresh round of signatures. Treat the staff roster, the technical-controls narrative, and the disposal plan as living project artifacts. Name vendors rather than describing categories of vendor. Decide now who signs when someone joins in month seven.

The Exemption Rule Almost Nobody Will Comment On

Published the same day, FR Doc 2026-21060 — CPCLO Order No. 012-2026 — proposes amending 28 CFR Part 16 to exempt JUSTICE/OJP-017 from 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G) and (H), and (f). Comments close November 16, the same date as the SORN.

In plain terms: subsection (d) is an individual's right of access and amendment, (f) covers the procedures for exercising that right, and (c)(3) is the disclosure accounting an individual can request. DOJ's stated rationale is compliance with the confidentiality provisions at 34 U.S.C. 10231 and 34 U.S.C. 30303, under which data collected for statistical purposes may be used solely for statistical purposes and no adverse determination may be made about an identifiable individual from it.

For grantees, this is the operationally decisive half of the package, because it answers a question that surfaces on nearly every BJS-funded collection: what happens when a survey respondent or an incarcerated person asks to see or correct their record? Under the proposed exemption, the statistical-confidentiality shield cuts both ways — the data cannot be used against the person, and the person cannot reach into the file. If your IRB protocol, consent script, or respondent-facing FAQ currently promises an access-and-correction path, reconcile it with this rule before November 16. If the exemption genuinely conflicts with an institutional human-subjects commitment, the comment docket is the place to say so, and it is open for 30 days, not for the life of your award.

What to Put in the Docket Before November 16

Comments on both documents go to the Office of Privacy and Civil Liberties, 145 N Street NE, Suite 8W.300, Washington, DC 20530, or to privacy.compliance@usdoj.gov. Program questions go to AskBJS@usdoj.gov; BJS sits at 999 N Capitol Street NE.

Three comments are worth the hour it takes to write them, in descending order of likely effect:

1. Ask routine use (1) to resolve the subrecipient question. Does a subrecipient's own IRB and institutional data-security regime satisfy the certification, or does BJS's model certificate control? That ambiguity is what produces the open-ended review.
2. Ask BJS to publish a target turnaround for DMP and Privacy Certificate approval. A stated service level converts an indefinite gate into a schedule line you can budget against.
3. Ask how mid-award personnel changes are handled. If every consultant with data access must sign, SACs and university centers need a named amendment path for staff added in month seven.

Then price the work into FY 2027. The BJS cycle is legible: the FY 2026 NOFOs posted August 14 and August 18 and closed in the first two weeks of October. If FY 2027 holds that calendar, draft Privacy Certificates and a skeleton DMP should exist in July — before the solicitation drops, not after the award lands.

Start with what is actually open. Search active DOJ criminal-justice statistics and record-improvement solicitations on Granted at grantedai.com/grants, then pull your current BJS award file and check the Privacy Certificate signature roster against the eight routine uses published October 15 — while the comment window is still open.