Access to Personal Data by Persons Other than the Data Subject

(1) General Rules regarding Access to Personal Data. (a) Access to Personal Data. Except as provided in 940 CMR 11.04, the AGO shall not allow any other agency or individual not employed or contracted by the AGO to have access to personal data unless such access is authorized by law, or is approved by the data subject if the data subject is entitled to access under M.G.L. c. 66A, § 2(i) and 940 CMR 11.00. (b) Response to Public Records Requests. Any information concerning an individual which, because of name, identifying number, mark, description, or other such personal identifiers, can be readily associated with a particular individual, that is contained in a public record as defined by M.G.L. c. 4, § 7, clause Twenty-sixth, is not “personal data” and therefore, public records containing such information may be disseminated to any person making such request, provided that any personal information as defined by M.G.L. c. 93H is redacted prior to dissemination. As illustration, and without limitation, the following records received and maintained by the AGO may be considered “public records”. 1. open meeting law complaints, excluding the complainant’s personal contact information such as their residential address, personal telephone and/or email address; 11.04: continued 2. public records requests; 3. responses to AGO solicitation for public comment; and 4. records that have already been filed with, and are available to the public through, any state or federal court. (2) Allowable Dissemination of Personal Data. Consistent with the purposes of M.G.L. c. 66A and 940 CMR 11.00, the AGO may disseminate personal data to persons other than the data subject as follows: (a) The AGO may disseminate personal data if such dissemination is authorized in writing by the data subject; (b) The AGO may disseminate personal data in response to compulsory legal process, provided that the procedures required by M.G.L. c. 66A, § 2(k) are followed; (c) The AGO may disseminate personal data to another federal, state, or local governmental entity for criminal or civil law enforcement purposes, including multi-state investigations, provided the AGO and any such entity have an agreement or protective order in place to keep the personal data confidential; (d) The AGO maydisseminate personal data where such dissemination is necessaryto make a good faith effort to settle a case in which the AGO is or represents a party in the course of litigation, or to resolve, settle, or mediate a matter which would otherwise be necessary to litigate, or which otherwise could not be resolved; (e) The AGO may disseminate personal data to a national or multi-state public or private entity that collects such data for statistical purposes, provided that the entity and the AGO have an agreement in place that preserves the anonymity of the individuals to whom the personal data relates; (f) The AGO may disseminate personal data to the entity or individual that originally provided the AGO with such data; (g) The AGO may disseminate personal data for any other purpose not explicitly set forth in M.G.L. c. 66A, § 2(c), provided that such dissemination is not inconsistent with the purposes of M.G.L. c. 66A, i.e., the purpose(s) for which the information was originally collected, and with other applicable laws; (h) The AGO may disseminate personal data asrequired by an order of a court of competent jurisdiction; and (i) The AGO may disseminate personal data as required by Mass. R. Crim. P. 14.