Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I collect cookie information from participants in Massachusetts? What are the requirements?

Based on the provided context documents, collecting cookie information from participants in Massachusetts is subject to certain requirements.

Requirements for Collecting Personal Data

Under Massachusetts law, the collection, maintenance, and dissemination of personal data are subject to regulations [4.1]. However, these regulations do not apply to criminal offender record information, intelligence or evaluative information, or any information contained in a public record [4.1].

CORI Policy Requirement

If a person or entity conducts five or more criminal background investigations annually, whether the information is obtained from DCJIS or another source, they must maintain a written CORI policy that applies all provisions from the DCJIS Model CORI Policy [2.2].

Need to Know Requirements

Each requestor must maintain a “need to know” list of staff that have been authorized to request, receive, or review CORI. This list must be updated periodically, but not less than every six months, and must be made available to DCJIS upon request [2.2].

The context documents do not provide specific information on the collection of cookie information. However, it is important to note that any personal data collected, including cookie information, must be subject to the regulations outlined in Massachusetts law [4.1].

Therefore, it is recommended that any entity or person collecting cookie information from participants in Massachusetts should maintain a written policy that outlines the collection, maintenance, and dissemination of personal data, including cookie information. Additionally, they should maintain a “need to know” list of staff authorized to access this information.

It is also important to note that if the entity or person conducts five or more criminal background investigations annually, they must maintain a written CORI policy that applies all provisions from the DCJIS Model CORI Policy and maintain a “need to know” list of staff authorized to access this information.

[2.1] provides the requirements for requestors to request CORI, which includes verifying the identity of each subject and maintaining a signed CORI Acknowledgment Form for each subject.

[5.1] outlines the requirements for making voting information available to citizens and publishing a fair, concise summary of the host community agreement in a periodical of general circulation and on the official website of the municipality.

In summary, while the context documents do not provide specific requirements for collecting cookie information, any personal data collected, including cookie information, must be subject to the regulations outlined in Massachusetts law. Therefore, it is recommended that any entity or person collecting cookie information from participants in Massachusetts should maintain a written policy that outlines the collection, maintenance, and dissemination of personal data, including cookie information. Additionally, they should maintain a “need to know” list of staff authorized to access this information.

Source(s):
Jurisdiction

Massachusetts