Can I skip obtaining consent to disclose personal information for a business purpose in Massachusetts? What are the requirements?

Based on the context documents, you cannot skip obtaining consent to disclose personal information for a business purpose in Massachusetts. The requirements for obtaining informed consent are outlined in 760 CMR 8.02, which states that consent will be deemed “informed consent” only if the holder provides to the data subject a written statement containing the following information and the data subject indicates his/her written understanding and agreement:

• an explanation of how the requested data will be used and held;
• the identity of persons, entities or agencies who will receive or hold the data, and an assurance that all holders will keep the data confidential;
• an offer to answer any inquiries concerning the data, indicating the data subject’s right to object in accordance with 760 CMR 8.05; and,
• any legal requirements to provide the requested data and any legal or administrative consequences arising from a decision to withhold the data.

Additionally, 107 CMR 2.04 requires written consent from individuals before collecting personal information for vocational rehabilitation services. The written consent must include information about the Commission’s need to collect personal information, the policies governing its use, the identification of the authority under which the information is collected, an explanation of the purposes for which the Commission intends to use or release the information, and a list of those persons or organizations from whom the Commission may seek personal information. The written consent must be reviewed annually.

Furthermore, 211 CMR 36.04 requires prior written informed consent before conducting an HIV test. The informed consent must include an understanding by the individual to be tested that the test is being performed, the nature of the test, the persons or entities which will or may have access to the test results or to which the results of that test may be disclosed, the purpose for which the test results may be used, and any reasonably foreseeable risks and benefits resulting from the test. The informed consent must also include specific disclosures, such as notification of the purpose(s) of the HIV test(s), information concerning the effect(s) of the test result(s) on the approval of the application, or the risk classification of the individual, and a complete description of the persons or entities which may reasonably be expected to have access to the test results or any other HIV-related information about the individual.

Finally, 840 CMR 6.03 prohibits retirement boards from disclosing any personal information contained in a personnel or medical file which may be identified or associated with the data subject without the written consent of the data subject or his or her authorized representative.

Therefore, it is necessary to obtain informed consent before disclosing personal information for a business purpose in Massachusetts.

Jurisdiction

Massachusetts

• Privacy