Tom Shea v. Hampden County Regional Retirement Board (SPR 20252588)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records September 15, 2025 SPR25/2588 Karen P. Martin Executive Director Hampden County Regional Retirement Board 67 Hunt Street, Suite 202 Agawam, MA 01001 Dear Ms. Martin: I have received the petition of Tom Shea appealing the response of the Hampden County Regional Retirement Board (Board/HCRBR) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On February 16, 2025, Mr. Shea requested “…HCRBR assigned email addresses of the HCRBR Board Members.” Previous Appeals This request was the subject of previous appeals. See SPR25/0714 Determination of the Supervisor of Records (March 25, 2025); SPR25/1716 Determination of the Supervisor of Records (June 27, 2025); and SPR25/2171 Determination of the Supervisor of Records (August 5, 2025). In my August 5th determination, I found that the Board had not met its burden to withhold the requested email addresses under Exemptions (b) and (n) of the Public Records Law and ordered it to provide a further response. The Board responded on August 19, 2025. Unsatisfied with the Board’s response, Mr. Shea petitioned this office and this appeal, SPR25/2588, was opened as a result. While this appeal was pending, the Board provided a supplemental response on September 12, 2025. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Karen P. Martin SPR25/2588 Page 2 September 15, 2025 It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Board’s August 19th and September 12th Responses In its August 19, 2025 response, the Board continued to cite Exemptions (b) and (n) of the Public Records Law to withhold the responsive email addresses. In a supplemental response on September 12, 2025, the Board also cited Exemption (c) of the Public Records Law to withhold the email addresses and further explained its position under Exemption (b). Current Appeal In his appeal petition, Mr. Shea stated, “[t]he HCBR has failed to comply with your most recent determination and the previous one.” Exemption (b) Exemption (b) permits the withholding of records that are: related solely to internal personnel rules and practices of the government unit, provided however, that such records shall be withheld only to the extent that proper performance of necessary governmental functions requires such withholding G. L. c. 4, § 7(26)(b). There are no authoritative Massachusetts decisions interpreting Exemption (b). The general purpose of the cognate federal exemption is to relieve agencies of the burden of assembling and maintaining for public inspection materials in which the public cannot reasonably be expected to have an interest. See Dep’t of the Air Force v. Rose, 425 U.S. 352, 362-70 (1976) (interpreting the federal Freedom of Information Act, which provides an exemption for records which are “related solely to the internal personnel rules and practices of an agency”); see also Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 432 (1983) -------------------------------- (Massachusetts Public Records Law modeled on federal Freedom of Information Act).

Karen P. Martin SPR25/2588 Page 3 September 15, 2025 The courts have interpreted the federal exemption to allow withholding of materials that, if released, could cause agency rules or regulations to be circumvented. See Fiumara v. Higgins, 572 F. Supp. 1093, 1102 (1983) (internal codes are exempt where disclosure may enable outsiders to circumvent agency functions). The analysis employed by the federal courts requires a two-pronged test. Material is exempt if it is predominantly used internally and if disclosed would significantly risk circumvention of agency regulations and statutes. See Marrera v. United States Dep’t of Justice, 622 F. Supp. 51, 55 (D.D.C. 1985) (Bureau of Prisons access and identity codes were properly withheld as materials in which the public would have no legitimate interest or which would compromise security if disclosed). In its August 19, 2025 response under Exemption (b), the Board stated: …[T]he HCRRB board members email addresses are for inter-office email use only. They are related solely to the internal personnel rules and practices of our agency. These emails are used by… our records custodian and human resources personnel…The cases that were cited in the State’s last letter, were prior to a Supreme Court ruling that updated Exemption 2 which states: Agencies must balance the need to protect internal operations with the public’s right to access government information… We would release email addresses if we thought the release of such information would not allow for possible foreseeable harm. No one other than HCRRB board employees has access to the last two elected board members’ email addresses because they are internal emails that are used solely by [identified individuals], the attorney, and the other board members. Because of our policy, they would be of no use to anyone else… In its supplemental response on September 12, 2025, the Board stated: These email addresses are known only to the other HCRRB board members, me, and The Director, who also serves as our Supervisor of Public Records. They are only used to correspond between the board members, the Director, and the Chairman. No other person has ever asked for these email addresses…They are not only government entity issued email addresses. They all have HCRRB but some are Yahoo, Gmail, Outlook or others… Although the Board states that the email addresses are solely for internal purposes, the Board has not sufficiently demonstrated how the email addresses relate solely to internal personnel rules and practices of the government unit nor how disclosure of the email addresses would hinder the proper performance of necessary governmental functions. Consequently, the Board has not met its burden of specificity to withhold the responsive email addresses under Exemption (b). Exemption (c) Exemption (c) permits the withholding of:

Karen P. Martin SPR25/2588 Page 4 September 15, 2025 personnel and medical files or information and any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation. G. L. c. 4, § 7(26)(c). Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case-by-case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. ---------------------------- App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. In its September 12, 2025 response under Exemption (c), the Board stated: No other person has ever asked for these email addresses… our Director and records custodian, has not released these email addresses to Mr. Shea as they could be considered private email addresses since the Board members created these themselves. They are not only government entity issued email addresses. They all have HCRRB but some are Yahoo, Gmail, Outlook or others. The Board members access these emails through various types of their personal electronic devices, such as cell phones, watches, laptops or home computers… There has been no substantial potential for public interest outside the government unit. Based on the Board’s response, it is unclear how the Board may withhold responsive records pursuant to Exemption (c) of the Public Records Law. In this case, the Board has not established how the withheld email addresses contain intimate details of a highly personal nature

Karen P. Martin SPR25/2588 Page 5 September 15, 2025 or how disclosure would result in personal embarrassment to an individual of normal sensibilities. Further, it is uncertain whether any of the information is available from other sources. PETA, 477 Mass. at 292. The Board must also provide information with respect to the balancing test which examines whether the public interest in obtaining the requested information outweighs the seriousness of any invasion of privacy. Consequently, the Board has not met its burden to withhold responsive records under Exemption (c) of the Public Records Law. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its August 19, 2025 response under Exemption (n), the Board stated:

Karen P. Martin SPR25/2588 Page 6 September 15, 2025 …[B]oard members access emails on their personal devices such as cell phones, laptops, desktops, etc. Your computer or devices could have ransomware or malware on it, and you wouldn’t even know it. By giving you these email addresses, the board members’ personal devices could be compromised, since they do not have the same protection our office security provides. Cyber criminals and cyber terrorists are constantly improving, innovating and refining their techniques to penetrate our defenses. We are continually trying to improve our cyber awareness and hygiene to stay of potential threats. I’m sure you remember when someone tried to PHISH my email account to steal $24,000,000.00 and transfer it to a different account. We could have lost that money without safety policy and procedures in place. I am also reminding you of the Town of Arlington losing $450,000.00 through cybertheft last year. Also, on June 26, 2025, another retirement board’s IT network was accessed, and ransomware was used to encrypt and prevent access to network files. Based on the Board’s response, I find that the requested email addresses do not resemble the records listed as examples in the statute. See PETA, 477 Mass. at 289. Specifically, the records do not resemble “blueprints, plans, policies, procedures and schematic drawings” that relate to security measures. It is also unclear how the records are the type that “a terrorist would find useful to maximize damage” as required under Exemption (n). Where the requested records bear a minimal resemblance to the categories listed in Exemption (n), the burden on the custodian to prove its “reasonable judgment” that disclosure is likely to jeopardize public safety is greatest. See id. at 290 (noting “inverse correlation” between the two prongs of Exemption (n) inquiry). Further, the Board did not provide factual heft to support the withholding of the requested records pursuant to Exemption (n). Specifically, the Board has not sufficiently explained how disclosure of the email addresses is likely to jeopardize public safety or cyber security. See PETA, at 289-90. As a result, the Board has not met its burden to withhold the responsive email addresses under Exemption (n). Conclusion Accordingly, the Board is ordered to provide Mr. Shea with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Shea may appeal the substantive nature of the Board’s response within ninety (90) days. See 950 C.M.R. 32.08(1).

Karen P. Martin SPR25/2588 Page 7 September 15, 2025 Sincerely, Manza Arthur Supervisor of Records cc: Tom Shea