Stebbins, Ricky v. Public Employee Retirement Administration Commission (SPR 20260054)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records January 14, 2026 SPR26/0054 Felicia Baruffi, Esq. Senior Associate General Counsel Public Employee Retirement Administration Commission 10 Cabot Road, Suite 300 Medford, MA 02155 Dear Attorney Baruffi: On January 7, 2026, this office received your petition on behalf of the Public Employee Retirement Administration Commission (PERAC/Commission) seeking an extension of time to produce records and permission to charge for time spent segregating or redacting responsive records. G. L. c. 66, § 10(c); G. L. c. 66, § 10(d)(iv); see also 950 C.M.R. 32.06(4). As required by law, it is my understanding that the Commission furnished a copy of the petition to the requestor, Ricky Stebbins. G. L. c. 66, § 10(c); G. L. c. 66, § 10(d)(iv)(2). On December 27, 2025, Mr. Stebbins requested the following: [1] All PROSPER access logs from . . . January 1, 2025 through December 31, 2025 . . . , in CSV or XLSX format. . . . Required data fields . . .: [a] Timestamp. . .[;] [b] Username[;] [c] User role or privilege level[;] [d] Organization or vendor affiliation[;] [e] Event type . . .[;] [f] Device ID or IP address[;] [g] Session ID or duration[;] . . . [2] . . . [A]ny communications showing how BlackRock became aware of [an identified] July 7, 1:10 AM FOIA request . . .: [a] Any emails, phone logs, or meeting records between PERAC staff and BlackRock on July 7, 2025[;] [b] Any internal PERAC emails or messages discussing [an identified] FOIA request and whether to notify vendors[;] [c] Any written PERAC policy governing vendor notification during public records reviews[;] [d] Any calendar entries, visitor logs, or meeting documentation showing One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Felicia Baruffi, Esq. SPR26/0054 Page 2 January 14, 2026 [an identified individual] at PERAC offices (July 2024-December 2025)[;] [3] . . . Access Activity During [an identified individual’s] Sessions. . . . Please provide: [a] Action-level logs showing which PROSPER files, modules, or data were viewed, downloaded, modified, or deleted during the 34 . . . sessions[;] [b] Whether any Schedule 7 disclosures, fee reports, or performance data were accessed[;] [c] Whether any records responsive to [an identified] FOIA request were accessed[;] [d] Session duration and specific activity timestamps for each login[;] If action-level logs do not exist, please provide: . . . [e] How PERAC ensures compliance with 201 CMR 17.00 audit trail requirements. . . .[;] [f] Whether PERAC can verify that no records were modified or deleted during vendor access[;] [4] . . . Employment History and Access Pattern . . . Please provide: [a] Documentation explaining why PROSPER access was not needed during [an identified individual’s] first three years of employment[;] [b] Whether [an identified individual’s] role, title, or responsibilities changed in July 2025[;] [c] Whether another BlackRock employee previously handled PROSPER access for Massachusetts pension accounts[;] [d] Business justification for requesting credentials on July 7, 2025. . .[;] [5] . . . Credential Request for Multiple Accounts. . . Please clarify: [a] Business purpose stated or implied in BlackRock’s July 7 credential request[;] [b] Whether [three identified individuals] . . . were expected to perform different tasks or the same review[;] [c] Why [an identified individual] never logged in despite credential approval[;] [d] Why [an identified individual] logged in only once[;] [6] . . . Account Activity Cessation . . . Please provide: [a] Documentation of what task was completed on or around August 19 that no longer required access[;] [b] Whether [an identified individual’s] account was deactivated or whether the user simply stopped accessing[;] [c] Whether [an identified individual’s] role, access privileges, or responsibilities changed after August 19[;] [d] Whether the timing of cessation coincided with any PERAC decisions or actions regarding [an identified] FOIA request[;] [7] . . . Identity Verification Documentation . . . Please provide: [a] Employment verification or documentation submitted when BlackRock requested credentials[;]

Felicia Baruffi, Esq. SPR26/0054 Page 3 January 14, 2026 [b] Any organizational chart or directory listing showing [an identified individual’s] role with respect to Massachusetts pension systems[;] [c] Any correspondence from . . . or about [an identified individual] beyond the July 7-8 credential exchange[;] [8] . . . Test Account – “zzTest PERAC Vendor money manager1” . . . Please provide: [a] Account creation date, creator identity, and authorization documentation[;] [b] Business purpose for maintaining test or generic accounts in production oversight systems[;] [c] Whether this account was used for system testing, vendor training, data review, or other purposes[;] [d] Whether the September 5 login can be attributed to a specific individual or organization[;] [e] Whether this is a shared account accessible by multiple users[;] [f] How PERAC tracks accountability for actions taken under non- attributable accounts[;] [g] How generic account use complies with 201 CMR 17.00 access control and audit trail requirements[;] [h] Why this account appeared for the first time in 2025[;] [i] Any relationship between [an identified individual’s] account cessation (August 19) and zzTest account appearance (September 5)[;] . . . [9] . . . For all private equity, private credit, real assets, and fund-of-funds investments reported to PERAC between **2018–2024**, provide the following data fields [as separate columns] in [Excel (.XLSX), CSV, or similar structured formats]: . . . [a] Fund name[;] [b] Vintage year[;] [c] Commitment amount[;] [d] Capital called[;] [e] Capital distributed[;] [f] Gross IRR (internal rate of return)[;] [g] Net IRR . . .[;] [h] Gross MOIC (multiple on invested capital) [i] Net MOIC . . .[;] [j] Management fees (annual and cumulative)[;] [k] Performance fees / carried interest[;] [l] Fee offsets or rebates[;] [m] Valuation methodology used[;] [n] Reporting entity . . .[;] . . . [10] Communications (internal PERAC or between PERAC and vendors) from **July 1, 2025 to present** containing any of [approximately ten identified] terms [and] . . . [five identified] Priority subject lines. . . .[;] . . . [11] . . . The name of the entity . . . responsible for hosting, maintaining, or compiling PROSPER access logs[;]

Felicia Baruffi, Esq. SPR26/0054 Page 4 January 14, 2026 [12] . . . Any contract, statement of work, or service agreement governing: [a] Log retention policies and timeframes[;] [b] Audit export procedures and formats[;] [c] Security and access control requirements[;] [d] Data ownership and custody arrangements[;] . . . [13] A copy of the specific request PERAC sent to this entity in response to [an identified] July 2025 FOIA request. . . .[;] [14] . . . Data Integrity Confirmation. . . Please provide: [a] Written confirmation of whether this vendor has deleted, archived, modified, or migrated any PROSPER access logs since January 1, 2020[;] [b] Documentation of any log retention schedule or data lifecycle policies[;] [c] Verification procedures PERAC uses to ensure completeness and integrity of vendor-provided access logs[;] . . . [15] . . . If any requested records no longer exist, please provide: . . . [a] Specific record category[;] [b] Date of deletion or destruction[;] [c] Records retention authority . . .[;] [d] Name and title of person who authorized destruction[.] Petition for an Extension of Time Under the Public Records Law, upon a showing of good cause, the Supervisor of Records (Supervisor) may grant a single extension to an agency not to exceed 20 business days and a single extension to a municipality not to exceed 30 business days. In determining whether there has been a showing of good cause, the Supervisor shall consider, but shall not be limited to considering: (i) the need to search for, collect, segregate or examine records; (ii) the scope of redaction required to prevent unlawful disclosure; (iii) the capacity or the normal business hours of operation of the agency or municipality to produce the request without the extension; (iv) efforts undertaken by the agency or municipality in fulfilling the current request and previous requests; (v) whether the request, either individually or as part of a series of requests from the same requestor, is frivolous or intended to harass or intimidate the agency or municipality; and (vi) the public interest served by expeditious disclosure. G. L. c. 66, § 10(c). If the Supervisor determines that the request is part of a series of contemporaneous requests that are frivolous or designed to intimidate or harass, and the requests are not intended for the broad dissemination of information to the public about actual or alleged government activity, the Supervisor may grant a longer extension or relieve the agency or municipality of its obligation to provide copies of the records sought. Id.

Felicia Baruffi, Esq. SPR26/0054 Page 5 January 14, 2026 The filing of a petition does not affect the requirement that a Records Access Officer (RAO) must provide an initial response to a requestor within ten business days after receipt of a request for public records. 950 C.M.R. 36.06(4)(b). Request for Additional Time to Produce Responsive Records In its petition, the Commission requests an extension of 20 business days to produce the responsive records and provides the following information in support of its request: As of today’s date, PERAC has spent four hours of staff time conducting preliminary searches for responsive records. Our IT unit has indicated that it will take 30 hours to generate and redact the PROSPER access logs requested in Item 1 due to the over one million events that occurred during [the specified] time range. . . . Our compliance and investment team has estimated that there are approximately 287 reports and related documents responsive to Item 2 of [the] request, each between 2 and 20 pages. . . . Accordingly, we will require 140 total hours of staff time to locate and compile all reports and data responsive to Item 2. . . . Our preliminary search for communications responsive to Item 3 of your request has returned more than 9,670 potentially responsive email communications and attachments. . . . In light of the need to collect, segregate and examine the records, as well as the capacity of the Commission to produce the records without an extension, the Commission has established good cause to permit an extension of time. G. L. c. 66, § 10(c)(i)-(iii). The Commission is granted an extension of 20 business days. Petition to Assess Fees – Agencies A fee shall not assessed for time spent segregating or redacting records unless such segregation or redaction is required by law or approved by the Supervisor of Records (Supervisor) under a petition. G. L. c. 66, § 10(d)(iv). See G. L. c. 66, § 10(d)(iii); 950 C.M.R. 32.06(4). In rendering such a decision, the Supervisor is required to consider the following: a) the public interest served by limiting the cost of public access to the records; b) the financial ability of the requestor to pay the additional or increased fees; and c) any other relevant extenuating circumstances. G. L. c. 66, § 10(d)(iv). The statute sets out a two-prong test for determining whether the Supervisor may approve an agency’s petition to allow the agency to charge for time spent segregating or redacting records. The first prong is whether the request for records was made for a commercial purpose.

Felicia Baruffi, Esq. SPR26/0054 Page 6 January 14, 2026 G. L. c. 66, § 10(d)(iv). It is my determination that this request was not made for a commercial purpose. The second prong of the test is whether the fee represents an actual and good faith representation by the agency to comply with the request. The Supervisor must consider 1) if the fee is necessary such that the request could not have been prudently completed without the redaction or segregation; 2) the amount of the fee is reasonable; and 3) the fee is not designed to limit, deter or prevent access to requested public records. Id. Petitions seeking a waiver of statutory limits to fees assessed to segregate and/or redact public records must be made within ten business days after receipt of a request for public records. 950 C.M.R. 32.06(4)(g). Fee Estimates – Agencies An agency may assess a reasonable fee for the production of a public record except those records that are freely available for public inspection. G. L. c. 66, § 10(d). The fees must reflect the actual cost of complying with a particular request. Id. A maximum fee of five cents ($.05) per page may be assessed for a black and white single or double-sided photocopy of a public record. G. L. c. 66, § 10(d)(i). Agencies may not assess a fee for the first four (4) hours of employee time to search for, compile, segregate, redact or reproduce the record or records requested. G. L. c. 66, § 10(d)(ii). Where appropriate, agencies may include as part of the fee an hourly rate equal to or less than the hourly rate attributed to the lowest paid employee who has the necessary skill required to search for, compile, segregate, redact or reproduce a record requested, but the fee shall not be more than $25 per hour. Id. Current Petition In its petition, the Commission requests permission to assess a rate of $25.00 per hour for segregation and redaction of the responsive records under Exemptions (c), (n), (o), and (t), and provides the following in support of its request: . . . [L]ogs [responsive to Item 1 of the request] will contain IP addresses, login credentials, and other sensitive information, the disclosure of which may compromise the cybersecurity of PERAC’s systems, as well as the systems of retirement boards and vendors. This information will be redacted pursuant to Exemption (n). . . .[C]ommunications [responsive to Item 3 of the request] are likely to contain personal and financial information (e.g., social security numbers, personnel records, and medical and disability information) exempt from disclosure under Exemption (c), as well as the home addresses and personal contact information of public employees, exempt from disclosure under Exemption (o). The emails may

Felicia Baruffi, Esq. SPR26/0054 Page 7 January 14, 2026 also contain statements filed under Section 20C of Chapter 32, which are exempt from disclosure under Exemption (t). In light of the Commission’s petition, I find the Commission has met its burden to explain how, given the nature of the responsive records, the request could not prudently be completed without redaction or segregation. See G. L. c. 66, § 10(d)(iv). To the extent the responsive records contain the exempt information as described above, the Commission may assess a fee for the segregation and redaction of such exempt material. See G. L. c. 66, § 10(d)(iv). Conclusion As described above, I find the Commission has established good cause for a time extension of 20 business days. Additionally, to the extent the responsive records contain the exempt information discussed above, the Commission may assess a fee for segregation and redaction. Further, I encourage the parties to communicate to enable the Commission to provide records in an efficient and affordable manner. Please note, Mr. Stebbins has the right to seek judicial review of this decision by commencing a civil action in the appropriate superior court. See G. L. c. 66, §§ 10(c), 10(d)(iv)(4), 10A(c). Sincerely, Manza Arthur Supervisor of Records cc: Ricky Stebbins