Todd Wallack v. Department of Criminal Justice Information Services (SPR 20242343)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records September 3, 2024 SPR24/2343 Agapi Koulouris, Esq. General Counsel Department of Criminal Justice Information Services 200 Arlington Street, Suite 2200 Chelsea, MA 02150 Dear Attorney Koulouris: I have received the petition of Todd Wallack, of WBUR, appealing the response of the Massachusetts Department of Criminal Justice Information Services (DCJIS) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On July 5, 2024, Mr. Wallack requested: [1] Any data showing the number of times that people with access to the CJIS systems have accessed [a named individual’s] CORI record without good reason to do so since January 1, 2019. (Alternatively, if you do not have that data available, please provide the total number of times that users have accessed [a named individual’s] CORI report since Jan. 1, 2019.) [2] Any data showing the number of times that people with access to the CJIS systems have accessed [a named individual’s] CORI record without good reason to do so since January 1, 2019. (Alternatively, if you do not have that data available, please provide the total number of times that users have accessed [a named individual’s] CORI report since Jan. 1, 2019.) [3] Any data showing the number of times that people with access to the CJIS systems have accessed [a named individual’s] CORI record without good reason to do so since January 1, 2019. (Alternatively, if you do not have that data available, please provide the total number of times that users have accessed [a named individual’s] CORI report since Jan. 1, 2019.) [4] Any data showing the number of times that people with access to the CJIS systems have accessed [a named individual’s] CORI record without good reason to do so since January 1, 2019. (Alternatively, if you do not have that data One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Agapi Koulouris, Esq. SPR24/2343 Page 2 September 3, 2024 available, please provide the total number of times that users have accessed [a named individual’s] CORI report since Jan. 1, 2019.) [5] Any audits DCJIS has created or received since 2019 on people improperly accessing CORI reports[;] [6] Any statistics DCJIS has compiled since 2019 on misuse of CORI data. On August 1, 2024, DCJIS provided a response. Unsatisfied with the response, Mr. Wallack petitioned this office and this appeal, SPR24/2423, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(d)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based…”); 950 C.M.R. 32.06(3); see also Dist. Att’y for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. DCJIS’ August 1st Response In its August 1, 2024 response, DCJIS states: In response to your current public records request, DCJIS notes that the current request you have submitted is substantially similar to a request you had submitted to DCJIS in 2022 in which you had specifically requested CJIS audits pertaining to both yourself and [an identified individual]. After DCJIS replied to your requests and asserted that the records were exempt from public disclosure pursuant to the provisions of M.G.L. c. 4, §7 clause 26(a) and (f), M.G.L. c. 6, § 172, 28 CFR 20.33, 18 USC 2721 and the FBI CJIS Security Policy you subsequently appealed these decisions. The Supervisor of Public Records then

Agapi Koulouris, Esq. SPR24/2343 Page 3 September 3, 2024 issued determinations dated August 19, 2022, November 7, 2022, January 9, 2023, March 10, 2023, and May 23, 2023 and most recently on July 2, 2024. After reviewing these determinations, DCJIS issued replies after each determination to further explain its position. In its most recent replies dated July 18, 2023 and December 11, 2023, DCJIS took the opportunity to further explain the basis for its withholding of certain records in response to this public records request. DCJIS also requested a further in camera review of said records with the Supervisor of Public Records. In her most recent reply, the Supervisor of Public Records held that with regard to the CJIS audit records being requested in this appeal, that the matter is now closed as “In compliance with the Public Records Law, the Supervisor of Records may only issue determinations where a violation of G. L: c. 66, § 10 has occurred.” As such, by way of reference, in regard to the CJIS audits requested in paragraphs (1) through (4), DCJIS incorporates all prior responses the public records requests you have submitted to this office. Please see DCJIS responses to your public records requests dated July 5, 2022, August 4, 2022, December 22, 2022, February 23, 2023, May 9, 2023, July 18, 2023, December 11, 2023, and May 28, 2024. In summary DCJIS asserted in its responses that the requested records are exempt from public disclosure pursuant to the provisions of M.G.L. c. 4, §7 clause 26(a) and (f), M.G.L. c. 6, § 172, 28 CFR 20.33, 18 USC 2721 and the FBI CJIS Security Policy. DCJIS asserted these exemptions, as described in more detail in the referenced responses, as the information contained in CJIS audit reports contains Criminal Justice Information that is exempt from disclosure. As stated, DCJIS understands that the information that you are requesting includes CJIS audit reports that would include highly confidential data that is exempt from disclosure under the referenced statutes, regulations and policy. Current appeal In his appeal, Mr. Wallack states, “[t]he agency didn’t fully explain what documents it is withholding or why. The only documents the agency provided were copies of its annual reports.” Based on DCJIS’ response, it is unclear what types of records it possesses that it is withholding from disclosure under Exemptions (a) and (f) of the Public Records Law. G. L. c. 66, § 10(d)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based…”); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). DCJIS must clarify this matter.

Agapi Koulouris, Esq. SPR24/2343 Page 4 September 3, 2024 Conclusion Accordingly, DCJIS is ordered to provide Mr. Wallack with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Wallack may appeal the substantive nature of DCJIS’ response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: Todd Wallack