Open Commonwealth v. Executive Office of Technology Services and Security (SPR 20230078)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records January 31, 2023 SPR23/0078 Michelle Burwell Records Access Officer Executive Office of Technology Services and Security One Ashburton Place, Room 804 Boston, MA 02108 Dear Ms. Burwell: I have received the petition of OpenCommonwealth.org appealing the response of the Executive Office of Technology Services and Security (Office/EOTSS) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On October 28, 2022, OpenCommonwealth.org requested: [1] Any and all responsive records during the time period beginning October 1, 2021 through the date you respond, which include: [a] Any and all emails between [a named individual] and or the BSEA/DALA and any employee of EOTSS which is/are requesting a search and/or assistance and/or estimates of documents and/or production of documents regarding public records requests made upon the BSEA and/or DALA. [b] Any and all text messages between [a named individual] and or the BSEA/ DALA and any employee of EOTSS which is/are requesting a search and/or assistance and/or estimates of documents and/or production of documents regarding public records requests made upon the BSEA and/or DALA. [c] Any and all written or typewritten documents between [a named individual] and or the BSEA/DALA and any employee of EOTSS which is/are requesting a search and/or assistance and/or estimates of documents and/or production of documents regarding public records requests made upon the BSEA and/or DALA. [d] Any and all voice mail messages or memos between [a named individual] and or the BSEA/DALA and any employee of EOTSS which is/are requesting a search and/or assistance and/or estimates of documents and/or production of documents regarding public records requests made upon the BSEA and/or DALA. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Michelle Burwell SPR23/0078 Page 2 January 31, 2023 Previous Appeal This request was the subject of a previous appeal. See SPR22/2857 Determination of the Supervisor of Records (December 28, 2022). In my December 28th determination, I ordered the Office to provide the requestor with a response to the request. On January 11, 2023, the Office responded. Unsatisfied with the Office’s response, the requestor petitioned this office and this appeal, SPR23/0078, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Office’s January 11th Response In its January 11, 2023 response, the Office states: [1] In the matter at hand, EOTSS operates as a legal service provider for DALA/BSEA’s own legal staff. Specifically, EOTSS’ eDaaS team provided ediscovery services that were used by DALA/BSEA legal staff to develop legal advice for their own clients ([i].e., DALA/BSEA). Just as clients of a private law firm has not waived their attorney-client privilege when that firm communicates confidentially with third party legal service providers (e.g., retaining a third party ediscovery service provider to ingest and review large data sets), DALA/BSEA has not waived its privilege here by communicating with the eDaaS team about its own ediscovery service requests. “The attorney-client privilege not only protects statements made by the client to the attorney in confidence for the purpose of obtaining legal advice in a particular

Michelle Burwell SPR23/0078 Page 3 January 31, 2023 matter, but also protects such statements made to or shared with necessary agents of the attorney or the client, including experts consulted for the purpose of facilitating the rendition of such advice.” Hanover Ins. Co. v. Rapo Jepsen Ins. Servs., Inc., 449 Mass. 609, 616 (2007) (emphasis added). Any determination to the contrary would create an exception to the attorney-client privilege that would largely swallow the rule as requestors could circumvent a privilege claim by (1) submitting a public records request to a Commonwealth entity that uses a public third party ediscovery service provider such as EOTSS, and then (2) submitting a second request to that service provider for all edsicovery records related to the first request. [2] As stated in the caselaw cited above, essential, non-attorney agents may be included in confidential communications without waiving attorney-client privilege where those communications are made for the purpose of rendering or facilitating advice. Id. In the normal course of business, all ediscovery service requests from DALA/BSEA to the eDaaS team are made by pre-authorized personnel from DALA/BSEA’s legal staff (either lawyers or legal support staff), and all of these requests are transmitted directly to EOTSS’ eDaaS team. Only the EOTSS legal staff (to whom the eDaaS team reports) and eDaaS team members have access to the contents of ediscovery search requests. Here, all of the records logged in the December 13 Response were between DALA/BSEA personnel and eDaaS personnel and were made for the purpose of creating, refining, or interpreting eDiscovery search results. EOTSS’ eDaaS team personnel are clearly essential agents with regard to the provision of ediscovery services by EOTSS. Accordingly, all of those records are properly described as confidential communications between DALA/BSEA legal staff and their own essential agents. Such communications do not constitute a waiver of privilege. See id. [3] EOTSS did not identify any responsive records that were not listed in the privilege log. OpenCommonwealth.org’s confusion about the number of identified records likely stems from the formatting of EOTSS’ December 13 Response. The privilege log included with that response contained two hundred twenty-one (221) populated rows of data. Discounting the single row of headers atop each column, metadata for two hundred twenty (220) records were included in the log. Of those records twenty-five (25) do not have any “date sent” information because they are not, themselves, .msg message files associated “data sent” metadata. They are, instead, other file types (e.g., .pdf, .xlsx, .png) that were embedded in email messages. These records were included in the privilege log because the EOTSS personnel who reviewed the log believed that the content of these non-.msg files was relevant to the contents of the associated email communications and the records were therefore responsive to the original request.

Michelle Burwell SPR23/0078 Page 4 January 31, 2023 [4] EOTSS did redact some information from the privilege log included in its December 13 Response. Specifically, EOTSS redacted the names of individuals where they appeared in the subject lines of email communications (or in filenames derived from those subject lines). EOTSS did this from an abundance of caution in light of the following considerations: (2) the eDaaS personnel who reviewed these records are not familiar with the subject matter of this request and did not know if the named people were DALA/BSEA personnel, or private individuals related to OpenCommonwealth.org’s request, or private third parties who had also submitted unrelated public records requests to DALA/BSEA; (b) including a private citizen’s name in the administrative record of another, potentially unrelated, public records request might result in the personal embarrassment of a normal person of reasonable sensibilities; and (c) the time necessary to research and identify these individuals to develop a particularized basis for asserting exemption (c) would have prolonged the already extended time necessary to prepare the December 13 Response. Accordingly, the EOTSS reviewers determined that the prudent course would be to redact all personal names from the privilege log under exemption (c) and then offer this additional contextual information if sought by the Supervisor or Requestor. If so instructed by the Supervisor, EOTSS can produce an unredacted version of the privilege log. [5] As stated above, EOTSS is not aware of any records responsive to OpenCommonwealth.org’s request that were not listed in the privilege log included in the December 13 Response. Every potentially responsive record produced by EOTSS’ internal search systems was reviewed by EOTSS personnel, and every record determined to be responsive to the request was listed in the privilege log. EOTSS did not find any responsive records that are not subject to the attorney-client privilege asserted in this Supplemental Response. Common law attorney-client privilege A records custodian claiming the attorney-client privilege under the Public Records Law has the burden of not only proving the existence of an attorney-client relationship, but also (1) that the communications were received from a client during the course of the client’s search for legal advice from the attorney in his or her capacity as such; (2) that the communications were made in confidence; and (3) that the privilege as to these communications has not been waived. See Suffolk Constr. Co. v. Div. of Capital Asset Mgmt., 449 Mass. 444, 450 n.9 (2007); see also Hanover Ins. Co. v. Rapo & Jepsen Ins. Servs., 449 Mass. 609, 619 (2007) (stating that the party seeking the attorney-client privilege has the burden to show the privilege applies). Records custodians seeking to invoke the common law attorney-client privilege “are required to produce detailed indices to support their claims of privilege.” Suffolk, 449 Mass. at 460. Pursuant to the Public Records Law, in assessing whether a records custodian has properly withheld records based on the claim of attorney-client privilege, the Supervisor of Records “shall not inspect the record but shall require, as part of the decision making

Michelle Burwell SPR23/0078 Page 5 January 31, 2023 process, that the agency or municipality provide a detailed description of the record, including the names of the author and recipients, the date, the substance of such record, and the grounds upon which the attorney-client privilege is being claimed.” G. L. c. 66, § 10A(a). In Suffolk, the Supreme Judicial Court held that “the attorney-client privilege shields from the view of third parties all confidential communications between a client and its attorney undertaken for the purpose of obtaining legal advice.” Suffolk, 449 Mass. at 448. In addition, the Court “state[d] explicitly that confidential communications between public officers and employees and governmental entities and their legal counsel undertaken for the purpose of obtaining legal advice or assistance are protected under the normal rules of the attorney-client privilege.” Id. at 450. The Office must explain the attorney-client relationship between the Office and BSEA/DALA. In particular, the Office must provide additional information about how the communications were received from a client during the course of the client’s search for legal advice from the attorney in his or her capacity as such. It is additionally uncertain how the underlying documents constitute legal advice that can be withheld under the attorney-client privilege. Pursuant to G. L. c. 66, § 10A(a), the Office must provide additional information in the privilege log regarding the substance of each record, and the names of the authors and recipients, and the dates when not provided. Exemption (c) Exemption (c) applies to: personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation G. L. c. 4, § 7(26)(c). Analysis under Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. This exemption requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law abiding and efficient manner. Id. at 292.

Michelle Burwell SPR23/0078 Page 6 January 31, 2023 There are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). Although the Office states it may redact the names in the responsive records under Exemption (c), the Office has not sufficiently explained its reasoning. It is uncertain how this information constitutes intimate details of a highly personal nature or how disclosure would result in personal embarrassment to an individual of normal sensibilities. Additionally, it is not clear from the Office’s response, whether this information is available from other sources. The Office must clarify these matters. Conclusion Accordingly, the Office is ordered to provide the requestor with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, Manza Arthur Supervisor of Records cc: OpenCommonwealth.org