1. (1) Any TND Organization seeking designation from the Department as a bargaining representative must maintain a data security policy, which it must file with the Department as part of its Request for Designation. Such policy must:

   1. (a) provide a statement of compliance outlining steps taken to satisfy the specifications provided by the Department pursuant to 456 CMR 24.15;
   2. (b) be made available to all Active TNDs; and
   3. (c) indicate that any information provided to the TND Organization may be securely shared

with the Department for purposes of administration of 456 CMR 24.00.

1. (2) For purposes of these regulations, personal information shall include but not be limited to the TND’s first and last name, or first initial and last name, in combination with any one or more of the following data elements; provided, however, that personal information shall not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public:

   1. (a) Social security number;
   2. (b) Driver’s license number or other state-issued identification number;
   3. (c) Personal phone number;
   4. (d) Home address; and
   5. (e) Email address.