950 C.M.R. 33.17
In deciding whether disclosure of personal data will constitute an invasion of personal privacy, agencies shall
consider the following examples:
(1) Disclosure without the consent of the data subject in the following situations is usually not an invasion of personal privacy unless the disclosure would clearly violate standards of ordinary decency:
Disclosure of routine correspondence including without limitation applications for benefits under government
programs.
Disclosure of complaints where disclosure is accompanied by a statement as to whether any findings have
been made on the complaint and what those findings are.
(2) Disclosure without the consent of the data subject which is not authorized by statute or regulation in the following situations usually is an invasion of personal privacy:
Disclosure of the resume of or evaluative materials on an applicant for employment. Such materials are
personnel information excluded from the definition of public records whether or not disclosure would otherwise constitute an invasion of personal privacy.
Disclosure of census information in any non-aggregated from which permits association of specific
information with specific individuals.