Code of Massachusetts Regulations › 801 CMR - EXECUTIVE OFFICE FOR ADMINISTRATION AND FINANCE › Title 801 CMR 3.00 - Privacy And Confidentiality › Section 3.03 - Access to Personal Data

Current through Register 1525, July 5, 2024
Subject to
				801 CMR 3.01
				and 3.03, the holder shall not allow any other agency or individual not
				employed by the holder to have access to personal data unless such access is
				authorized by statute or regulation which are consistent with the purposes of
				M.G.L. c. 66A, or is approved by the data subject if the data subject is
				entitled to access under M.G.L. c. 66A, § 2(I). The holder may adopt rules
				identifying the specific types of personal data applicable to that holder and a
				manner of dissemination that is consistent with
				801
				CMR 3.00. Nothing in
				801
				CMR 3.00 shall be construed as authorizing the holder
				to release information, the disclosure of which is prohibited by any statute
				other than M.G.L. c. 66A.
Consistent with the purposes of M.G.L. c. 66A and
				801
				CMR 3.00, the holder may disseminate personal data to
				persons other than the data subject as follows:
(a) The holder may disseminate personal data
			 in response to compulsory legal process, provided that the procedures required
			 by M.G.L. c. 66A, § 2(k) are followed. The holder need not provide the
			 notice required under M.G.L. c. 66A, § 2(k), if a court orders otherwise
			 upon a finding that notice to the data subject would probably so prejudice the
			 administration of justice that good cause exists to delay or dispense with such
			 notice.
(b) A holder may
			 disseminate personal data to any federal, state, or local governmental entity
			 for criminal or civil law enforcement purposes, provided that an authorized
			 representative of the governmental entity has made a written request to the
			 holder specifying the record desired and the law enforcement activity for which
			 the record is sought, and the governmental entity agrees in writing to keep the
			 personal data confidential to the extent permitted by law.
(c) The holder may disseminate personal data
			 to the United States Census Bureau to aid the Bureau in connection with an
			 official census or survey, provided that the Bureau agrees to keep the personal
			 data confidential to the extent permitted by law.
(d) The holder may disseminate personal data
			 as required by an order of a court of competent jurisdiction.
(e) The holder may disseminate medical or
			 psychiatric data to a physician treating a data subject upon the request of
			 said physician, or to other persons to the extent consistent with federal or
			 other applicable law, if a medical or psychiatric emergency arises which
			 precludes the data subject's giving approval for the release of such data, but
			 the data subject shall be given notice of such access upon termination of the
			 emergency. The holder may disseminate personal data to other persons if an
			 emergency arises that precludes the data subject's giving approval for the
			 release of such data and dissemination is necessary for reasons related to the
			 health or safety of the data subject, or in circumstances posing an immediate
			 threat to public safety, provided that the scope of disclosure is limited to
			 the extent necessary to alleviate or address the emergency. The data subject
			 shall be given notice of such dissemination upon termination of the
			 emergency.