Collection and Maintenance of Personal Data

(1) Designation of Personal Data Officer. Each LHA and LRA shall designate one individual to serve as the officer immediately responsible for the privacy, confidentiality, and security of personal data consistent with M.G.L. c. 66A. (2) Limit on Personal Data. A Holder shall not collect or maintain more personal data than reasonably necessary for the performance of the holder's legally authorized functions.