§ 109 — Collection of personal identifying information by government agencies

[ Text of section added by 2023, 28, Sec. 7 effective January 1, 2026. See 2023, 28, Sec. 104.]Section 109. (a) For the purposes of this section, the following words shall, unless the context clearly requires otherwise, have the following meanings:"Government agency'', a legal entity of state government established by the general court or by executive order as an agency, board, bureau, commission, council, department, office or division within the executive branch of the commonwealth with a specific mission and which is subject to the control of the governor or a quasi-public entity."Personal identifying information'', information: (i) that directly identifies an individual, including name, address, social security number or other identifying number or code; (ii) by which an agency intends to identify specific individuals in conjunction with other data elements, which shall include indirect identification that may compile an identity, such as a combination of gender, race, birth date, geographic indicator and other descriptors; or (iii) that permits the physical or online contacting of a specific individual.(b) Every government agency that collects demographic data as to the race or ethnicity of residents of the commonwealth shall use separate collection and tabulations for the following:(i) each major Asian group, as reported by the United States Census Bureau, including, but not limited to, Chinese, Japanese, Filipino, Korean, Vietnamese, Asian Indian, Laotian, Cambodian, Bangladeshi, Hmong, Indonesian, Malaysian, Pakistani, Sri Lankan, Taiwanese, Nepalese, Burmese, Tibetan and Thai;(ii) each major Pacific Islander group, as reported by the United States Census Bureau, including, but not limited to, Native Hawaiian, Guamanian, Samoan, Fijian and Tongan;(iii) each other Asian or Pacific Islander group not listed in clause (i) or (ii);(iv) each major Black or African American group, as reported by the United States Census Bureau, including, but not limited to, African American, Jamaican, Haitian, Nigerian, Ethiopian, Cape Verdean and Somali;(v) each major Latino group, as reported by the United States Census Bureau, including, but not limited to, Mexican, Puerto Rican, Cuban, Salvadoran, Dominican and Colombian; and(c) Each government agency shall allow an individual to choose more than 1 group, write in their own group or choose the aggregate category. No government agency shall fill out racial or ethnic information unless directed by the individual or required by state or federal law to fill out such information on the individual's behalf.(d) Except for personal identifying information, which shall be deemed confidential, each government agency shall make the data available to the public in accordance with state and federal law. Data may be maintained in paper, electronic or other media form. To prevent identification of individuals, the data may be aggregated into categories at a state, county, city, census tract or zip code level to facilitate comparisons, to identify disparities and to be included in studies and reports. This subsection shall not be construed to prevent any other government agency from posting data collected on the agency's website in a manner prescribed in this section.(e)(1) The secretary of administration and finance shall establish regulations and guidelines on the collection of demographic data, which shall include, but not be limited to: (i) a standardized form for information collection; (ii) revising the categories of race and ethnicity to ensure continued alignment with the categories reported by the United States Census Bureau, as set forth in the federal Office of Management and Budget's statistical standards for collecting and reporting race and ethnicity data across federal agencies; (iii) expanding the categories to ensure that individuals are able to accurately express self identification; (iv) a standardized format for agencies to make data publicly available and to update said data on an annual basis; (v) a method to ensure that no personal identifying information is publicly released; (vi) a standardized written disclosure to the individual completing the form that information collection is voluntary; (vii) procedures to ensure that nonparticipation in information collection shall have no impact on an individual's eligibility for state services; (viii) an annual review of the cost impact and success of collecting information; and (ix) a process by which government agencies may apply to the secretary of administration and finance for a programmatic or partial waiver from the requirements of this section based upon: (A) contradictory obligations under state or federal law; (B) a demonstration that the information cannot be collected without imposing a burden that outweighs the benefits of collection; or (C) a demonstration that the information collected cannot be reported in a way that protects personal identifying information.(2) Annually, there shall be not less than 1 public hearing on the implementation of or changes in the regulations and guidelines established pursuant to paragraph (1).(3) Annually, not later than August 1, the secretary of administration and finance shall file a report on the progress of data collection to the clerks of the house of representatives and senate and the joint committee on state administration and regulatory oversight. Said report shall include a list of all waivers granted to government agency programs pursuant to paragraph (1) and the grounds upon which each waiver was granted.(f) All data collected by government agencies shall be subject to state and federal privacy laws, including, but not limited to, Title 13 of the United States Code and section 2 of chapter 93H.