965 CMR, § 2.02
As used in 965 CMR 2.00, unless the context otherwise requires, the terms set forth below are defined as follows:
Audit Trail shall mean a record by the holder of certain persons or entities specified in 965 CMR 2.04(13) who obtain access to personal data and shall include the identity of such persons or entities gaining access and their intended use of such data.
Authorized Representative shall mean an agent expressly appointed by the data subject, including, but not limited to, an attorney at law.
Collects shall mean gathers, obtains, or receives personal data.
Data Subject shall mean an individual to whom personal data refers. This term shall refer only to human beings, and shall not include corporations, corporate trusts, partnerships, limited partnerships, trusts, other similar entities, entities subject to audit pursuant to M.G.L. c. 11, §§ 12 and 13, or schools subject to review pursuant to M.G.L. chs. 75C, 75D, and 93, § 20A.
Department of the State Auditor or Department shall mean the agency of government created by M.G.L. c. 11, § 2.
Disseminates shall mean transfers personal data, for any purpose, from a holder to any other agency, person, or entity.
Holder shall mean:
(a) The Department of the State Auditor or
(b) Any person or entity which contracts with or has an agreement with the Department whereby personal data is held as a part or as a result of performing a governmental or public function or purpose; or
(c) Any subcontractor of a holder described above who holds personal data as a part of or as a result of performing a governmental or public function or purpose.
Holds shall mean collects, stores, maintains, disseminates, or uses, whether manually, mechanically, or electronically.
Maintains shall mean stores, updates, or corrects personal data.
Personal Data shall mean any information concerning an individual which, because of a personal identifier including, but not limited to, name, identifying number, mark, or description that can be readily associated with a particular individual; provided, however, that such information is not contained in a public record as defined in M.G.L. c. 4, § 7 clause 26, and not referred to in 965 CMR 2.02.
Personal Data System shall mean a system of records containing personal data which is organized in such a way that the data is retrievable by the identity of the data subject.
Personal Identifier shall mean any element of data which may be used to determine a person's identity, either by itself or when combined with other data available to the holder. Such data may include, but is not limited to: name, address, social security number, date of birth, race, zip code, mother's given name or maiden name, or other similar device.
State Auditor shall mean Auditor of the Commonwealth or a designated member of the Department.
965 CMR, § 2.02