Wayne A. Perkins, Esq. v. Department of Early Education and Care (SPR 20211711)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records July 26, 2021 SPR21/1711 Denise J. Karlin, Esq. Assistant General Counsel Department of Early Education and Care 51 Sleeper Street Fourth Floor Boston, MA 02210 Dear Attorney Karlin: I have received the petition of Wayne A. Perkins, Esq. appealing the response of the Department of Early Education and Care (Department) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On May 28, 2021, Attorney Perkins requested “public records in the care, custody and/control of the Massachusetts Department of Early Education and care which identifies all of the teachers and assistants, their EEC certifications, their mailing and email addresses located in region four.” Previous appeal This request was the subject of previous appeals. See SPR21/1591 Determination of the Supervisor of Records (July 12, 2021). The Department provided a response on July 9, 2021. Unsatisfied with the Department’s response, Attorney Perkins petitioned this office and this appeal, SPR21/1711, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Denise J. Karlin, Esq. SPR21/1711 Page 2 July 26, 2021 establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); -se-e -a-ls-o 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. Department’s July 9th Response In its July 9, 2021 response, the Department declined to provided email addresses stating “that e-mail addresses were not provided to the Requestor pursuant to a recent determination of the Attorney General’s Office, on November 6, 2020, that the provision of aggregated e-mail addresses for groups of individuals is exempt from the Public Records Law under G.L. c. 4, $7, cl. 26(n) (“exemption (n)”), the safety and security exemption.” The Department explained,”[t]here is no question that e-mail addresses are the types of information that are included in exemption (n). Many times, requests for e-mails of large groups are done by hackers or cyberterrorists for the following reasons: (1) social engineering, (2) email phishing, (3) spear phishing, and (4) business e-mail compromise. While EEC is in no way suggesting that these reasons are the basis for Requestor’s current request, it is the position of EEC, as explained in the attached Attorney General’s opinion, that EEC cannot specifically ask the purpose of such requests and, therefore, providing the e-mails makes computer systems of those individuals whose e-mails were sought vulnerable to such attacks.” The Department further explained, “the individuals listed in the databases supplied by EEC are not public employees but are private citizens who have sought a license or credential from EEC and, therefore, have a higher expectation of privacy than public employees.” In Attorney Perkins’ July 12, 2021 appeal to this office, he states, “[t]here has been no showing as to how the disclosure of the teacher’s and assistant’s emails would jeopardize the Commonwealth’s cybersecurity using the PETA standards.” The Department provided a supplemental response on July 19, 2021 contending, “the e- mails should also be withheld pursuant to G.L. c. 4, $7, cl. 26(c) (‘exemption (c)’), the privacy exemption, as well as under exemption (n), the safety and security exemption. The individuals registered in the EEC Professional Qualifications Registry (‘PQR’) have an expectation that their e-mail addresses will not be disclosed to third parties by EEC. EEC requests the e-mail addresses in order to communicate with the individuals registered in the PQR and not for any other reason.” Exemption (c) Exemption (c) applies to:

Denise J. Karlin, Esq. SPR21/1711 Page 3 July 26, 2021 personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation G. L. c. 4, § 7(26)(c). Analysis under Exemption (c) is subjective in nature and requires a balancing of the public's right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm'r of Real Property Dep't, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. This exemption does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep't of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) ---------------------------- (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This exemption requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law abiding and efficient manner. Id. at 292. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security.

Denise J. Karlin, Esq. SPR21/1711 Page 4 July 26, 2021 G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” PETA, 477 Mass. at 289-90. The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. Despite the Department’s July 9th response, it is unclear whether the requested email addresses listed in the Department’s data are business email addresses. The Department must clarify this. Conclusion Accordingly, the Department is ordered to provide Attorney Perkins with a response to the request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within 10 business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, .fJ. 11. • ~ .~- ~ 0 ,wJW:,(J.. . - .. Rebecca S. Murray Supervisor of Records cc: Wayne A. Perkins, Esq.