Massachusetts 2025-2026 Regular Session

Massachusetts House Bill H2687 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	1 of 1
2	2	HOUSE DOCKET, NO. 4038 FILED ON: 1/17/2025
3	3	HOUSE . . . . . . . . . . . . . . . No. 2687
4	4	The Commonwealth of Massachusetts
5	5	_________________
6	6	PRESENTED BY:
7	7	David M. Rogers
8	8	_________________
9	9	To the Honorable Senate and House of Representatives of the Commonwealth of Massachusetts in General
10	10	Court assembled:
11	11	The undersigned legislators and/or citizens respectfully petition for the adoption of the accompanying bill:
12	12	An Act relative to protecting Massachusetts residents against federal government surveillance.
13	13	_______________
14	14	PETITION OF:
15	15	NAME:DISTRICT/ADDRESS :DATE ADDED:David M. Rogers24th Middlesex1/17/2025Patrick Joseph Kearney4th Plymouth1/17/2025 1 of 7
16	16	HOUSE DOCKET, NO. 4038 FILED ON: 1/17/2025
17	17	HOUSE . . . . . . . . . . . . . . . No. 2687
18	18	By Representative Rogers of Cambridge, a petition (accompanied by bill, House, No. 2687) of
19	19	David M. Rogers and Patrick Joseph Kearney relative to personal data access by criminal justice
20	20	agencies. Public Safety and Homeland Security.
21	21	The Commonwealth of Massachusetts
22	22	_______________
23	23	In the One Hundred and Ninety-Fourth General Court
24	24	(2025-2026)
25	25	_______________
26	26	An Act relative to protecting Massachusetts residents against federal government surveillance.
27	27	Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority
28	28	of the same, as follows:
29	29	1 SECTION 1. Section 1 of chapter 66A of the General Laws, as appearing in the 2020
30	30	2Official Edition, is hereby amended by inserting after the definition of “Automated personal data
31	31	3system,” the following definition:-
32	32	4 “Commonwealth fusion center”, an entity established in executive order no. 476 within
33	33	5the criminal information section of the department of state police, established in section 38 of
34	34	6chapter 22C, and under the direction of the executive office of public safety and security, or any
35	35	7successor entity.
36	36	8 SECTION 2. Said section 1 of said chapter 66A, as so appearing, is hereby further
37	37	9amended by inserting after the definition of “Criminal intelligence agency,” the following 2
38	38	10definitions:-
39	39	11 “Criminal intelligence information”, data collected on an individual or organization that
40	40	12is reasonably suspected of involvement in criminal activity for the purpose of their identification 2 of 7
41	41	13or for acquiring evidence of their criminal activity. Reasonable suspicion is established when
42	42	14information exists that establishes sufficient facts to give a trained law enforcement or criminal
43	43	15justice agency officer, investigator or employee a basis to believe that there is a reasonable
44	44	16possibility that an individual or organization is involved in a definable criminal activity or
45	45	17enterprise.
46	46	18 “Criminal intelligence system”, the arrangements, equipment, facilities and procedures
47	47	19used for the receipt, storage, interagency exchange or dissemination, and analysis of criminal
48	48	20intelligence information, including the commonwealth fusion center, the Boston Regional
49	49	21Intelligence Center, any successor entities and any other entities in the commonwealth bound by
50	50	22the provisions of 28 CFR Part 23.
51	51	23 SECTION 3. Said section 1 of said chapter 66A, as so appearing, is hereby further
52	52	24amended by striking out the definition of “Personal data,” and inserting in place thereof the
53	53	25following definition:-
54	54	26 “Personal data”, any information concerning an individual that, because of a name,
55	55	27identifying number, mark or description, can be readily associated with a particular individual;
56	56	28provided however, that personal data shall not include information that would reasonably be
57	57	29expected to: (i) interfere with an ongoing criminal investigation or other law enforcement
58	58	30proceeding; (ii) constitute a clearly unwarranted invasion of personal privacy; (iii) disclose the
59	59	31identity of a confidential source; or (iv) endanger the life or physical safety of any individual.
60	60	32 SECTION 4. Said section 1 of said chapter 66A, as so appearing, is hereby further
61	61	33amended by adding the following definition:- 3 of 7
62	62	34 “Protected information”, information about the political, religious or social views,
63	63	35associations or activities of any individual, group, association, organization, corporation,
64	64	36business or partnership or other entity.
65	65	37 SECTION 5. Said chapter 66A is hereby further amended by inserting after section 2 the
66	66	38following 6 sections:-
67	67	39 Section 2A. At least once annually, every criminal intelligence system shall conduct an
68	68	40internal audit and publish a report based on the results. This audit shall include:
69	69	41 (i) for each database that contains personal data: (1) the number of authorized users; (2)
70	70	42each user’s level of access; (3) the quantity of data accessed by each user on a weekly basis; (4)
71	71	43the number of transactions performed of each specified transaction type for each unique user and
72	72	44access location; (5) the quantity of data collected and maintained from each unique source; and
73	73	45(6) the frequency of use in an investigation of data from each source;
74	74	46 (ii) the numbers of investigations authorized and denied under paragraph (4) of
75	75	47subsection (b) of section 2C, and the dates of initiation and closure for each of these
76	76	48investigations;
77	77	49 (iii) the number of investigations authorized under said paragraph (4) of said subsection
78	78	50(b) that remain open, the date of initiation of the investigation for each open investigation, the
79	79	51length of time the investigation has remained open and a justification for continued collection or
80	80	52maintenance of protected information; 4 of 7
81	81	53 (iv) the number of investigations authorized under said paragraph (4) of said subsection
82	82	54(b) that have led to indictments or prosecutions, and the names and docket numbers of resulting
83	83	55court proceedings; and
84	84	56 (v) the number of authorized disseminations under paragraph (3) of said subsection (b),
85	85	57and to which entity each dissemination was made.
86	86	58 Section 2B. Every criminal intelligence system shall provide assistance and unrestricted
87	87	59access to the office of the inspector general, who shall submit to the clerks of the house of
88	88	60representatives and the senate, the house and senate committees on post audit and oversight, and
89	89	61the joint committee on public safety and homeland security a report every 2 years on the
90	90	62compliance of criminal intelligence systems with section 2C. The report shall include
91	91	63recommendations for corrective action and shall be a public record.
92	92	64 Section 2C. (a) No state or local law enforcement agency, as defined in section 1 of
93	93	65chapter 6E, prosecutorial office, criminal intelligence system, as defined in section 1, police or
94	94	66peace officer or agent thereof shall track, collect, maintain or disseminate protected information,
95	95	67unless such information directly relates to an investigation of criminal activities, and there are
96	96	68reasonable grounds to suspect the subject of the information is involved in criminal conduct.
97	97	69 (b) (1) No protected information obtained in violation of any applicable federal, state or
98	98	70local law, ordinance or regulation shall be knowingly accessed, received, maintained or
99	99	71disseminated.
100	100	72 (2) All protected information shall be evaluated for the reliability of its source and the
101	101	73accuracy of its content prior to being included in any investigation file, whether temporary,
102	102	74interim or permanent in nature. 5 of 7
103	103	75 (3) Protected information shall be disseminated only to law enforcement agencies,
104	104	76contingent upon review and prior written authorization by the head of the originating law
105	105	77enforcement agency or criminal intelligence system. The originating law enforcement agency
106	106	78shall maintain a record of any such written authorization, specifying the reasons the
107	107	79dissemination is necessary, for a minimum of 5 years. The originating entity shall record each
108	108	80instance of dissemination in a log containing: (i) the method of dissemination; (ii) the name of
109	109	81the subject; (iii) the name of the entity with whom the information was shared; and (iv) the date
110	110	82of dissemination.
111	111	83 (4) All investigations undertaken on the basis of any protected information shall first be
112	112	84authorized in writing by the head of the investigating law enforcement agency or criminal
113	113	85intelligence system. A record of any such written authorization, specifying the reasons for such
114	114	86investigation, shall be maintained in the corresponding investigation file for a minimum of 5
115	115	87years.
116	116	88 (5) A law enforcement agency or criminal intelligence system shall review all
117	117	89information included in its investigation files at least once every 5 years, and shall destroy any
118	118	90information that is not reliable, accurate, relevant and timely; provided, that any documents
119	119	91related to the authorization for and termination of investigations based in whole or in part on
120	120	92protected information collected under this section, and any authorization to disseminate such
121	121	93protected information, shall be retained. Information retained in an investigation file after a
122	122	94review shall be accompanied by the following documentation: the name of the reviewer, the date
123	123	95of review and an explanation of the decision to retain the information. 6 of 7
124	124	96 (6) Any violation of this section constitutes an injury and any person may institute
125	125	97proceedings for injunctive relief, declaratory relief or writ of mandamus in the superior court. An
126	126	98action instituted under this paragraph may be brought against any agency with possession,
127	127	99custody or control of personal data, and any person whose data is included in the violation may
128	128	100institute proceedings and shall be entitled to recover actual damages not exceeding $2,000 or
129	129	101$200 per day for each day of violation, whichever is greater. A court shall award costs and
130	130	102reasonable attorneys’ fees to the plaintiff who is the prevailing party in an action brought under
131	131	103this paragraph. Violations of this section by a government employee shall result in consequences
132	132	104that may include retraining, suspension or termination, in accordance with any memorandums of
133	133	105understanding with employee bargaining units.
134	134	106 Section 2D. The executive office of public safety and security shall engage an
135	135	107independent auditor to select and audit a random sample of the suspicious activity reports held
136	136	108by the Boston Regional Intelligence Center, the commonwealth fusion center and the New
137	137	109England State Police Information Network, relating to current or former residents of the
138	138	110commonwealth. If the auditor finds any of these suspicious activity reports to lack indicia of
139	139	111reasonable suspicion of a crime as outlined in 28 CFR part 23.20, the department of state police
140	140	112shall suspend cooperation with the entity that produced the report until such time as all records
141	141	113held by these agencies pertaining to Massachusetts residents have been reviewed for compliance
142	142	114with 28 CFR part 23.20, and such records purged from these agencies’ systems if noncompliant.
143	143	115 Section 2E. (a) The commonwealth fusion center shall publish the names of the members
144	144	116of its privacy oversight committee. The meetings of the privacy oversight committee shall take
145	145	117place at least quarterly, and shall be open to the public. 7 of 7
146	146	118 (b) For entities retaining criminal intelligence information, training manuals related to the
147	147	119handling of personal data shall be available to the public.
148	148	120 Section 2F. Personal data held in a criminal intelligence system shall not be exempt from
149	149	121disclosure to the individual concerned, or to their attorney or their heirs, by reason of being held
150	150	122in a criminal intelligence system; provided, that disclosure is otherwise proper.
151	151	123 Section 2G. After notice and opportunity for a hearing, the office of the inspector general
152	152	124may impose a monetary penalty on any person or group found to be in violation of any of the
153	153	125provisions of sections two A to two F, inclusive, or of any rules or regulations promulgated
154	154	126thereunder. The monetary penalty shall not exceed five hundred dollars for each act or violation.
155	155	127The amount of any such monetary penalty shall be paid to the inspector general for general use.
156	156	128 SECTION 6. After notice and opportunity for a hearing, the office of the inspector
157	157	129general may impose a monetary penalty on any person or group found to be in violation of any of
158	158	130the provisions of SECTION 5, inclusive, or of any rules or regulations promulgated thereunder.
159	159	131The monetary penalty shall not exceed five hundred dollars for each act or violation. The amount
160	160	132of any such monetary penalty shall be paid into the general fund.