Todd Wallack v. Department of Criminal Justice Information Services (SPR 20243352)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records January 3, 2025 SPR24/3352 Agapi Koulouris, Esq. General Counsel Department of Criminal Justice Information Services 200 Arlington Street, Suite 2200 Chelsea, MA 02150 Dear Attorney Koulouris: I have received the petition of Todd Wallack, of WBUR, appealing the response of the Massachusetts Department of Criminal Justice Information Services (DCJIS) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On August 29, 2024, Mr. Wallack requested: [1] Any complaints made to the agency since 1/1/2019 about improper access and dissemination of criminal offender recorder information (CORI). [2] Any written responses to those complaints. Previous Appeal This request was the subject of a previous appeal See SPR22/2690 Determination of the Supervisor of Records (October 7, 2024). In my October 7th determination, DCJIS was ordered to provide a response. DCJIS responded on November 22, 2024. Unsatisfied with the response, Mr. Wallack petitioned this office and this appeal, SPR24/3352, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Agapi Koulouris, Esq. SPR24/3352 Page 2 January 3, 2025 It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. DCJIS’ November 22nd Response In its November 22, 2024 response, DCJIS cites Exemptions (a) and (c) of the Public Records Law to withhold the requested records. DCJIS advised, “[i]n response to the July 3, 2024 request DCJIS had provided copies of its annual reports for FY20, FY21, FY22, and FY23. Each annual report includes a summary of the complaints received and reviewed by the Criminal Record Review Board along with the disposition of each complaint. DCJIS has not published its FY24 annual report to date. It files its annual reports in December.” DCJIS also cited Exemption (f) of the Public Records Law to withhold records but provided no analysis. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Att’y Gen. v. Collector of Lynn, 377 Mass. 151, 154 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists

Agapi Koulouris, Esq. SPR24/3352 Page 3 January 3, 2025 individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. In its response, DCJIS cites the Criminal Offender Record Information (CORI) Act. The current definition of CORI is as follows: Criminal offender record information,” records and data in any communicable form compiled by a Massachusetts criminal justice agency which concern an identifiable individual and relate to the nature or disposition of a criminal charge, an arrest, a pre-trial proceeding, other judicial proceedings, previous hearings conducted pursuant to section 58A of chapter 276 where the defendant was detained prior to trial or released with conditions under subsection (2) of section 58A of chapter 276, sentencing, incarceration, rehabilitation, or release. Such information shall be restricted to information recorded in criminal proceedings that are not dismissed before arraignment. Criminal offender record information shall not include evaluative information, statistical and analytical reports and files in which individuals are not directly or indirectly identifiable, or intelligence information. Criminal offender record information shall be limited to information concerning persons who have attained the age of 18 and shall not include any information concerning criminal offenses or acts of delinquency committed by any person before he attained the age of 18; provided, however, that if a person under the age of 18 was adjudicated as an adult in superior court or adjudicated as an adult after transfer of a case from a juvenile session to another trial court department, information relating to such criminal offense shall be criminal offender record information. . . . G. L. c. 6, § 167. Under Exemption (a), DCJIS asserts: In this request, it appears that you are now seeking the individual complaints along with the responses to those complaints. The complaints that you seek allege improper access to, and dissemination of CORI. The complaint files and responses to those complaints contain personal identifying information of the complaint subject including the complainant’s CORI and other types Criminal Justice Information (“CJI”) that are exempt from public disclosure under the law pursuant to M.G.L. c. 4, §7 clause 26(a), (c) and (f), M.G.L. c. 6, § 172, 28 CFR 20.33, 18 USC 2721 and the FBI CJIS Security Policy. The files, may include but not be limited to any of the following records: CORI, RMV, FBI records, CJIS audit logs, and personnel investigation records. The CORI statute is clear in its exemption of CORI records from the public records law. M.G.L. c. 6, § 172 provides in part, “the department shall maintain criminal offender record information in a database, which shall exist in an electronic format and be accessible via the world wide web. Except as provided

Agapi Koulouris, Esq. SPR24/3352 Page 4 January 3, 2025 otherwise in this chapter, access to the database shall be limited as follows:” The statute and further sections of the General Laws then continue and outline the provisions under which CORI may be lawfully accessed and disseminated. There is no specific exemption in the law that allows for public dissemination of CORI pursuant to a public records request of this type. DCJIS processes requests for publicly accessible CORI under the provisions of M.G.L. c. 6, § 172(a)(4). M.G.L. c. 6, § 172(a)(4) does not authorize access to CORI relating to complaints but, rather requests for an individual CORI record submitted to DCJIS by name under the procedures established under the law. The present request, is not a request for an individual CORI record but, rather a complaint file(s) that contains information that is outside of the limited parameters for access to records afforded under the CORI statute. Likewise, 28 CFR 20.33 limits public access to FBI files in paragraph (c) as follows, “Nothing in these regulations prevents a criminal justice agency from disclosing to the public factual information concerning the status of an investigation, the apprehension, arrest, release, or prosecution of an individual, the adjudication of charges, or the correctional status of an individual, which is reasonably contemporaneous with the event to which the information relates.” The aforementioned request does not authorize disclosure of the records requested. Furthermore, DCJIS may be subject to sanctions by the FBI should it improperly disseminate records. 28 C.F.R. 20.33(b) provides in part, “The exchange of criminal history record information authorized by paragraph (a) of this section is subject to cancellation if dissemination is made outside the receiving departments, related agencies, or service providers identified in paragraphs (a)(6) and (a)(7) of this section. Based upon DCJIS’ response, DCJIS has not met its burden to show that the records, in their entirety, fall within the CORI Act. Specifically, DCJIS has not demonstrated that all of the withheld records constitute “information recorded in criminal proceedings that are not dismissed before arraignment” as defined in G. L. c. 6, § 167. See Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 289-90 (1979) (the statutory exemptions are narrowly construed and are not blanket in nature). Any non-exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 10(a). Exemption (c) Exemption (c) applies to: personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation

Agapi Koulouris, Esq. SPR24/3352 Page 5 January 3, 2025 G. L. c. 4, § 7(26)(c). Analysis under Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case-by-case basis. Massachusetts courts have found that “core categories of personnel information that are ‘useful in making employment decisions regarding an employee’” may be withheld from disclosure. Worcester Telegram & Gazette Corp. v. Chief of Police of Worcester, 58 Mass. App. Ct. 1, 5 (2003). For example, “employment applications, employee work evaluations, disciplinary documentation, and promotion, demotion, or termination information pertaining to a particular employee,” may be withheld pursuant to Exemption (c). Wakefield Teachers Ass’n v. Sch. Comm., 431 Mass. 792, 798 (2000). The courts have also discussed specific categories of records that may be redacted under Exemption (c). See Globe Newspaper Co. v. Exec. Office of Admin. and Fin., Suffolk Sup. No. 11-01184-A (June 14, 2013). There are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). When analyzing a privacy claim, there is a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law abiding and efficient manner. Id. at 292. In its response, DCJIS further states, DCJIS also asserts that the files are exempt from disclosure based on G.L. c. 4, §7 clause 26(c) pursuant to the personnel records exemption applicable to non-law enforcement entities as well as the privacy exemption therein. The complaint files may contain reports summarizing personnel records and discipline reported to DCJIS during the course of complaint investigations by such entities and as such, exempt from disclosure. In addition, DCJIS asserts the privacy exemption on the basis that individuals filing a complaint with DCJIS have asserted that their privacy rights relating to CORI, the CORI regulations, and/or other types of CJI relating to them have been improperly assessed or disseminated in violation of applicable statutes. As discussed in more detail in the section below, DCJIS publishes an annual report that the statute specifically mandates contain de-identified data relating to complaints. For DCJIS to release this information pursuant to a public records request, it will constitute an unwarranted invasion of privacy and may deter others from filing complaints with the Board.

Agapi Koulouris, Esq. SPR24/3352 Page 6 January 3, 2025 Based on DCJIS’ response, it is unclear how the records constitute one of the core categories of personnel information useful in making employment decisions regarding an employee. It is additionally uncertain how the records, in their entirety, contain intimate details of a highly personal nature, nor how disclosure would result in personal embarrassment to an individual of normal sensibilities. It is also not clear whether this information is available from other sources. PETA, 477 Mass. at 292. Further, DCJIS did not provide information with respect to examining whether the public interest in obtaining the requested information outweighs the seriousness of any invasion of privacy. Id. Further, DCJIS must clarify whether segregable portions can be provided. See Reinstein, 378 Mass. at 289-90 (the statutory exemptions are narrowly construed and are not blanket in nature). Any non-exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 10(a). Conclusion Accordingly, DCJIS is ordered to provide Mr. Wallack with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Wallack’s may appeal the substantive nature of DCJIS’s response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: Todd Wallack