Every holder, as that term is defined in section one of chapter sixty-six A, shall, on or before September first, nineteen hundred and seventy-six, or upon the subsequent establishment, termination, or change in the character of such personal data system, file with the state secretary a notice which shall specify:--
(a) the name of the system;(b) the nature and purpose of the system;(c) the number of persons on whom data are or are expected to be maintained;(d) the categories of data maintained, or to be maintained, indicating which categories are or will be stored in an automated personal data system;(e) the agency's policies and practices regarding data storage, retention of data, and disposal thereof;(f) the categories of data sources;(g) a description of types of uses made or to be made of data, including a description of all classes of users of such data;(h) a description of the actions taken to comply with chapter sixty-six A; and(i) the name, title, and business address of the individual immediately responsible for the system. The state secretary shall, at least once annually, publish a report containing all of the notices filed pursuant to this section during said year. Such report and the separate notices shall be a public record as defined in paragraph twenty-six of section seven of chapter four.
Mass. Gen. Laws ch. 30, § 63