Informed Consent

A data subject may give or withhold informed consent when requested by a holder to provide personal data. (1) Written Statement from Holder. Consent will be deemed "informed consent" only if the holder provides to the data subject a written statement containing the following information and the data subject indicates his/her written understanding and agreement: (a) an explanation of how the requested data will be used and held; (b) the identity of persons, entities or agencies who will receive or hold the data, and an assurance that all holders will keep the data confidential; (c) an offer to answer any inquiries concerning the data, indicating the data subject's right to object in accordance with 760 CMR 8.05; and, (d) any legal requirements to provide the requested data and any legal or administrative consequences arising from a decision to withhold the data. (2) Separate Approval for Data Use. Except where otherwise provided by statute or judicial order, personal data collected for one purpose shall not be used for another unrelated purpose without the informed consent of the data subject.