DIVISION OF ARKANSAS STATE POLICE (ASP) AUTOMATED FINGERPRINT IDENTIFICATION SYSTEM (AFIS) AND IDENTIFICATION BUREAU (ID)
TERMS AND CONDITIONS FOR CONNECTION OF THIRD PARTY ELECTRONIC FINGERPRINT HARVESTERS TO THE ASP APPLICANT CRIMINAL BACKGROUND CHECK NETWORK IN ARKANSAS
Third party electronic fingerprint Harvesters in Arkansas who meet the terms and conditions as set out by the Division of Arkansas State Police (ASP) may be allowed to establish and maintain a connection to the ASP Applicant Criminal Background Check Network (Network) for purposes of transmitting non-criminal justice requests for criminal history information to ASP.
The Harvester's connection to the Arkansas State Police (ASP) Applicant Criminal Background Check Network is contingent upon implementation of, and adherence at all times to, the Terms and Conditions herein, including any changes thereto.
ASP reserves the right to amend or modify the Terms and Conditions, and/or impose additional requirements and/or restrictions in writing, at any time it deems necessary to protect the stability and security of the network.
ASP reserves the right to terminate the Harvester's connection to the network at any time, without prior notice, if it has reason to believe that the security or stability of the network has been, or will be, compromised in any way.
Definitions For purposes of this document, terms are defined as follows:
1.01 Applicant - Any person who wishes to submit his/her fingerprints to ASP for a non-criminal justice background check. At this time, only those applicants who are authorized by law to have a national fingerprint-based or a fingerprint-based check conducted by the Federal Bureau of Investigation (FBI) may have their fingerprints electronically harvested.
1.02 Applicant Information - Personal and confidential information, regarding an applicant, including fingerprint images, social security number, Arkansas driver's license or identification card, or any other personal identification information provided by or collected from an applicant, which is taken for the purpose of the non-criminal justice record check.
1.03 Descriptor Data Dictionary - Safran Morphotrak 0007-PF00048A, latest revision. This document contains the descriptor data definitions for the Arkansas State Police.
1.04 Harvester - An electronic fingerprint capture service operating in Arkansas, which has met the standards, set out by ASP and has established a connection to the ASP Applicant Criminal Background Check Network for purposes of transmitting electronic fingerprints of an applicant to ASP for a non-criminal justice background check.
1.05 Harvester Representative - The person duly authorized to represent the Harvester and act on the Harvester's behalf, with defined authority for implementing and ensuring on-going compliance with all requirements set forth in these Terms and Conditions. The Harvester representative is subject to the certification requirements set forth in this document. For the purposes of the duties and responsibilities set forth in this document, the Harvester representative and the Harvester shall be considered to be the same entity.
1.06 Interface Control Document (ICD) - Safran Morphotrak MorphoBIS 0006-PF0048A, latest revision. This document shall provide the system interface controls and interface description between a foreign (non-Idemia) livescan device and the Arkansas State Police (ASP) Morpho Biometrics Identification Solution (MorphoBIS)
1.07 Livescan - A computer-based device that allows for the capture of electronic fingerprint images and applicant data, and the electronic transmission of fingerprint images and data to centralized computers at ASP.
1.08 Network - The electronic communication system, established by ASP to facilitate the transmission of requests for non-criminal justice requests for criminal history information to ASP from third party electronic fingerprint Harvesters in Arkansas.
1.09 Operator - Any person who operates a livescan device and/or provides applicant-fingerprinting services on behalf of a Harvester.
Scope 2.01 This document establishes the minimum controls deemed necessary by ASP to protect the security, stability and integrity of the Network, and the privacy rights of individual applicants. The Harvester may impose any additional, more stringent controls on itself, as it deems necessary and/or appropriate.
2.02 The Terms and Conditions apply to all personnel, equipment, software, systems, networks, communication links, and facilities supporting and/or acting on behalf of the Harvester.
2.03 Approval to establish and maintain connectivity to the Network shall be contingent upon the Harvester's full compliance at all times with all requirements set forth in this document. Failure or refusal to fully comply with all requirements herein may result in the temporary or permanent termination of the Harvester's connection to the Network or the ability to transmit electronic fingerprints to ASP, whether directly or indirectly through a Network connection.
Personnel Security 3.01 The Harvester shall be responsible for the actions of any person or entity acting on its behalf and/or providing services in support of it.
3.02 The Harvester, and every operator providing services on a Harvester's behalf, shall be properly trained to roll fingerprints and in the use of the live scan machine hardware/software.
3.03 The Harvester shall maintain a current list of all operators providing fingerprint services on its behalf. A current copy of the list shall be provided to ASP by the Harvester.
3.04 The Department reserves the right to restrict or eliminate access to information on the network to those employees, operators or contractors of the Harvester whose criminal history record would not allow them access to criminal justice information.
3.05 The Harvester's personnel or persons acting on their behalf, shall at all times while capturing fingerprints electronically, display identification that indicates the harvester's name, the person's name and the person's photograph. This should be worn on the person on the upper area of the body.
Site Security 4.01 All Harvester hardware and software associated with the capture and/or transmission of applicant fingerprints to ASP shall be adequately secured at all times to reasonably protect against theft, damage, and/or unauthorized access or use by any person.
Information Security 5.01 Applicant information is confidential and the use of this information for any purpose other than the purpose for which it was expressly provided by the applicant is strictly prohibited. Violation of an applicant's absolute right to privacy may subject the Harvester and/or its operator(s) to criminal and/or civil liability, and may result in termination of the Harvester's connectivity to the Network.
5.02 Except as expressly authorized by ASP, applicant information shall not be replicated, sold, shared, modified, archived, stored, or used to supplement any existing data base, file, record or report, or create any new data base, file, record or report.
5.03 The livescan operator conducting the transaction shall reasonably verify the identity of each applicant by comparison to a valid (unexpired) government-issued photo identification, presented at the time of fingerprinting, to the appearance of the applicant, and to the information contained on the ASP Applicant Criminal Background Check Network. Services shall not be provided to any applicant who does not present proper and valid photo identification, and whose identity from the government issued photo identification cannot be verified through this comparison. The following areas must be an exact match: first name, last name, and date of birth.
5.04 Once a transaction has been transmitted, the Harvester is strictly prohibited from using a previously captured fingerprint image for any purpose other than resubmitting a record that was rejected by ASP or the FBI due to faulty image or data.
5.05 Applicant fingerprint transaction records may be temporarily retained in an electronic storage medium, within the livescan device, pending successful transmission of the record to ASP. In no event, however, may any applicant fingerprint image or record be retained, in either electronic or hard copy form, for longer than 40 calendar days from the date of the initial transmission of the fingerprint record to ASP or immediately upon the Harvester ceasing to conduct business in Arkansas, whichever event comes first.
System Security 6.01 A dedicated system shall be utilized for transmitting electronic applicant fingerprints to ASP. The Harvester shall not use the system to run any other business application(s), unless expressly authorized by ASP in advance in writing.
6.02 The ASP-approved transmission path, which enables connectivity to the network, originating from the Harvester's livescan, and traversing through any interconnected systems, and ultimately terminating at ASP, shall not be modified in any way without advance notice to, and express written approval received, from ASP in advance of the modification.
6.03 The Harvester must maintain compliance with the Descriptor Data Dictionary and the Interface Control Document (ICD) for successful submission of data.
6.04 All equipment used for transmitting and/or forwarding electronic applicant fingerprints to ASP shall be segregated and screened against unauthorized use. Data integrity must be maintained in order to detect the unauthorized creation, alteration, or deletion of applicant data or images.
6.05 All unused user or system accounts by the Harvester shall be removed or disabled.
Security Violations 7.01 All security violations, or suspected security violations shall be immediately reported to ASP. Reports of security violations shall include the date of the incident(s), the parties involved (if known), the nature and scope of the incident, and any action(s) taken, including steps to protect against future violations, and any other information deemed vital by ASP.
7.02 ASP reserves the right to investigate all reported or suspected security violations and to take any action it deems appropriate and/or necessary to protect the security and stability of the network and the privacy rights of individual applicants, up to and including immediate termination of the Harvester's connection to the network with or without prior notice.
7.03 The Harvester will hold ASP harmless for any intentional acts or negligent omissions committed by the Harvester in the course of the Harvester's gathering, transmission, or retention of fingerprint or personal information or data.
Quality Controls 8.01 Remedial training for Harvester personnel may be required if, at any time, ASP determines that the rate of record rejections due to poor image quality, or data errors, exceeds acceptable levels. Failure to obtain appropriate training and resolve unacceptable fingerprint record rejection levels in a timely manner may result in termination of the Harvester's connectivity to the network.
8.02 The Harvester shall only utilize hardware and software that is currently certified and approved by and compatible with ASP for the applicant software type, the National Institute of Standards and Technology (NIST), and the Federal Bureau of Investigation (FBI).
8.03 All manufacturer software upgrades, including the installation of any patches deemed necessary by the manufacturer or ASP, shall be applied in a timely fashion by the Harvester and shall remain current.
8.04 All ASP customization software upgrades and ASP validation table updates shall be applied in a timely fashion and shall remain current.
8.05 All applicant fingerprint records shall be transmitted to ASP within 24 hours from the time the fingerprints were obtained from the applicant.
8.06 Except as specifically provided herein, a Harvester shall not transmit or forward an applicant fingerprint image capture transaction to the ASP more than one time. The Harvester shall be responsible for applicable ASP and FBI processing fees associated with any duplicate transaction that it transmits to the ASP through its network connection.
8.07 The Harvester shall maintain a log of all applicant fingerprint capture and transmission transactions. The log shall clearly identify the name of the operator who performed each transaction, the name of the applicant fingerprinted, the date the applicant was fingerprinted, the type of government-issued photo identification that was presented, and the applicant tracking number associated with the transaction. The Harvester shall maintain the log for a minimum of three (3) years from the date of the oldest transaction, and shall make the log available to ASP upon request. Access to and security for the log shall be controlled by the Harvester.
Fees 9.01 The Harvester is not to collect the processing fee charges on behalf of ASP and FBI.
9.02 The Harvester may charge the applicant a separate electronic fingerprint capture fee as compensation for its services and use of its equipment. The amount of the fee and acceptable method(s) of payment shall be determined by the Harvester.
9.03 Any applicant who returns to the Harvester to be reprinted because his/her initial fingerprint submission (captured by the same Harvester) was rejected due to poor fingerprint image quality, shall not be charged an additional electronic capture fee by the Harvester. The applicant may be charged an additional electronic fingerprint capture fee if the original fingerprint transaction, which was rejected, was performed by a different Harvester.
Audits 10.01 The Harvester shall be subject to periodic, unannounced, on-site visits by ASP to audit for compliance with the provisions of the Terms and Conditions herein, and any applicable laws, regulations, policies, practices, or other requirements deemed necessary by ASP. The audits shall be reasonable in both scope and length, and shall primarily occur during the Harvester's normal business hours. Audits will be conducted in a manner that is least disruptive to the Harvester's business operations, whenever possible.
10.02 Failure to cooperate, and/or refusal to provide documents, logs, lists, files, records, or any other information requested by ASP may result in the temporary or permanent termination of the Harvester's connection to the network.
Miscellaneous Provisions 11.01 These Terms and Conditions do not confer, grant, or authorize any actions to be performed by any entity or person other than the specific named Harvester.
11.02 As long as the Harvester meets the Terms and Conditions for ASP for Network connection, the Harvester may maintain its connection to the ASP Network.
11.03 The Harvester is not allowed to use the ASP name or logo in any advertising or media production other than to state that the Harvester "currently meets the standards for electronically transmitting non- criminal justice requests for criminal history information to the Arkansas State Police and for submission for a national fingerprint based background check".
11.04 The Harvester shall obtain and maintain all necessary licenses, permits, or authorizations to transact business in the State of Arkansas.
11.05 The Harvester must at all times operate under and be in compliance with the terms of the subscription account between the Harvester and Tyler Arkansas.
11.06 All reports, notices, requests, and/or correspondence shall be mailed by U.S. Mail First Class to: Lieutenant in Charge, Arkansas State Police, AFIS/ID Bureau, 1 State Police Plaza Drive, Little Rock, AR 72209. ASP may agree to accept electronic reports, notices, requests or correspondence.
