Code of Massachusetts Regulations
610 CMR - BOARD OF HIGHER EDUCATION
Title 610 CMR 10.00 - Privacy, Confidentiality, and Data Security
Section 10.03 - Collection, Maintenance, and Dissemination of Personal Data

1. Administration. Acting pursuant to applicable provisions of M.G.L. c. 15A, the Board is legally responsible for providing certain aggregate educational data in report form to the legislative and executive branches of the Commonwealth and to the public. This aggregate data which shall be available for dissemination shall be produced in standard reports, including but not limited to enrollment, program inventory, regular statistical reports, special studies, tuition and fees, and enrollment projections. Such reports shall be prepared, issued or released on a regular schedule and upon executive or legislative request.

2. Release of Official Data. The Board shall prepare and have available certain aggregate educational data for release through public statements and in standard report format whenever reasonably practicable. Such data may be contained in regular statistical reports, special studies, testimonies or public statements. Data releases that do not conform to the established Board's available standard report format(s) shall meet the Board's internal standards to assure that they are current, consistent with other sources, and supported by adequate background information and analysis.

3. Accuracy of Data. The Board shall take reasonable steps to ensure that all educational data collected from data holders is accurate, complete and consistent with data previously on file with the Board or provided to the Board by other data holders. Data or reports prepared by the Board for disclosure which do not conform to the established Board's standard report format(s) shall be accurate, current and consistent with their sources, and shall, whenever practicable, be supported by adequate background information and analysis.

1. prior to the inception of any personal data system, notices should be published in generally read newspapers in all communities in the Commonwealth, through all other reasonable means of drawing attention to such data held;

2. statements of identification of kinds of data held and assurance should be recorded in an individual file accessible to periodic examination by the Commissioner or his or her designee and the inclusion of such statements in the notice and annual report to be submitted pursuant to 610 CMR 10.03(2)(f);

3. to the extent possible, at the time of collection of data within the context of informed consent procedures conducted pursuant to 610 CMR 10.04(3) and (4).

1. design personnel procedures which limit the number of employees whose duties involve access to personal data;

2. train existing personnel concerning standards of confidentiality and security required by 610 CMR 10.00;

3. not allow any other agency or individual not employed by the holder to have access to personal data unless such access is authorized by statute or regulation or is approved by the holder and by the data subject;

4. screen prospective personnel with regard to previous work experience with personal data and corresponding violations of confidentiality; and

5. ensure that all personnel working with or having access to personal data are familiar with 610 CMR 10.00, the provisions of M.G.L.c. 66A, c. 30, § 63, c. 214, § 3B, and other pertinent legislation.

1. adequate fire detection and sprinkling systems;

2. protection against water and smoke damage;

3. watertight facilities; and

4. alarm systems, safes and locked files, window bars, security guards or any other devices reasonably expected to prevent loss through larceny or other means of removal for manually held data, including files, tapes, cards and like materials; and

5. passwords, keys, badges, access logs, or other methods reasonably expected to prevent loss through larceny or other means of removal for mechanically or electronically held data.

1. the name of the system and the title and address of the person in charge of it;

2. the nature and purpose of the system;

3. the identification of the types, categories, uses and sources of data held in the system and the assurance that such data is essential, pursuant to 610 CMR 10.03(1)(b);

4. the approximate number of individuals about whom data is held in the system;

5. whether and to what extent the data is held in computerized form;

6. a description of each person and organization having access to the system;

7. a description of the policies and practices of the holder with regard to data maintenance, retention, and disposal;

8. a description of the manner in which any individual who believes that the data about him or her is held in the system may have a search made, and, if such data is so held, may inspect, copy, and object to it as provided in 610 CMR 10.00;

9. a description of other actions take to comply with 610 CMR 10.00 and Massachusetts Law, particularly M.G.L. c. 66A; and

10. a statement that this report is available upon request in compliance with 610 CMR 10.00.

1. where such data is held in computerized form, the data system shall have the capacity for a program or programs to electronically record all persons collecting, examining or using data and purposes of such collection, examination, or use.

2. where the data is held in manual form, the holder shall require that a manual notation be made, to the maximum extent possible, of all persons collecting, examining or using data and the purposes of such collection, examination, or use.

3. the audit trail developed shall all be deemed part of the data held, and shall thereby be accessible only to the following persons:

4. in cases where a room is maintained solely for the purpose of holding data, the holder shall maintain a log which records the names of persons having access to the room. Where a room is not maintained solely for that purpose, the holder shall maintain a log which records the names of persons actually working with such data, and the dates and lengths of time of such use.

1. each holder shall adopt a written plan for such review, describing the systems involved, the schedule for such review, and the persons making the review. Each holder shall submit such review plan to the Commissioner or his or her designee. The plan as approved shall be a public record;

2. immediately following the completion of such a review, the persons who conducted the review shall make a written report describing the files, tapes, records, films or data reviewed and the degree of conformance by the holder with 610 CMR 10.00; and

3. a copy of the report shall be submitted to the chief executive officer of the institution and the Commissioner along with any suggestions as to whether any changes to 610 CMR 10.00 should be considered.

1. identification and justification of personal data as essential in accordance with 610 CMR 10.03(1);

2. brief descriptions of existing or planned agreements involving the holding of personal data in accordance with 610 CMR 10.03(1)(e).

3. statements reflecting proposed action on and compliance with each of the mandates presented in this part, particularly, the provision of an annual report and a written plan for periodic review of data held, in accordance with 610 CMR 10.03(2)(f) and (h); and

4. the identification of foreseeable threats to the security of personal data held, and a corresponding description of all measures to be employed as safeguards designed to avoid or mitigate such threats, including but not necessarily limited to, plans involving personnel training relating to data system operations and 610 CMR 10.00.

1. Where a suit (or legal proceeding) has been threatened or instituted by a data subject against the Commonwealth, the Board of Higher Education, division, or public institution of higher education, or against any official employee of the Board or a public institution of higher education, arising from his or her official duties or scope of employment, any personal data concerning the data subject held by the entity that is or employs a party to such suit (or legal proceeding) which is relevant to a determination of the issues in dispute shall be furnished to the Attorney General or authorized assistant attorney general or special assistant attorney general who may further disclose such personal data to the extent he or she deems necessary for purposes of representing the defendant(s), subject to the following conditions:

2. In the event that a personal data system maintained by the Commonwealth, Board of Higher Education or public institutions of higher education to carry out its functions, indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising under a statute, rule, regulation or order issued pursuant thereto, the relevant data may be referred to the Attorney General in order to enforce or implement the statute, rule, regulation or order issued pursuant thereto, or to investigate or prosecute such violation.

3. Nothing in 610 CMR 10.03 shall be construed to authorize the Board of Higher Education or Public institutions of higher education to release information, the disclosure of which is prohibited by any statute other than the Fair Information Practices Act. M.G.L. c. 66A.

1. Any employee at the Board of Higher Education or at a public institution of higher education found breaching the confidentiality of data subjects through violations of 610 CMR 10.00 shall be subject to reprimand, suspension, dismissal or other disciplinary actions by the holder, the chief executive officer of the institution, the Board of Higher Education and the Commonwealth governing its employees, and may be denied future access to personal data and removed from any custodial responsibilities.

2. The Board of Higher Education or any institution under the Board of Higher Education or any institution which violates the terms of 610 CMR 10.00 may be liable to individuals injured, pursuant to M.G.L. c. 214, § 3B, to legal action to enjoin such violations brought by the Attorney General, and to administrative action by the institution or the Board of Higher Education to remove authorization to hold personal data.