Law / United States / 
Massachusetts
Board of Higher Education privacy, confidentiality and data security regulation: personal data held by the Board and by public institutions of higher education
In force.
A sensitive categories rule binding government bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Governance, Consent, Data subject rights, Security, Disclosure
What it requires
- If you are the Board of Higher Education or a public institution of higher education, collect, maintain and disseminate only the personal data that is essential to a function authorized by law (610 CMR 10.03(1)(a)).
- Do not use personal data collected for one purpose for another unrelated purpose without the data subject's informed consent, which requires explaining how the data will be used and held, who is likely to receive or hold it, and any legal requirement to provide it (610 CMR 10.03(2)(b) and 10.04(3) and (4)).
- Let only employees whose duties require it have access to personal data, and do not let anyone you do not employ have access unless a statute or regulation authorizes it or you and the data subject approve it (610 CMR 10.03(2)(c) and (m)).
- Keep an audit trail that records who collects, examines or uses personal data and for what purpose, and limit access to the trail to the data subject, authorized personnel and the Commissioner (610 CMR 10.03(2)(g)).
- Protect personal data with passwords, keys, badges, access logs or other methods reasonably expected to prevent loss or removal, and keep duplicate files to a minimum (610 CMR 10.03(2)(d) and (e)).
- Put a provision requiring compliance with 610 CMR 10.00 in every agreement affecting the collection, maintenance or dissemination of personal data that you make with a person or entity not otherwise subject to the regulation (610 CMR 10.03(1)(e)).
- File a report with the Commissioner on each personal data system every year and whenever a system is established, ended or changed in character, and review each system at least once every 24 months under a written plan (610 CMR 10.03(2)(f) and (h)).
- Before you computerize or automate a personal data system or develop a new one, write a master plan that identifies the foreseeable threats to the security of the data and the safeguards you will use against them (610 CMR 10.03(2)(l)).
- When a subpoena or other order directs you to disseminate a data subject's personal data, tell the data subject at once unless the law or a court order forbids it, and where legally and practically possible allow time to seek to quash the order (610 CMR 10.03(2)(n)).
- Designate one officer responsible for each personal data system, who receives complaints and objections and ensures that data subjects have their rights (610 CMR 10.04(1) and (2)).
- On request, tell a data subject in writing whether you hold or have held personal data about him or her in the previous 24 months, and let the data subject inspect and copy it unless the law or a court order prohibits it (610 CMR 10.04(5) and (8)).
- Within 30 days of a data subject's written objection, investigate it, correct the data if the objection has merit or record the data subject's statement if it does not, and tell the data subject the outcome in writing (610 CMR 10.04(12) and (13)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
The Commissioner of Higher Education, who monitors compliance in cooperation with the Office of the Attorney General pursuant to chapter 214, section 3B of the General Laws
What record it asks for
What the log must hold
Actor identity, Access record
Logging duty
Each holder keeps records of all persons who collect, examine or use personal data and the purposes of that use; the audit trail is part of the data held and is open only to the data subject, authorized personnel and the Commissioner.
- Kind
- Explicit
- As of
- Provision
- 610 CMR 10.03(2)(g)
- Trigger
- personal_data_processing
What this law does
610 CMR 10.00, the Board of Higher Education's privacy, confidentiality and data security regulation, applies to the Board of Higher Education and all public institutions of higher education. It governs the collection, maintenance, security and dissemination of personal data held in manual or computerized personal data systems, and educational data collected by the Board.
A holder may not collect, maintain or disseminate personal data other than data essential for the performance of functions authorized by law. A holder may not use personal data collected for one purpose for another unrelated purpose without the data subject's informed consent. A holder may not let a person it does not employ have access to personal data unless a statute or regulation authorizes the access or the holder and the data subject approve it.
Each holder must keep records of access to and use of the personal data it holds. A data subject is entitled on request to access any personal data concerning him or her, except where law or a judicial order prohibits it. The regulation continues in force unless the boards of trustees of the public institutions have adopted their own privacy, confidentiality and data security regulations. The Commissioner of Higher Education monitors compliance in cooperation with the Attorney General.
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .