Objections and Administrative Appeals

(1) Objections. A data subject, his or her attorney, parent or legal guardian, or other representative authorized in writing by the data subject may object to the accuracy, completeness, pertinence, timeliness, relevance or dissemination of personal data pertaining to the data subject, or the denial of access to such data maintained in a personal data system. Such individual may file an objection with the information officer in charge of the personal data system or another designated person within the agency. If the information officer or agency designee is unavailable, the data subject or his or her representative may make the objection to the agency head. (2) Responsibilities of Holder Pursuant to Objections. Upon receiving a data subject's objection, the information officer or agency designee shall investigate the validity of the objection within 30 days of receipt of the objection. (a) If the data subject or his or her representative requests that the personal data be corrected or amended, or requests any other change with respect to the personal data, and there is no disagreement concerning the change to be made, the information officer or agency designee shall cause such change to be made. (b) If the information officer or agency designee determines that the objection lacks merit, he or she shall provide the data subject an opportunity to provide a statement reflecting the data subject's position regarding the data and shall include the statement with the personal data and with any subsequent disclosure or dissemination of the data in question. (3) Appeal of Holder's Decision. Any data subject or representative who objects to the decision of the information officer or agency designee may appeal the matter to the agency head or a designee. The appeal shall be filed in writing within 30 days of receipt of notification of the decision by the information officer or agency designee under 801 CMR 3.04(2). (a) If the agency head or designee agrees with the objection, he or she shall cause the requested correction, amendment, or other change to be made. (b) If the agency head or designee determines that objection lacks merit, he or she shall provide the data subject an opportunity to provide a statement reflecting the data subject's position regarding the personal data and cause such statement to be included with the personal data and with any subsequent disclosure or dissemination of the data in question.