803 CMR 2.00 — Criminal Offender Record Information (CORI)

cmr-803-2.00803 CMR 2.00Regulation

Open source

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES 803 CMR 2.00:CRIMINAL OFFENDER RECORD INFORMATION (CORI) Section 2.01: Purpose and Scope 2.02: Definitions 2.03: CORI Inclusions and Exclusions 2.04: iCORI Registration 2.05: Levels of Access to CORI 2.06: Access to an Individual's Own CORI 2.07: Attorneys 2.08: Legally Designated Representatives 2.09: Special Categories for CORI Access 2.10: Prohibition Against Requiring an Individual to Provide His or Her Own CORI 2.11: Requirements for Requestors to Request CORI 2.12: Electronic Submission of CORI Acknowledgment Forms 2.13: Identity Verification Exemption for Subsequent CORI Checks 2.14: Storage and Retention of CORI 2.15: Destruction of CORI and CORI Acknowledgment Forms 2.16: Required Dissemination of CORI 2.17: Permissive Dissemination of CORI 2.18: CORI Policy Requirement for Certain Requestors and the Need to Know Requirements 2.19: Requirement to Maintain a Secondary Dissemination Log 2.20: Adverse Employment Decision Based on CORI or Other Criminal History Information 2.21: Adverse Licensing Decision Based on CORI or Other Criminal History Information 2.22: Use of a Consumer Reporting Agency (CRA) 2.23: Audits by DCJIS 2.24: Confidentiality and Privacy of CORI 2.25: CORI Self-audit 2.26: Inaccurate CORI 2.27: CORI Complaints 2.28: The Criminal Record Review Board 2.29: Severability

803 CMR 2.00 Criminal Offender Record Information (CORI)

2.01 Purpose and Scope

2.01: Purpose and Scope (1) 803 CMR 2.00 sets forth the establishment and use of the iCORI system to access CORI. 803 CMR 2.00 further sets forth procedures for accessing CORI for the purpose of evaluating applicants for employment, volunteer opportunities, or professional licensing, as well as CORI complaint procedures. (2) 803 CMR 2.00 applies to all users of the iCORI system, including employers, governmental licensing authorities, and individuals seeking to obtain criminal history information. (3) Nothing contained in 803 CMR 2.00 shall be interpreted to limit the authority granted to the Criminal Record Review Board (CRRB) or to the Department of Criminal Justice Information Services (DCJIS) by the Massachusetts General Laws.

2.02 Definitions

2.02: Definitions All definitions set forth in 803 CMR 5.00: Criminal Offender Record Information (CORI) - Housing, 7.00: Criminal Justice Information System (CJIS), 8.00: Obtaining Criminal Offender Record Information (CORI) for Research Purposes, 9.00: Victim Notification Registry (VNR), 10.00: Gun Transaction Recording, and 11.00: Consumer Reporting Agency (CRA) are incorporated in 803 CMR 2.02 by reference. The following additional words and phrases as used in 803 CMR 2.00 shall have the following meanings: Adjudicated as an Adult . For purposes of CORI dissemination under 803 CMR 2.00, an offense is adjudicated as adult if the subject has been adjudicated as an adult in superior court or adjudicated as an adult after transfer of a case from a juvenile session to another trial court department. 6/11/21803 CMR - 5

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.02 continued

2.02: continued Apostille. A form of authentication applied by the Secretary of the Commonwealth to documents for use in countries that participate in the Hague Convention of 1961. Consumer Reporting Agency (CRA) . Any person or entity which, for monetary fees, dues, or on a cooperative, not-for-profit basis, regularly engages in whole or in part in the practice of assembling or evaluating criminal history, credit, or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports. Criminal History Information . As used in 803 CMR 2.00, criminal history information is any Massachusetts information identifying an individual in connection with any alleged criminal offense, regardless of whether that information is public or non-public and regardless of whether it is obtained from DCJIS or any other source. For example, an entry in a Massachusetts police department’s daily log is publicly available, but it is nevertheless criminal history information for purposes of 803 CMR 2.00 if it identifies an individual in connection with any alleged criminal offense. Criminal Justice Agency (CJA) . An agency in Massachusetts at any level of government which performs as its principal function activities relating to: (a) crime prevention, including research or the sponsorship of research; (b) the apprehension, prosecution, adjudication, incarceration, or rehabilitation of juvenile or criminal offenders; and/or (c) the collection, storage, dissemination, or usage of juvenile or criminal offender record information. Criminal Offender Record Information (CORI) . Is defined in 803 CMR 2.03. Criminal Record Review Board (CRRB). A statutorily-created board within DCJIS that reviews complaints and investigates allegations of violations of the laws and regulations governing CORI. Department of Criminal Justice Information Services (DCJIS) . The Commonwealth agency statutorily designated: (a)to provide for, manage, and exercise control over the installation, operation, and maintenance of a public safety information system and network including, but not limited to, a criminal justice information system; (b) to ensure the prompt collection, exchange, dissemination, and distribution of such public safety information as may be necessary for the efficient administration and operation of criminal justice agencies; (c) to connect such systems directly or indirectly with similar systems in this or other states; (d)to manage data processing to support data collection, information sharing, and interoperability for the Commonwealth’s criminal justice agencies; (e) to oversee the authorized provision of CORI to criminal justice agencies and other individuals or entities authorized by law to receive it; (f) to supervise all personnel associated with the public safety information system; (g) to provide support to the Criminal Record Review Board (CRRB); (h) to operate the Firearms Records Bureau (FRB); and (i) to operate and support the Victim Notification Registry (VNR). Disabled Person . As defined in M.G.L. c. 6, § 172C, a disabled person is an individual with an intellectual or developmental disability, as defined by M.G.L. c. 123B, § 1, or who is otherwise mentally or physically disabled and, as a result of such mental or physical disability, is wholly or partially dependent on others to meet daily living needs. Elderly Person . As defined in M.G.L. c. 6, § 172C, an elderly person is an individual who is 60 years of age or older. 6/11/21803 CMR - 6

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.02 continued

2.02: continued Employment Applicant. An individual who has applied for a job or position and who otherwise meets the requirements for the job or position for which he or she is being screened for criminal history by an employer or volunteer organization. An employment applicant, as referenced in 803 CMR 2.02, shall also include applicants for positions as volunteers, subcontractors, contractors, or vendors, as well as individuals applying for a special state, municipal, or county employee position as those terms are defined in M.G.L. c. 268A, § 1. Employee . Individuals currently employed by the requestor. As referenced in 803 CMR 2.02, employee also includes volunteers, subcontractors, contractors, vendors, and special state, municipal, or county employees as those terms are defined in M.G.L. c. 268A, § 1. Evaluative Information. Records, data, or reports regarding individuals charged with a crime and compiled by criminal justice agencies which appraise mental condition, physical condition, extent of social adjustment, rehabilitative progress, and the like, and which are primarily used in connection with bail, pre-trial or post-trial release proceedings, sentencing, correctional and rehabilitative planning, probation, or parole. Housing Applicant . An individual who applies to rent or lease housing for a period of 30 days or longer, including market rate and subsidized housing. Housing applicant shall not include individuals seeking admission to any type of program, and further, the term specifically excludes applicants to: substance abuse programs; shelters; nursing homes; or assisted living facilities. iCORI . The internet-based system used in the Commonwealth to access CORI and to obtain self-audits. iCORI Agency Agreement. An agreement signed by an individual with signatory authority for an iCORI requestor whereby the requestor agrees to comply with the CORI laws, regulations, policies, and procedures associated with CORI access and dissemination. Individual. A natural person. Intelligence Information . Records and data compiled by a criminal justice agency for the purpose of criminal investigation, including reports of informants, investigators, or other persons, and information obtained from any type of surveillance associated with an identifiable individual. Intelligence information shall also include records and data compiled by a criminal justice agency for the purpose of investigating a substantial threat of harm to an individual, or to the order or security of a correctional facility. Legally Designated Representative . Any person authorized to submit and receive CORI on behalf of a requestor. Legally Designated Representative shall be synonymous with legally authorized designee. Licensing Applicant. An otherwise qualified individual who has applied for a license and is being screened for criminal history by a governmental licensing agency. License and licensing, as used in 803 CMR 2.00, refer to licenses, permits, certificates, or authorizations issued by government agencies. Licensing applicant, as used in 803 CMR 2.00, includes initial and renewal applicants, as well as current license holders. Open Access to CORI . The level of CORI access available to any member of the general public upon production of a subject’s correct name and date of birth. Person. A natural person, corporation, association, partnership, or other legal entity. Requestor. A person submitting a request for CORI or criminal history information. As used in 803 CMR 2.00, requestor excludes a person making such requests through a law enforcement or criminal justice agency. Required Access to CORI . The level of CORI access available to requestors who are authorized or required by statute, regulation, or accreditation requirement to obtain CORI. 6/11/21803 CMR - 7

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.02 continued

2.02: continued Self-audit. A self-audit is a report of all CORI requests made on the requesting individual through the iCORI system apart from those made by criminal justice agencies. A self-audit may only be requested by the subject individual or the subject individual’s legally designated representative or attorney on his or her behalf. Standard Access to CORI . The level of CORI access available to any requestor, or any requestor’s legally designated representative, to evaluate: current and prospective employees, including full-time, part-time, contract, or internship employees or volunteers; applicants for rental or lease of housing; volunteers for services; and licensing applicants for a professional or occupational license issued by a state or municipal entity. Subject . An individual for whom a request for CORI is submitted to DCJIS.

2.03 CORI Inclusions and Exclusions

2.03: CORI Inclusions and Exclusions (1)CORI is defined in M.G.L. c. 6, § 167 and shall include any records or data in any communicable form which meet all the following criteria such that they: (a) are compiled by a Massachusetts criminal justice agency; (b) concern an identifiable individual; (c) relate to the nature or disposition of any one of the following:

  1. a criminal charge;
  2. an arrest;
  3. a pre-trial proceeding;
  4. any other judicial proceeding;
  5. a previous hearing conducted pursuant to M.G.L. c. 276, § 58A where the defendant was detained prior to trial or released with conditions under M.G.L. c. 276, § 58A(2);
  6. sentencing;
  7. incarceration;
  8. rehabilitation; or
  9. release. (d) are recorded in a criminal proceeding that was not:
  10. dismissed before arraignment; or
  11. subject to the filing of a nolle prosequi before arraignment; (e) concern an individual, who:
  12. has reached 18 years of age or older;
  13. prior to September 18, 2013, had reached 17 years of age or older; or
  14. was younger than 18 years old, but was adjudicated as an adult in superior court or adjudicated as an adult after transfer of a case from a juvenile session to another trial court department. (f) concern offenses that are punishable by incarceration. (2) CORI shall not include: (a) information recorded in a criminal proceeding that was dismissed before arraignment; (b) information recorded in a criminal proceeding in which a nolle prosequi was filed before arraignment; (c)information concerning criminal offenses or acts of delinquency committed by any individual younger than 18 years old on or after September 18, 2013 or 17 years of age prior to September 18, 2013, unless the individual was adjudicated as an adult; (d)photographs, fingerprints, or other identifying data of an individual used for investigative purposes, except where it meets the definition of CORI in 803 CMR 2.03; (e) evaluative information; (f)statistical and analytical reports and files in which individuals are not directly or indirectly identifiable; (g) intelligence information; (h) information regarding any offenses which are not punishable by incarceration; (i) booking photographs; (j) daily police logs, arrest registers, or other similar records compiled chronologically; (k) chronologically maintained court records of published judicial proceedings; (l) decisions of the Parole Board; 6/11/21803 CMR - 8

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.03 continued

2.03: continued (m) published records of public court or administrative proceedings; (n) published records of public judicial, administrative, or legislative proceedings; (o) federal criminal record information; or (p) anything otherwise excluded by law. (3) Any information in a police incident report that meets the definition of CORI in 803 CMR 2.03(1) is CORI. (4) Booking photographs by themselves are not CORI, but any information on a booking sheet will be CORI where it meets the definition of CORI in 803 CMR 2.03(1). (5) Regardless of whether an individual is identified by name, an individual may be identifiable for purposes of 803 CMR 2.03(1)(b) if the person is identifiable in some other manner. (6)Fingerprints concern an identifiable individual for purposes of 803 CMR 2.03(1)(b), regardless of whether the individual is identified by name or in any other manner; therefore, fingerprints are CORI where they otherwise meet all the criteria in 803 CMR 2.03(1).

2.04 iCORI Registration

2.04: iCORI Registration (1) To access the iCORI system, a requestor shall first register for an iCORI account as outlined in 803 CMR 2.04(2) through (10). (2) A member of the general public may register for an iCORI account to request his or her own CORI, to request Open Access to CORI, or to request a self-audit. (3) An employer or volunteer organization may register for an iCORI account to screen current employees or employment applicants. (4)A governmental licensing agency may register for an iCORI account to screen current license holders or licensing applicants. (5) A CRA may register for an iCORI account to access CORI for a client who would meet the requirements of registration for an iCORI account. Regulations applicable to CRA registration can be found in 803 CMR 11.00: Consumer Reporting Agency (CRA). (6) A landlord, property management company, real estate agent, or public housing authority may register for an iCORI account to access CORI to evaluate housing applicants. Regulations applicable to landlord, property management company, real estate agency, and public housing authority registration can be found in 803 CMR 5.00: Criminal Offender Record Information (CORI) - Housing. (7) To complete the registration process, users shall agree to all iCORI terms and conditions. In addition, users shall also complete CORI training. DCJIS’s website contains the following training documents: training for individuals, training for organizations, and training for consumer reporting agencies. To complete CORI training, each user must review the appropriate training document. (8) Upon registration, requestors are required to complete the iCORI Agency Agreement, which shall be signed by an individual with signatory authority for the requestor. The terms of the iCORI Agency Agreement shall include, but not be limited to, the following: (a) Requestor agrees to comply with the CORI laws and regulations; (b) Requestor shall maintain an up-to-date “need to know” list and provide all staff that request, review, or receive CORI with the iCORI training materials available on the DCJIS website at https://www.mass.gov/orgs/department-of-criminal-justice-information-services; (c) Requestor agrees to report any violation of the CORI laws or regulations associated with the iCORI account to DCJIS within 72 hours of learning of said breach or violation; (d) Requestor shall only request the level of CORI access authorized by statute or approved by DCJIS; and 6/11/21803 CMR - 9

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.04 continued

2.04: continued (e)Requestor shall be liable for any violations of the CORI law or regulations, and individual users of the requestor’s account may also be liable for any such violations. (9) All iCORI registrations shall expire after two calendar years. Registrations shall be renewed prior to the registration expiration date in order for the registrant to continue to have iCORI access. In order to renew, re-register, and/or ensure continued access (collectively, to “renew access”), the following conditions shall be met: (a) All requestors shall again execute the iCORI Agency Agreement upon renewal of the iCORI registration. The iCORI Agency Agreement shall be signed by an individual with signatory authority for the requestor; and (b) Requestors seeking to renew access as an entity other than an individual member of the general public shall again complete the iCORI training and agree to all iCORI terms and conditions. (10) DCJIS shall assess a fee for each request for CORI or self-audit according to a fee structure established by the Secretary of Public Safety and Security and shall establish rules for the waiver of a fee or portion thereof for such other persons as it deems appropriate, pursuant to M.G.L. c. 6, § 172A. No fee shall be assessed for a request made by a victim of a crime or a witness or family member of a homicide victim, all as defined in M.G.L. c. 258B, § 1, or by any local, state, or federal government entity. No fee shall be assessed for any veterans organization requesting information relative to employees, volunteers, or veterans for which such organization provides housing.

2.05 Levels of Access to CORI

2.05: Levels of Access to CORI (1) There shall be three different levels of access to CORI. The level of access to which a requestor is entitled shall depend upon the requestor and whether a statute, regulation, or accreditation requirement authorizes or requires the requestor to obtain a certain level of CORI. (2) The three levels of CORI access are: (a) Required Access; (b) Standard Access; and (c) Open Access. (3) Required Access to CORI is available only to requestors that are authorized or required by statute, regulation, or accreditation requirement to obtain CORI. (a) The level of Required Access granted to a requestor is determined with reference to the language of the statutory, regulatory, or accreditation requirement that mandates obtaining CORI. The four levels of Required Access are as follows:

  1. Required 1 Access to CORI includes access to: a. all pending criminal charges, including cases continued without a finding of guilt until they are dismissed; b. all adult misdemeanor convictions and felony convictions; c. offenses for which the subject was adjudicated as an adult; and d. all convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses (as defined by M.G.L. c. 6, § 178C) punishable by a term of incarceration in state prison, unless sealed.
  2. Required 2 Access to CORI includes access to:
    1. criminal offenses that did not result in a conviction;
    2. all pending criminal charges, including cases continued without a finding of guilt
    until they are dismissed; c. all adult misdemeanor convictions and felony convictions; d. offenses for which the subject was adjudicated as an adult; and e. all convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses (as defined by M.G.L. c. 6, § 178C) punishable by a term of incarceration in state prison, unless sealed.
  3. Required 3 Access to CORI includes access to:
    1. all juvenile offenses, including pending charges;
    2. criminal offenses that did not result in a conviction;
    3. all pending criminal charges, including cases continued without a finding of guilt
    until they are dismissed; 6/11/21803 CMR - 10

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.05 continued

2.05: continued

  1. all adult misdemeanor convictions and felony convictions;
  2. offenses for which the subject was adjudicated as an adult; and
  3. all convictions for murder, voluntary manslaughter, involuntary manslaughter, and

sex offenses (as defined in M.G.L. c. 6, § 178C) punishable by a term of

incarceration in state prison, unless sealed.

4. Required 4 Access to CORI includes access to:

a. criminal offenses that have been sealed;

b. all juvenile offenses, including pending charges;

c. criminal offenses that did not result in a conviction;

d. all pending criminal charges, including cases continued without a finding of guilt

until they are dismissed;

e. all adult misdemeanor convictions and felony convictions;

f. offenses for which the subject was adjudicated as an adult; and

g. all convictions for murder, voluntary manslaughter, involuntary manslaughter,

and sex offenses (as defined in M.G.L. c. 6, § 178C) punishable by a term of

incarceration in state prison.

(4) Standard Access to CORI is available to employers, volunteer organizations, landlords,

property management companies, real estate agents, public housing authorities, and

governmental licensing agencies to screen employment applicants, employees, licensing

applicants, and housing applicants.

(a) Standard Access to CORI includes access to:

1 all pending criminal charges, including cases continued without a finding of guilt until

they are dismissed;

2. all misdemeanor convictions for five years following the date of disposition or date

of release from incarceration or custody, whichever is later;

3. all felony convictions or findings of not guilty by reason of insanity for ten years

following the date of disposition or date of release from incarceration or custody,

whichever is later; and

4. all convictions for murder, voluntary manslaughter, involuntary manslaughter, and

sex offenses (as defined in M.G.L. c. 6, § 178C) punishable by a term of incarceration

in state prison, unless sealed, including information relating to such offenses where the

subject was adjudicated as an adult .

(b)Where a Standard Access request will return a conviction pursuant to 803 CMR

2.05(4)(a)2. or (4)(a)3., then the CORI provided to the Standard Access requestor will also

include all of the subject’s adult convictions as well as information relating to any offenses

for which the subject was adjudicated as an adult.

(5) Open Access to CORI is Available to All Members of the General Public.

(a) Open Access to CORI includes access to:

  1. misdemeanor convictions for one year following the date of disposition or date of release from incarceration or custody, whichever is later; 2.felony convictions or findings of not guilty by reason of insanity for offenses punishable by less than five years, for two years following the date of disposition or date of release from incarceration or custody, whichever is later; 3.felony convictions or findings of not guilty by reason of insanity for offenses punishable by five or more years in state prison, for ten years following the date of disposition or date of release from incarceration or custody, whichever is later; and
  2. all convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses (as defined in M.G.L. c. 6, § 178C) punishable by a term of incarceration in state prison, unless sealed, including information relating to such offenses where the subject was adjudicated as an adult. (6)None of the three levels of CORI access shall grant access to information expunged pursuant to court order. 6/11/21803 CMR - 11

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.06 Access to an Individual’s Own CORI

2.06: Access to an Individual’s Own CORI (1) An individual may request a copy of his or her own CORI by registering for an iCORI account. An individual requesting a copy of his or her own CORI will have Required 2 Access, which includes all CORI, but excludes juvenile, sealed, or expunged charges. (2) If an individual does not have access to the internet, the individual may request a copy of his or her CORI from DCJIS by submitting a completed CORI Personal Request Form. (3) An individual’s attorney may request a copy of the individual’s CORI in accordance with the additional procedures and requirements of 803 CMR 2.07(1). (4) An individual’s legally designated representative may request a copy of the individual’s CORI by registering for an iCORI account or by requesting a copy from DCJIS and supplying an original completed CORI Advocate or Designated Representative Request Form. An individual’s legally designated representative shall comply with the additional procedures of 803 CMR 2.08. (5) If an individual or his or her attorney or legally designated representative requires CORI to obtain apostille authentication from the Office of the Secretary of the Commonwealth, an additional fee may be required.

2.07 Attorneys

2.07: Attorneys (1) An attorney may access the CORI information of the attorney’s client in the following manner: (a) The attorney shall obtain the client’s consent to access the client’s CORI; (b) The attorney shall verify the identity of the client; (c) The attorney shall complete the CORI Attorney Affidavit Form, which must:

  1. affirm that the subject of the request is a current client of the requesting attorney;
  2. affirm that the attorney has obtained the client’s consent to access the client’s CORI;
  3. describe and affirm the means used by the attorney to verify the client’s identity; and
  4. be signed by the attorney subject to the penalties of perjury. (d)The attorney shall submit the completed CORI Attorney Affidavit Form either electronically via the attorney’s account on the iCORI system or by a physical copy mailed to DCJIS. (e) The completed CORI Attorney Affidavit Form will be valid for a period of one year from the signing of the form. The attorney may run a subsequent CORI check on the same client within this time period so long as the client is still a current client of the attorney. (f) Where representation changes such that the client is represented by a succeeding attorney who works for the same firm or entity as the attorney who signed the CORI Affidavit Form, and where the client maintains an unbroken attorney-client relationship with attorneys working for that firm or entity, then succeeding attorneys who directly represent the client and who work for that same firm or entity may run a subsequent CORI check on the client within one year of the signing of the CORI Attorney Affidavit Form by the initial attorney. (g) The attorney or the firm or entity for which the attorney works shall maintain a copy of the completed CORI Attorney Request Form for a period of one year from the submission of the CORI request. The attorney who signs the form is responsible for ensuring that it will be preserved. (h)A client’s CORI accessed by an attorney on the client’s behalf may only be disseminated:
  5. to the client;
  6. to such other individuals as authorized by the client; or
  7. as otherwise authorized by law. (i) An attorney shall not use the procedures outlined in 803 CMR 2.07(1) to access CORI of a former client or a non-client. To access the CORI of a former client or a non-client, an attorney must use the procedures described in 803 CMR 2.07(2). 6/11/21803 CMR - 12

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.07 continued

2.07: continued (2) An attorney seeking to obtain a former client or non-client’s CORI, beyond what is available via Open Access to CORI, for litigation purposes shall submit a valid, signed court order directly to DCJIS. A non-client’s CORI, beyond what is available via Open Access to CORI, may only be disseminated: (a) as allowed by the court that issued the order; or (b) as otherwise authorized by law.

2.08 Legally Designated Representatives

2.08: Legally Designated Representatives A legally designated representative may obtain the client’s CORI on the client's behalf as follows: (a) A legally designated representative may obtain a client’s CORI by registering for an iCORI account and submitting a CORI request. To submit a CORI request the legally designated representative shall:

  1. provide the legally designated representative’s own identifying information required by DCJIS, as well as identifying information regarding the client; 2.obtain a signed CORI Advocate or Designated Representative Request Form authorizing the legally designated representative to obtain the client's CORI;
  2. maintain the completed CORI Advocate or Designated Representative Request Form for a period of one year from the submission of the CORI request; and
  3. verify the client’s identity as provided in 803 CMR 2.11. (b) A legally designated representative seeking to obtain a client's CORI may instead submit a completed CORI Advocate or Designated Representative Request Form on paper to DCJIS. (c) CORI accessed by a legally designated representative on behalf of a client may only be disseminated:
  4. to the client;
  5. to such other individuals as authorized by the client; or
  6. as otherwise authorized by law.
2.09 Special Categories for CORI Access

2.09: Special Categories for CORI Access (1)An elderly person or disabled person shall be permitted to obtain CORI to screen employment applicants or employees for positions which may provide assistance within the home of the elderly person or disabled person; in order to do so, it is necessary to complete the On Behalf of/Home Health Aide CORI Request Form. (a) A legally designated representative may also obtain CORI for this purpose on behalf of an elderly person or disabled person. (b)A requestor using the On Behalf of/Home Health Aide CORI Request Form shall receive Required 2 Access as defined in 803 CMR 2.05. (c) A requestor using On Behalf of/Home Health Aide CORI Request Form shall not be subject to the provisions of 803 CMR 2.20. (2) A requestor who wishes to obtain CORI beyond what is available via Open Access may contact DCJIS to request such access. Pursuant to M.G.L. c. 6, § 172(a)(6), the Commissioner of DCJIS may provide expanded access to CORI if he or she finds that expanding access serves the public interest. Upon such a finding, the Commissioner shall also determine the extent of expanded CORI access.

2.10 Prohibition against Requiring an Individual to Provide His or Her Own CORI

2.10: Prohibition against Requiring an Individual to Provide His or Her Own CORI A person or entity is prohibited from requesting or requiring an individual to provide a copy of his or her own CORI, except as authorized by M.G.L. c. 6, § 172. As provided in M.G.L. c. 6, §§ 172(d), 177, and 178, a violation of this provision may subject the violator to civil liability and may constitute a crime punishable by fine or imprisonment. Therefore, in addition to its own investigation and imposition of civil penalties through the CRRB pursuant to 803 CMR 2.27 and 2.28, DCJIS may also refer a violation of 803 CMR 2.10 to a law enforcement agency or district attorney’s office for investigation or potential criminal prosecution. 6/11/21803 CMR - 13

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.11 Requirements for Requestors to Request CORI

2.11: Requirements for Requestors to Request CORI (1)Prior to submitting a CORI request, a requestor, including any individual, employer, volunteer organization, landlord, property management company, real estate agent, public housing authority or governmental licensing agency, shall: (a) obtain a signed CORI Acknowledgment Form for each subject to be checked; (b) verify the identity of each subject pursuant to 803 CMR 2.11(5); and (c) sign and date a CORI Acknowledgment Form for each subject certifying that the subject was properly identified. (2) Model CORI Acknowledgment Forms with the required fields of information are available on the DCJIS website. Requestors shall either use the applicable published CORI Acknowledgment Forms or incorporate the language and information provided on such forms into their applications. (3) To complete the CORI Acknowledgment Form, the subject shall provide: (a) all names that have been used by the subject or by which the subject has been known; and (b) all different names or dates of birth for the subject that the subject is aware appear in the CORI database. (4) In the course of reviewing a CORI Acknowledgment Form, if the requestor finds other names or dates of birth used by the subject or by which the subject has been known, the requestor may submit this information to the iCORI system. Requestors shall notify the subject of the source of the identifying information when the CORI results are returned. When the requestor is a CRA, the CRA’s client shall notify the subject of the source of the identifying information. (5) In order to verify the identity of a subject and to comply with 803 CMR 2.11(1)(b), one of the following methods shall be used: (a) A requestor shall verify a subject’s identity by examining in person a suitable form of government-issued identification containing a photograph of the subject. Acceptable types of government-issued identification are:

  1. a passport;
  2. a driver’s license issued by any federal, state, or territorial government of the United States;
  3. an identification card with a photograph issued by any federal, state, or territorial government of the United States;
  4. a permanent residency card issued by the U.S. Government;
  5. a military identification card issued by the U.S. Government;
  6. Native American Tribal documents; and
  7. other forms of documentation as determined by DCJIS. (b) If a subject does not have an acceptable form of government-issued identification, a requestor shall verify identity by examining in person either the subject’s birth certificate or social security card. (c) If a subject is younger than 18 years old at the time of verification and cannot be verified by any of the documents identified in 803 CMR 2.11(5)(a) and/or (b), then the subject’s identity may be verified by a school-issued identification card with a photograph. (d) If a requestor is unable to verify a subject’s identity and signature in person, the subject may submit a completed CORI Acknowledgment Form acknowledged by the subject before a notary public. (e) Requestors that are unable to verify a subject’s identity either in person or by acceptance of a notarized CORI Acknowledgment Form, shall verify the identity of the subject by inspection of a photographic form of government-issued identification via videoconference. A legally designated representative may also use 803 CMR 2.11(5)(e) to submit a personal CORI request for and on behalf of his or her client. An employer, volunteer organization, landlord, property management company, real estate agent, or public housing authority that verifies a subject’s identity via videoconference shall verify the subject’s identity in person or by acceptance of a notarized CORI Acknowledgment Form within seven days of the subject reporting to work or a volunteer opportunity or acceptance of a lease or rental. In instances where the identity does not match the information provided, the requestor shall submit a new CORI request with the information verified either in person or by acceptance of a notarized CORI Acknowledgment Form. 6/11/21803 CMR - 14

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.11 continued

2.11: continued It is not necessary for an employer, volunteer organization, landlord, property management company, real estate agent, or public housing authority to re-verify a prior verification by videoconference if the subject does not subsequently report in person to work or a volunteer opportunity or for acceptance of a lease or rental. For any subject verified by videoconference between April 9, 2020 and June 15, 2021, which subject is required by 803 CMR 2.11(5)(e) to be re-verified, the re-verification may be completed by July 9, 2021 but must be completed no later than July 9, 2021 DCJIS may supplement 803 CMR 2.00 in the future with written guidance requiring that verification by videoconference be accompanied by the electronic or paper submission of copies of any documents described in 803 CMR 2.11(5)(a), (b), (c), or (d). (f)Requestors that are unable to verify a subject’s identity in person or as outlined in 803 CMR 2.11(5)(a), (b), (c), (d), or (e) may petition DCJIS for an alternative means of identity verification. DCJIS may grant, deny, or suggest an alternative means of identity verification sufficient to reasonably verify the subject’s identity. DCJIS may require CORI requests verified under such alternative means to be verified either in person or through the submission of a notarized CORI Acknowledgment Form at a later time. (g)DCJIS may supplement 803 CMR 2.00 with written guidance that would permit verification by other electronic means in accordance with the terms of such guidance. (6) A requestor shall submit all the following information for each request: (a) subject’s name; (b) subject’s date of birth; (c) if available, the last six digits of the subject's social security number; and (d) if available, a Massachusetts Driver’s License number or Massachusetts Identification Card (Mass ID) number. (7)For employers, volunteer organizations, and governmental licensing agencies, CORI Acknowledgment Forms shall be valid for one year from the subject’s having signed the form or until the conclusion of a subject’s employment or licensing period, whichever comes first. (8) For employer, volunteer organization, or government licensing agency may submit a new request for CORI within one year of the subject’s having signed the original CORI Acknowledgment Form as long as the requestor notifies the subject on its CORI Acknowledgment Form that a CORI may be requested at any time within that one year. (9) Nothing in 803 CMR 2.00 shall be construed to prohibit an employer or governmental licensing agency from making an adverse employment, volunteer, or licensing decision on the basis of a subject’s refusal to consent to a lawful request for CORI. (10) If a subject’s license expires or is revoked, a subject’s CORI Acknowledgment Form shall become invalid. (11) CORI Acknowledgment Forms shall be retained by the requestor for a minimum of one year from the date of the subject’s signature.

2.12 Electronic Submission of CORI Acknowledgment Forms

2.12: Electronic Submission of CORI Acknowledgment Forms (1) A requestor may collect CORI Acknowledgment Forms through electronic means including, but not limited to, the requestor’s electronic application. When CORI Acknowledgment Forms are collected electronically, the requestor shall comply with all provisions set forth in 803 CMR 2.11. (2) To satisfy the requirement pertaining to verification of the subject’s identity as set forth in 803 CMR 2.11(1)(b), the subject may submit a notarized copy of the CORI Acknowledgment Form as provided in 803 CMR 2.11(5)(c). Such notarized form shall be either uploaded into the requestor’s electronic system or transmitted electronically to the requestor prior to the submission of the subject's CORI request. If the requestor is unable to verify the subject’s identity in person and unable to obtain such notarized form, then it shall comply with the provisions of 803 CMR 2.11(5)(e) or (f). 6/11/21803 CMR - 15

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.13 Identity Verification Exemption for Subsequent CORI Checks

2.13: Identity Verification Exemption for Subsequent CORI Checks (1) A new CORI request may be submitted within one year as provided in 803 CMR 2.11(8), or where an attorney is submitting a request on behalf of the attorney’s client, as provided in 803 CMR 2.07(1)(e) and (f). (2) For CORI requests submitted for the same subject after one year, requestors shall obtain a new completed CORI Acknowledgment Form. (a) If the information provided on the CORI Acknowledgment Form exactly matches the information on the expired CORI Acknowledgment Form, then the requestor is not required to verify the subject’s identity a second time. (b) If the name and/or date of birth provided on the CORI Acknowledgment Form differs from the information on the expired CORI Acknowledgment Form, then all steps, including verification of identity as provided in 803 CMR 2.11, shall be followed prior to the submission of a new CORI request.

2.14 Storage and Retention of CORI

2.14: Storage and Retention of CORI (1) Hard copies of CORI shall be stored in a separate locked and secure location, such as a file cabinet. Access to the locked and secure location shall be limited to employees who have been approved to access CORI. (2) Electronically-stored CORI shall be password protected and encrypted. Password access shall be limited to only those employees who have been approved to access CORI. (3) CORI may be stored using cloud storage methods. When CORI is stored using cloud storage methods the following shall be followed: (a) The requestor shall have a written agreement with the cloud storage provider. The written agreement shall include the minimum security requirements published by DCJIS concerning cloud storage. Said agreement is subject to inspection by DCJIS and shall be provided to DCJIS upon request. (b) The cloud storage method shall provide for encryption and password protection of all CORI. (4) CORI and/or CORI Acknowledgment Forms shall not be retained for longer than seven years from whichever of the following occurs later: (a) The subject’s last date of employment or volunteer service for which the CORI request was made; or (b) The date of the final decision regarding the employment or volunteer opportunity or licensing decision of the requestor regarding the subject.

2.15 Destruction of CORI and CORI Acknowledgment Forms

2.15: Destruction of CORI and CORI Acknowledgment Forms (1) Hard copies of CORI and CORI Acknowledgment Forms shall be destroyed by shredding or burning. (2)Electronic copies of CORI and CORI Acknowledgment Forms shall be destroyed by deleting them from the device on which they are stored and from any system used to back up the information and by degaussing the device or overwriting the files with 1s and 0s multiple times. (3) CORI and CORI Acknowledgment Forms shall be appropriately destroyed by the electronic or mechanical means described above before disposing of, or repurposing, a computer or other device used to store CORI. 6/11/21803 CMR - 16

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.16 Required Dissemination of CORI

2.16: Required Dissemination of CORI (1) Each employer, volunteer organization, or governmental licensing agency shall provide a copy of a subject’s CORI or other criminal history information, and shall disclose the source of the information, to him or her: (a) before asking any questions about the subject’s criminal history; and (b) before making an adverse employment, volunteer, or licensing decision based on the subject's CORI. (2) Each employer, volunteer organization, or governmental licensing agency that is overseen, regulated, or supervised by a governmental entity shall, upon request, disseminate CORI relating solely to the requestor’s employees or licensees to that governmental entity’s staff in order for the governmental entity to ensure that the requestor is in compliance with the governmental entity’s regulations, policies, or procedures.

2.17 Permissive Dissemination of CORI

2.17: Permissive Dissemination of CORI (1) An employer, volunteer organization, or governmental licensing agency may disseminate a subject’s CORI to the subject. (2) If an employer, volunteer organization, or governmental licensing agency is a party to a complaint or legal action as a result of any decision based on CORI, then the employer, volunteer organization, or governmental licensing agency may disseminate CORI to an administrative agency or court for the purpose of defending its decision. (3) CORI may be disseminated during litigation as part of the discovery process, but may not be further disseminated, except as otherwise permitted by law and regulation. CORI may not be publicly filed, except as authorized by court order. (4) An employer, volunteer organization, or governmental licensing agency may disseminate a subject’s CORI to its staff who have been authorized to request, receive, or review CORI for the purposes of evaluating the subject’s application for employment or licensing.

2.18 CORI Policy Requirement for Certain Requestors and the Need to Know Requirements

2.18: CORI Policy Requirement for Certain Requestors and the Need to Know Requirements (1)A person or entity which conducts five or more criminal background investigations annually, whether the information is obtained from DCJIS or another source, shall maintain a written CORI policy which shall at least contain and apply all provisions from the DCJIS Model CORI Policy. (2)A CORI policy may be developed and maintained, regardless of the number of CORI requests conducted. (3) Each requestor shall maintain a “need to know” list of staff that have been authorized to request, receive, or review CORI. This list shall be updated periodically, but not less than every six months, and shall be made available to DCJIS upon request. A requestor may also provide the “need to know” list to a subject or subject’s attorney or legally designated representative upon request.

2.19 Requirement to Maintain a Secondary Dissemination Log

2.19: Requirement to Maintain a Secondary Dissemination Log (1) CORI shall not be disseminated except as otherwise provided in 803 CMR 2.16 and 2.17, or as otherwise authorized by the law, regulation, or accreditation requirement that allows for CORI access. (2) In the limited circumstances under which CORI may be lawfully disseminated outside of the requestor’s organization, the requestor shall either enter into an approved memorandum of understanding with the recipient or else record each such dissemination in a secondary dissemination log. 6/11/21803 CMR - 17

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.19 continued

2.19: continued (a) An approved memorandum of understanding shall:

  1. be approved by DCJIS prior to execution;
  2. be entered into between any and all parties that will disseminate, receive, or have any access to CORI pursuant to the agreement; 3.be signed by individuals with signatory authority on behalf of any and all such parties;
  3. conform with all statutes, regulations, and policies applicable to CORI access; and
  4. describe in detail all circumstances in which CORI will be shared, including the means and media to be used, any and all security controls, all persons with access to any CORI under the agreement, the purpose of such information sharing, and the legal authority for said agreement. (b)The secondary dissemination log shall record the following information for each dissemination:
  5. the subject’s name;
  6. the subject’s date of birth;
  7. the date and time of dissemination;
  8. the name of the individual to whom the CORI was disseminated along with the name of the organization for which the individual works, if applicable; and
  9. the specific reason for dissemination. (3) The secondary dissemination log may be maintained electronically or on paper. (4) An electronic dissemination log shall be protected in the same manner as described in 803 CMR 2.14 and 2.15. (5) Each secondary dissemination log entry shall be maintained for at least seven years. (6) A secondary dissemination log shall be subject to audit by DCJIS. (7) Upon request, a requestor may provide a subject a copy of the secondary dissemination log pertaining only to dissemination of the subject’s CORI.
2.20 Adverse Employment Decision Based on CORI or Other Criminal History Information

2.20: Adverse Employment Decision Based on CORI or Other Criminal History Information (1)Before taking adverse action against an employment applicant, volunteer applicant, employee, or volunteer, if the action is based on the subject’s CORI or any other criminal history information, then the employer or volunteer organization shall: (a) comply with applicable federal and state laws and regulations; (b) notify the subject in person, by telephone, fax, or electronic or hard copy correspondence of the potential adverse employment action; (c) provide a copy of the subject’s CORI or criminal history information to the subject; (d) identify the source of the CORI or criminal history information; (e) provide a copy of the requestor’s CORI Policy, if applicable, to the subject; (f) identify the information in the subject’s CORI or criminal history information that forms any basis for the potential adverse action; (g) provide the subject with the opportunity to dispute the accuracy of the information contained in the CORI or criminal history information; (h) when CORI is considered as a part of a potential adverse action, provide the subject with a copy of DCJIS information regarding the process for correcting CORI; and (i) document all steps taken to comply with 803 CMR 2.20.

2.21 Adverse Licensing Decision Based on CORI or Other Criminal History Information

2.21: Adverse Licensing Decision Based on CORI or Other Criminal History Information (1)A governmental licensing agency shall provide a licensing applicant with information regarding an appeal process, which information and process shall include the opportunity to dispute the accuracy of the information contained in CORI or criminal history information. (2) At the time of making a final adverse decision, including any appeals, on an application for a license, if the decision is based on the subject’s CORI or any other criminal history information, the governmental licensing agency shall: 6/11/21803 CMR - 18

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.21 continued

2.21: continued (a) comply with applicable federal and state laws and regulations; (b) notify the licensing applicant in person, by telephone, fax, or electronic or hard copy correspondence of the potential adverse licensing decision; (c) provide a copy of the licensing applicant’s CORI or criminal history information to the licensing applicant; (d) identify the source of the CORI or criminal history information; (e) provide a copy of the agency’s CORI Policy, if applicable, to the subject; (f) identify the information in the licensing applicant’s CORI that forms any basis for the potential adverse decision; (g) when CORI is considered as a part of a potential adverse decision, provide the licensing applicant with a copy of DCJIS information regarding the process for correcting CORI; and (h) document all steps taken to comply with 803 CMR 2.21(1).

2.22 Use of a Consumer Reporting Agency (CRA)

2.22: Use of a Consumer Reporting Agency (CRA) (1) A requestor may utilize the services of a Consumer Reporting Agency (CRA) to request CORI for an employment or volunteer applicant, an employee or volunteer, or a licensing applicant. See 803 CMR 11.00: Consumer Reporting Agency (CRA). (a) Before a CRA can request CORI from DCJIS on a requestor’s behalf, the requestor shall: 1.register for an iCORI account and designate the CRA as an entity authorized to submit iCORI checks on the requestor’s behalf; 2. notify the subject, in writing and in a separate document consisting solely of such notice, that a consumer report may be used in the decision making process; 3. obtain the subject's separate written authorization to conduct background screening before asking a CRA for the report regarding the subject. A requestor shall not substitute the CORI Acknowledgment Form for this written authorization; and 4. obtain a signed CORI Acknowledgment Form and follow all requirements pertaining to verification of identity as set forth in 803 CMR 2.11. (b) A requestor shall also provide required information to the CRA before requesting CORI through a CRA.

  1. The requestor shall certify to the CRA that the requestor is in compliance with the Federal Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681.
  2. The requestor shall not misuse any information in the report in violation of federal or state laws or regulations.
  3. The requestor shall provide accurate identifying information for the subject to the CRA and the purpose for which the subject's CORI is being requested. (2) Before taking adverse action on a subject’s application based on the subject’s CORI or criminal history information, whether received from DCJIS or any other source by the CRA, the requestor shall: (a) provide the subject with a pre-adverse action disclosure that includes a copy of the subject’s consumer report and a copy of A Summary of Your Rights Under the Fair Credit Reporting Act, published by the Federal Trade Commission and obtained from the CRA, by meeting the subject in person or by telephone, by electronic communication, by fax, or by hard copy correspondence; (b) provide a copy of the subject’s CORI or criminal history information to the subject; (c) identify the source of the CORI or criminal history information; (d) provide a copy of the requestor’s CORI Policy, if applicable, to the subject; (e) identify the information in the subject’s CORI that forms any basis for the potential adverse decision; (f)provide the subject with an opportunity to dispute the accuracy of the information contained in the CORI or criminal history information; (g) when CORI is considered as a part of a potential adverse action, provide the subject with a copy of the DCJIS information regarding the process for correcting a criminal record; and (h) document all steps taken to comply with 803 CMR 2.22(2). 6/11/21803 CMR - 19

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.23 Audits by DCJIS

2.23: Audits by DCJIS (1) Any and all requests for CORI are subject to audit at any time by DCJIS. (2) Each requestor who requests CORI shall respond to, cooperate with, and participate in audits conducted by DCJIS. (a) Failure to respond to, cooperate with, or participate in an audit may result in immediate revocation of CORI access. (b) If CORI access is revoked for failure respond to, cooperate with, or participate in a DCJIS audit, the requestor shall not obtain CORI through a CRA. (c) DCJIS may restore CORI access upon completion of its audit. (d) DCJIS may also initiate a complaint with the CRRB against any requestor for failure respond to, cooperate with, or participate in an audit. (3) During a DCJIS audit, the requestor shall provide, or allow DCJIS staff to inspect, certain CORI-related documents including, but not limited to: (a) CORI Acknowledgment Forms; (b) secondary dissemination logs; (c) the organization’s CORI Policy, if applicable; and (d) documentation of any adverse decisions based on CORI. (4) During an audit, DCJIS staff shall assess the requestor’s compliance with statutory and regulatory requirements including, but not limited to: (a) whether the requestor properly registered for the appropriate level of CORI access and provided correct registration information; (b) whether the requestor is properly completing and retaining CORI Acknowledgment Forms; (c) whether the requestor is requesting CORI in compliance with 803 CMR 2.00; (d) whether the requestor is properly storing and safeguarding CORI; (e) whether the requestor is properly maintaining a secondary dissemination log; (f) whether the requestor is screening only those individuals permitted by law; and (g) whether the requestor has a CORI policy that complies with DCJIS requirements. (5) Audit Results May Be Published . (6) If DCJIS staff determine that the requestor is not in compliance with statutory or regulatory CORI requirements, DCJIS may: (a) initiate a complaint against the organization with the CRRB; (b)refer the audit results to state or federal law enforcement agencies for criminal investigation; and/or (c) enter into a consent agreement with the requestor whereby the requestor agrees to certain audit findings and, in lieu of further proceedings, agrees to resolve audit findings by paying a fine and/or accepting conditions on access to CORI. (7) Pursuant to its authority and responsibilities in M.G.L. c. 6, §§ 167A and 172, if DCJIS detects a possible violation or breach of security associated with an iCORI account, it may immediately deactivate that account pending further investigation and take appropriate action to ensure the security and confidentiality of CORI data.

2.24 Confidentiality and Privacy of CORI

2.24: Confidentiality and Privacy of CORI (1)A requestor shall not request an individual’s CORI before obtaining that individual’s authorization, except when requesting Open Access CORI. This prohibition does not apply to a request by a criminal justice agency made for an authorized criminal justice purpose. (2) Restrictions on access to and dissemination of an individual’s CORI shall terminate upon the individual’s death. Upon request, and with a valid death certificate or reasonable proof of death as determined by DCJIS, any person or entity may access a deceased individual’s entire CORI. 6/11/21803 CMR - 20

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.25 CORI Self-audit

2.25: CORI Self-audit (1) A self-audit is a report of all CORI requests made on the requesting individual through the iCORI system apart from those made by criminal justice agencies. A self-audit may be requested at any time. (2) A self-audit may only be requested by the subject individual or the subject individual’s legally designated representative or attorney on his or her behalf. Requesting a self-audit under other circumstances, such as an attempt to obtain another person’s personal information, is a violation of M.G.L. c. 6, § 178. (3) To obtain a self-audit, an individual may register for an iCORI account. A self-audit may also be requested from DCJIS via mail using a request form developed by DCJIS. (4) All self-audit requests submitted by mail shall be notarized. (5) An individual may request one free self-audit every 90 days. A fee will be charged for any subsequent self-audit requests made during any 90-day period. (6) A self-audit is not a public record.

2.26 Inaccurate CORI

2.26: Inaccurate CORI (1) An individual may file a complaint with DCJIS regarding inaccurate information on his or her CORI using the process established by DCJIS. (2) DCJIS does not have authority to amend any records of the Trial Court. In responding to a complaint of inaccurate CORI, DCJIS may refer the complaining subject to the appropriate agency with authority to remedy the complaint.

2.27 CORI Complaints

2.27: CORI Complaints (1) A complaint may be filed with DCJIS for any violation(s) of the CORI laws and regulations including, but not limited to: (a) improper access to or dissemination of CORI; and (b)failure of a person to follow regulations, including 803 CMR 2.00, 803 CMR 5.00: Criminal Offender Record Information (CORI) - Housing, and 803 CMR 11.00: Consumer Reporting Agency (CRA). (2) DCJIS shall screen all complaints to determine whether there is sufficient information to investigate the alleged violation. (a) The complaint shall be signed by the complaining witness. If the complaining witness is an entity rather than an individual, then the complaint shall be signed on behalf of the complaining witness by the individual with most knowledge of the relevant facts. (b) Complaints regarding improper access to CORI or improper dissemination of CORI shall state the complaining witness’s beliefs as to the following:

  1. what CORI specifically was improperly accessed and/or disseminated;
  2. by whom the relevant CORI was accessed and/or disseminated and when;
  3. a reasonable time period within which the complaining witness believes the CORI was improperly accessed and/or disseminated; and
  4. a description of any relevant circumstances surrounding the alleged improper access and/or dissemination. (c) DCJIS may request additional information from the complaining witness, including the production of books, records, or documents, and failure to cooperate with such a request is grounds for concluding that the complaint is not supported by sufficient information. (3) After investigation, if DCJIS determines that there is sufficient information to support the complaint, then it shall present an investigation report to the CRRB to determine next steps, including whether a show cause order should be issued against any party. 6/11/21803 CMR - 21

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.27 continued

2.27: continued (a) If the CRRB issues a show cause order, DCJIS shall send the order by first class mail to any party affected by the order, and DCJIS shall provide any such parties with an opportunity and reasonable timeframe to respond to the order. DCJIS may extend a party’s deadline to respond upon the reasonable request of a party. (b) Upon receipt of responses from the parties affected by the order, or upon the passage of the timeframes set by DCJIS, DCJIS may schedule either a CORI complaint hearing before a subcommittee of the CRRB or a CORI complaint conference before a complaint hearing officer. Whether a complaint goes to hearing or conference shall be determined with regard to the complexity of the complaint. (c)With regard to a particular complaint, all complaining witnesses and respondents (individually, a “party” and collectively, “parties”) shall receive at least 30 days notice of the scheduled date, time, and place of the hearing or conference from DCJIS by electronic communication or by first class mail. (d) Each party shall also receive a complaint packet that contains a copy of the complaint, any response, and any other additional relevant information obtained by DCJIS. (e) Before the conference or hearing, DCJIS shall issue notices and summonses to compel attendance of all parties. DCJIS may issue additional notices and summonses to compel the attendance of witnesses and to require the production of books, records, or documents. (f) Prior to the conference or hearing, any party may request that a summons be issued to secure the attendance of an in-state witness.

  1. At least 21 days prior to the conference or hearing, the party requesting a summons shall provide, in writing, the name and address of the witness along with an explanation as to why a requested witness’s testimony is relevant to the proceeding. 2.Upon receipt of this information, should the complaint hearing officer or subcommittee chairperson determine testimony of the requested witness is not relevant, the party's request for a witness summons may be denied. (g) Prior to a conference or hearing, the respondent may enter into a consent agreement regarding the alleged violation and agree to pay a civil penalty and/or agree to any other sanctions as issued by the CRRB. (4) The complaint conference or hearing shall be an adjudicatory hearing that takes place before a complaint hearing officer or CRRB Subcommittee. The hearing officer or CRRB Subcommittee will conduct the conference or hearing and determine its course, including the order and manner in which the parties may offer information. Depending on the subject matter, complaint conferences/hearings maybe open to the public. (a) Oaths shall be administered to the parties, all relevant issues shall be considered, and all evidence determined necessary to decide the issues raised in the complaint and the response will be requested, received, and made part of the conference or hearing record. (b) All CORI complaint conferences and hearings shall be subject to the provisions of M.G.L. c. 30A, which governs adjudicatory hearing procedures. (c) All CORI complaint conferences and hearings shall be subject to the informal rules of adjudicatory procedure under 801 CMR 1.02: Informal/Fair Hearing Rules. (d) All complaint conferences and hearings shall be electronically recorded. (e) At complaint conferences and hearings, the complaining witness and the respondent may present testimony and evidence on their own behalf. (f)Following a complaint conference, the complaint hearing officer shall issue a recommendation on which the CRRB shall vote at its next formal meeting. Board findings and orders may be publicly posted. All identifying information of the complaining witness shall be redacted prior to such posting. (g) Following a complaint hearing, the subcommittee shall issue a written “Decision and Order” stating whether there was a violation of the CORI law or 803 CMR 2.00, what civil penalty, if any, and what sanctions, if any, will be imposed. All identifying information of the complaining witness shall be redacted prior to such posting. (5) If any individual involved in a conference or hearing is speech impaired, hearing impaired, or cannot speak or understand the English language, that individual shall be entitled to have translation services present at the conference or hearing. 6/11/21803 CMR - 22

803 CMR: DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES

2.27 continued

2.27: continued (a) In order to obtain the services of a translator, the individual shall notify DCJIS upon the filing of a complaint, upon providing a complaint response, or at least 15 days prior to the hearing or conference. (b) Any person may also provide a translator. If a person chooses to provide a translator, the person shall notify DCJIS as soon as reasonably possible prior to the conference or hearing. At that time, the person shall provide the qualifications of the translator to DCJIS, which shall approve the translator prior to the conference or hearing. (c) If an individual requests a translator pursuant to 803 CMR 2.00, DCJIS shall arrange for the services of such a translator and shall notify the complaining witness and respondent of the identity of the translator within a reasonable amount of time prior to the conference or hearing. (d) The CRRB may order any person failing to appear after a request for translation services to pay the costs of the translator.

2.28 The Criminal Record Review Board

2.28: The Criminal Record Review Board (1) The CRRB is an 18-member Board, created pursuant to M.G.L. c. 6, § 168(a), that shall meet regularly to review complaints and investigate incidents involving allegations of statutory and regulatory CORI violations. (2) The CRRB shall be consulted concerning the adoption of rules and regulations for the implementation, administration, and enforcement of M.G.L. c. 6, §§ 168 through 178A, and the collection, storage, access, dissemination, content, organization, and use of criminal offender record information by requestors. (3) CRRB shall have the authority to: (a) dismiss a CORI complaint; (b) appoint a CRRB member, three-member subcommittee, or hearing officer to conduct hearings or conferences of CORI violation complaints; (c) issue summonses to compel the attendance of witnesses and require their testimony at hearings or conferences; (d) require the production of books, records, and documents for hearings or conferences; (e) administer oaths at hearings or conferences; (f)order any party who fails to appear at a conference or hearing, after a request for translation services, to pay the costs of the translator; (g) remand a complaint presented to it for additional fact finding; (h) hear complaints and investigate any incidents alleging violations of M.G.L. c. 6, §§ 168 through 178A; (i) hear complaints and investigate any incidents alleging violations of DCJIS or CRRB rules or regulations; (j)enter into consent agreements regarding alleged violations of the CORI laws and regulations; (k) revoke access to CORI; (l) impose civil fines of up to $50,000 for each knowing CORI violation; and (m)refer any complaint to state or federal criminal justice agencies for criminal investigation.

2.29 Severability

2.29: Severability If any provision of 803 CMR 2.00, or the application thereof, is held to be invalid, such invalidity shall not affect the other provisions or the application of any other part of 803 CMR 2.00 not specifically held invalid, and to this end, the provisions of 803 CMR 2.00 and the various applications thereof are declared to be severable. REGULATORY AUTHORITY 803 CMR 2.00: M.G.L. c. 6, §§ 167A and 172; M.G.L. c. 30A. 6/11/21803 CMR - 22.1

Continue your research in ChatGPT or Claude

Connect Omnilex to search the legal corpus from your AI assistant.