Code of Massachusetts Regulations
940 CMR - OFFICE OF THE ATTORNEY GENERAL
Title 940 CMR 11.00 - Fair Information Practices Act
Section 11.04 - Access to Personal Data by Persons Other than the Data Subject

(a) Access to Personal Data. Except as provided in 940 CMR 11.04, the AGO shall not allow any other agency or individual not employed or contracted by the AGO to have access to personal data unless such access is authorized by law, or is approved by the data subject if the data subject is entitled to access under M.G.L. c. 66A, § 2(i) and 940 CMR 11.00.

(b) Response to Public Records Requests. Any information concerning an individual which, because of name, identifying number, mark, description, or other such personal identifiers, can be readily associated with a particular individual, that is contained in a public record as defined by M.G.L. c. 4, § 7, cl. Twenty-sixth, is not "personal data" and therefore, public records containing such information may be disseminated to any person making such request, provided that any personal information as defined by M.G.L. c. 93H is redacted prior to dissemination. As illustration, and without limitation, the following records received and maintained by the AGO will ordinarily be considered "public records".

(a) The AGO may disseminate personal data if such dissemination is authorized in writing by the data subject;

(b) The AGO may disseminate personal data in response to compulsory legal process, provided that the procedures required by M.G.L. c. 66A, § 2(k) are followed;

(c) The AGO may disseminate personal data to another federal, state, or local governmental entity for criminal or civil law enforcement purposes, including multi-state investigations, provided the AGO and any such entity have an agreement or protective order in place to keep the personal data confidential;

(d) The AGO may disseminate personal data where such dissemination is necessary to make a good faith effort to settle a case in which the AGO is or represents a party in the course of litigation, or to resolve, settle, or mediate a matter which would otherwise be necessary to litigate, or which otherwise could not be resolved;

(e) The AGO may disseminate personal data to a national or multi-state public or private entity that collects such data for statistical purposes, provided that the entity and the AGO have an agreement in place that preserves the anonymity of the individuals to whom the personal data relates;

(f) The AGO may disseminate personal data to the entity or individual that originally provided the AGO with such data;

(g) The AGO may disseminate personal data for any other purpose not explicitly set forth in M.G.L. c. 66A, § 2(c), provided that such dissemination is not inconsistent with the purposes of M.G.L. c. 66A, i.e., the purpose(s) for which the information was originally collected, and with other applicable laws; and

(h) The AGO may disseminate personal data as required by an order of a court of competent jurisdiction.