Bill > H1336

This bill aims to enhance privacy and data protection for criminal intelligence information collected and maintained by systems operating in Massachusetts, including the Commonwealth Fusion Center and the Boston Regional Intelligence Center. It mandates that these systems keep records of data sources and the quantity of information received from each, and only retain personal data if there is a reasonable suspicion of criminal involvement and the information is relevant to that activity. Dissemination of such data is restricted to those with a demonstrated need and right to know for law enforcement purposes, and requires recipient agencies to adhere to similar data handling procedures. The bill also requires agencies to notify others before entering into formal information exchange arrangements with federal or other state systems, and to implement robust security measures to protect personal information, including labeling data by sensitivity and confidence levels, and maintaining written security programs that address administrative, technical, and physical safeguards. Furthermore, it mandates annual internal audits of these systems, with the results made public, to track user access, data transactions, sources of information, and the outcomes of investigations involving protected information. The Inspector General will also receive assistance and unrestricted access to prepare an annual report on compliance, which will be subject to public hearings. Finally, the bill clarifies definitions related to criminal intelligence systems and personal data, and establishes stricter guidelines for the collection, maintenance, and dissemination of "protected information," which includes data about individuals' political, religious, or social views, associations, or activities, unless directly related to a criminal investigation with reasonable grounds for suspicion.