- (1) An agency that receives personal data as a result of a disclosure authorized by 101 CMR 16.00 shall use and hold the data in a manner consistent with federal and state laws, and shall not disclose it to another party unless legally authorized.
- (2) Reasonable efforts shall be made to limit the access to and use and disclosure of personal data authorized by 101 CMR 16.00 to the minimum necessary to accomplish the purpose for which the access, use, or disclosure is required and permitted.
REGULATORY AUTHORITY
101 CMR 16.00: M.G.L. c. 6A, § 16