D'Ambrosio, Patricia v. CREST Collaborative (SPR 20261363)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records April 21, 2026 SPR26/1363 Robert Jokela Executive Director Records Access Officer CREST Collaborative 20 Shattuck Road Andover, MA 01810 Dear Executive Director Jokela: I have received the petition of Patricia D’Ambrosio appealing the nonresponse of the CREST Collaborative (CREST) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On March 26, 2026, Ms. D’Ambrosio requested records for “Squarespace, Jotform and any other hosting, data storage, etc software platform etc.[.]” Specifically, Ms. D’Ambrosio requested the following records: [1] All formal agreement/s: data sharing/service provider agreements that specify FERPA obligations were/not met during the period of time my child’s student records were uploaded without my knowledge or consent[;] [2] All documentation specifying: any and all configurations under Jotform Enterprise, Jotform, Squarespace, etc. with appropriate protections[;] [3] Confirmation that the platforms meet FERPA requirements in their entirety: role‑based access control, audit logging, data handling policies, etc. And that Crest, as advised by Jotform, met with it’s attorney to secure these requirements[;] [4] Exact server locations: where the uploaded data is stored via Jotform and/or Crest Collaborative[;] [5] All plan agreements and contracts between: Crest Collaborative and Jotform, Squarespace, Jotform Enterprise, etc.[;] Andover Public Schools and Jotform, Squarespace, Jotform Enterprise, etc.[;] Crest Collaborative and Andover Public Schools[;] Crest Collaborative and Andover Public Schools and[;] Jotform, Squarespace, Jotform Enterprise, etc.[;] [6] Any and all steps and procedures Crest Collaborative has taken to protect my child’s student records: with evidentiary documentation of same[;] One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Robert Jokela SPR26/1363 Page 2 April 21, 2026 [7] The timeline for storing and using my child’s student records: pursuant to the purpose, as evidentiary documented by Crest, for same student records[;] [8] The evidentiary legal and procedural timelines governing the evaluation of my child: including key date/s of initiation, dates and specifics of requests by Crest and/or [an identified individual], date/s of completion, and any required retention periods for my child’s student records[;] [9] Evidentiary documentation demonstrating the timely destruction my child’s student records: by both Crest Collaborative and Jotform, Squarespace, and any additional third-party software systems or service providers involved in storing or processing my child’s student records[;] [10] The current Crest Collaborative Board policy and administrative regulations on student records and privacy: including, but not limited to, FERPA regulations[;] [11] Any and all security policies: governing student data privacy such as NDPA, student records security, and how electronic student records are secured along with access policies and safeguards[;] [12] Any and all policies and guidelines covering email and electronic communications: including, but not limited to encryption standards, that include retention, destruction, and monitoring[;] [13] Any and all vendor data privacy agreements: for example, but not limited to: NDPA/SPDC[;] [14] All evidentiary documentation, policies, etc. covering the steps Crest Collaborative took/will take to address any and all errors in my student’s information: as uploaded to Jotform and shared within Crest Collaborative[;] [15] Any and all communications between Andover Public Schools, [two identified individuals] and/or Crest Collaborative and its employees acting as an employee of Crest Collaborative or independently: that contain, reference, cite.... any of my child’s student recortds [sic] and/or covered student information under FERPA[;] [16] All evidentiary documentation demonstrating that Crest Collaborative and any/all of its employees are under the direct control, contractually or otherwise of Andover Public Schools and/or any of its emplyees [sic][.] Claiming to not yet have received responsive records, Ms. D’Ambrosio petitioned this office and this appeal, SPR26/1363, was opened as a result. Despite being notified of the opening of this appeal, it remains unclear whether CREST has provided a response. Accordingly, CREST is ordered to provide Ms. D’Ambrosio with a response to her request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Ms. D’Ambrosio may appeal the substantive nature of the CREST’s response within ninety (90) days. See 950 C.M.R. 32.08(1).

Robert Jokela SPR26/1363 Page 3 April 21, 2026 Sincerely, Manza Arthur Supervisor of Records cc: Patricia D’Ambrosio