Code of Massachusetts Regulations › 940 CMR - OFFICE OF THE ATTORNEY GENERAL › Title 940 CMR 11.00 - Fair Information Practices Act › Section 11.05 - Access to Personal Data by Data Subjects

Current through Register 1525, July 5, 2024
(1)
General Rules Regarding
			 Access to Personal Data
.
(a)
Data Subject Inquiry
. The data subject may request, in
			 writing, that the AGO perform a search to locate the subject's own personal
			 data held within the personal data systems maintained by the AGO. Such search
			 shall be considered compliant with M.G.L. c. 66A, § 2 if the name of the
			 data subject is used to search for any such personal data within all personal
			 data systems.
(b)
Request of Data Subject for Notification of Holding
.
			 Where required by law, the AGO shall, within 20 days of receipt of a request,
			 inform any data subject in writing whether the AGO maintains any personal data
			 concerning such individual within its personal data systems.
(c)
Notification of Denial of
			 Access to Data
. If access is denied, the AGO shall, within 20 days
			 of receipt of a request, notify in writing a data subject of its denial of the
			 request for access.
(d)
Right of Data Subject to Access
. Where access is
			 required by law, the AGO shall, in a timely manner, grant a data subject access
			 to the subject's own personal data within the personal data systems maintained
			 by the AGO to which the data subject is entitled in accordance with 940 CMR
			 11.05.
(e)
Modes of
			 Access
. The AGO may, at its discretion, provide a data subject
			 with the subject's own personal data by either creating a compilation of the
			 data that is contained within the personal data systems maintained by the AGO,
			 or reproducing the records that contain personal data.
(f)
Payment of Fees
.
			 The AGO may charge fees in accordance with 940 CMR 11.05 when a data subject
			 requests that a search for personal data be made, and for the inspection,
			 creation, or copying of any record containing the personal data to which access
			 is granted, according to the fee schedule set forth in 940 CMR 11.05(1)(g). The
			 AGO may require prepayment of fees or may waive such requirement.
(g)
Fee Schedule
.
			 The AGO may charge the following fees for responding to a request under M.G.L.
			 c. 66A:
1.The labor cost to search a system of
			 records for personal data, and, if found, to remove third party identifiers
			 (redaction), if applicable, and to prepare the personal data, or the records
			 containing the personal data, for inspection or photocopying will be $15.00 per
			 hour;
2.The cost to provide a copy
			 of the personal data, or the records containing personal data, will be $.25 per
			 page, which may be adjusted from time to time according to the Consumer Price
			 Index. Notice of any such adjustment will be provided to the requesting party
			 before any copies are made;
3.Where
			 the records containing personal data cannot be simply photocopied or printed
			 from a computer, the actual cost to reproduce the personal data may be
			 assessed; and
4.For requests
			 entailing less than one hour of search and redaction time, and resulting in no
			 more than 50 pages of records, a flat fee of $15.00 may be assessed; a flat fee
			 of $15.00 may also be assessed for requests requiring the creation of a
			 compilation in order to more efficiently provide the personal data to the data
			 subject.
(h)
Known Personal Data
. A request by a data subject for a
			 copy of the records containing all of the subject's own personal data submitted
			 to the AGO by the data subject, or a copy of all records containing personal
			 data already provided to the data subject by the AGO, shall not be considered a
			 request for personal data under M.G.L. 66A. The AGO, in its discretion and in
			 compliance with records retention policies, may copy or return such records
			 after receipt from the requester of a flat fee of $20.00.