Ryan Horan v. Massachusetts Bay Transportation Authority (SPR 20252002)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records July 16, 2025 SPR25/2002 Julie A. Ciollo, Esq. Records Access Officer Massachusetts Bay Transportation Authority 10 Park Plaza, Suite 7760 Boston, MA 02116 Dear Attorney Ciollo: On July 10, 2025, this office received your petition on behalf of the Massachusetts Bay Transportation Authority (MBTA) requesting permission to assess fees for time spent segregating and redacting responsive records. G. L. c. 66, § 10(c); G. L. c. 66, § 10(d)(iv); see also 950 C.M.R. 32.06(4). As required by law, it is my understanding that the MBTA furnished a copy of the petition to the requestor, Ryan Horan. G. L. c. 66, § 10(c); G. L. c. 66, § 10(d)(iv)(2). On June 25, 2025, Mr. Horan requested “the following information for all employees currently employed by the MBTA: 1. First name. 2. Middle name. If a complete middle name is unavailable, please provide a middle initial instead. 3. Last name. 4. Gender. 5. Date of birth. If complete date of birth is unavailable, please provide age or birth year. 6. Job title. 7. Department. 8. Hire date. If date of hire is unavailable, please provide seniority date. 9. Work email address. If complete work email addresses are unavailable, please provide the formula used to generate employees’ work email addresses. 10. Worksite physical address. If full physical address is unavailable, please provide the zip code. 11. Work mailing address. If full address is unavailable, please provide the zip code. 12. Home mailing address. If full home mailing address is unavailable, please provide only home zip code. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Julie A. Ciollo, Esq. SPR25/2002 Page 2 July 16, 2025 13. Remote workers. Please indicate if any employee works remotely and the zip code they physically work from. 14. If applicable, name of union, union local, and bargaining representative. 15. If applicable, bargaining unit name, number or other identifier. 16. In a separate file or otherwise clearly noted, please provide a list of retirees from the last 2 years. Petition to assess fees – Agencies A fee shall not assessed for time spent segregating or redacting records unless such segregation or redaction is required by law or approved by the Supervisor of Records (Supervisor) under a petition. G. L. c. 66, § 10(d)(iv). See G. L. c. 66, § 10(d)(iii); 950 C.M.R. 32.06(4). In rendering such a decision, the Supervisor is required to consider the following: a) the public interest served by limiting the cost of public access to the records; b) the financial ability of the requestor to pay the additional or increased fees; and c) any other relevant extenuating circumstances. G. L. c. 66, § 10(d)(iv). The statute sets out a two-prong test for determining whether the Supervisor may approve a municipality’s petition to allow the municipality to charge for time spent segregating or redacting records or to charge in excess of $25 an hour for the provision of public records. The first prong is whether the request for records was made for a commercial purpose. G. L. c. 66, § 10(d)(iv). It is my determination that this request was not made for a commercial purpose. The second prong of the test is whether the fee represents an actual and good faith representation by the municipality to comply with the request. The Supervisor must consider 1) if the fee is necessary such that the request could not have been prudently completed without the redaction or segregation or fee in excess of $25 per hour; 2) the amount of the fee is reasonable; and 3) the fee is not designed to limit, deter or prevent access to requested public records. Id. Petitions seeking a waiver of statutory limits to fees assessed to segregate and/or redact public records must be made within ten business days after receipt of a request for public records. 950 C.M.R. 32.06(4)(g). Fee Estimates – Agencies An agency may assess a reasonable fee for the production of a public record except those records that are freely available for public inspection. G. L. c. 66, § 10(d). The fees must reflect the actual cost of complying with a particular request. Id. A maximum fee of five cents ($.05) per page may be assessed for a black and white single or double-sided photocopy of a public record. G. L. c. 66, § 10(d)(i).

Julie A. Ciollo, Esq. SPR25/2002 Page 3 July 16, 2025 Agencies may not assess a fee for the first four (4) hours of employee time to search for, compile, segregate, redact or reproduce the record or records requested. G. L. c. 66, § 10(d)(ii). Where appropriate, agencies may include as part of the fee an hourly rate equal to or less than the hourly rate attributed to the lowest paid employee who has the necessary skill required to search for, compile, segregate, redact or reproduce a record requested, but the fee shall not be more than $25 per hour. Id. Current Petition In its petition, the MBTA seeks permission to assess fees for time spent segregating and redacting responsive records. In support of its request, the MBTA provides the following information: [A]n initial reading of Mr. Horan’s request indicates that responsive records will likely contain personal information and security and/or safety-sensitive information. Therefore, the MBTA must expend time redacting this information that is protected from disclosure under Massachusetts General Laws, Chapter 4, Sections 7(26)(c) and (n). [U]nder exemption (c) . . . Certain responsive records may contain information such as leave status, non-public identification numbers, home addresses and other personal or medical information. This data, if made public, would result in personal embarrassment to the named individuals. These are highly personal details that are not otherwise available from other sources. There is no prevailing public interest requiring disclosure. [T]he request also calls for records that will require redaction under Exemption (n) to the Public Records Law . . . Specifically, responsive records in this matter may contain identification numbers or email addresses. MBTA employee email addresses are being withheld in order to protect the MBTA’s and the employees’ cybersecurity interests. This information is exempt from disclosure under Massachusetts General Laws Chapter 4, Section 7(26)(n) which exempts “… any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which…is likely to jeopardize public safety or cyber security”. [I]n this matter, the bulk disclosure of email addresses is problematic because cyber-criminals can use the information to target key individuals with spear- phishing messages or other fraudulent means of tricking them into sending money or disclosing their password. These are very common attacks that impact many organizations every year (in excess of $1B annually). The Cybersecurity and Infrastructure Security Agency (CISA) has specifically recommended “[d]o not provide personal information or information about your organization, including its

Julie A. Ciollo, Esq. SPR25/2002 Page 4 July 16, 2025 structure or networks, unless you are certain of a person’s authority to have the information”. In addition, MBTA employee email addresses are used as part of logins for the MBTA’s protected systems. These systems contain personal and security details that must remain protected. Revealing this information in bulk would publicly expose thousands of logins for MBTA systems, rendering those systems vulnerable to infiltration, ultimately leading to security breaches and jeopardizing transportation safety. Based on the information provided in its fee petition, I find the MBTA has met its burden to explain how, given the nature of the responsive records, the request could not prudently be completed without segregation or redaction. See G. L. c. 66, § 10(d)(iv). Conclusion Accordingly, I find the MBTA has met its burden to explain how the response could not be prudently completed without redaction or segregation. To the extent the responsive records contain the exempt information as described above, the MBTA may assess a fee for segregation and redaction. Also, I encourage the parties to communicate further to enable the MBTA to provide records in an efficient and affordable manner. Please note, Mr. Horan has the right to seek judicial review of this decision by commencing a civil action in the appropriate superior court. See G. L. c. 66, §§ 10(c), 10(d) (IV) (4), 10A(c). Sincerely, Manza Arthur Supervisor of Records cc: Ryan Horan