Inadvertent Records Release | March 16, 2023

March 16, 2023

The Cannabis Control Commission (Commission) is contacting you to make you aware of an inadvertent release of agency documents that may have contained your name, residential address, email address, phone number, and/or date of birth.

While the information disclosed is in fact a public record that may otherwise be available for distribution in response to a public records request, its disclosure in this event was indeed inadvertent.

On March 8, 2023, the Commission fulfilled a Public Records Request and, as part of that production, released documents, which included the following fields:

• Names
• Residential Addresses
• Phone Numbers
• Email Addresses
• Dates of Birth

The release did not involve Social Security numbers, driver’s license information, or financial account details for any members of the public. Generally, the information pertained to former and current Marijuana Establishment and Medical Marijuana Treatment Center Agents.

Immediately upon discovering this error, the Commission notified the requestor of the issue, sought their cooperation in deleting files containing this information, and took proactive steps to prevent any further distribution. The requestor agreed to delete the identified files.

The Commission has consulted with the Office of the Attorney General and the Office of Consumer Affairs and Business Regulation to determine what actions the agency may take in response to this production. Although this notice is not required by law, the Commission believes, for the sake of transparency, it is important you be aware of this disclosure and the efforts taken to contain any distribution.

While the Commission was not the victim of any targeted data breach or attack, and protected Personal Information was not disclosed, you may still wish to take certain precautions in response to this notification. For instance, you can find important and helpful information through the Office of Consumers Affairs and Business Regulation’s website.

The Commission recognizes this notice may raise concern and takes seriously its duty to protect residents’ information. In addition to the immediate steps mentioned above, the Commission is reviewing Standard Operating Procedures and training for public records production to ensure this situation does not recur.

If you have questions or concerns about the impacts of this disclosure, contact the Commission by emailing Commission@CCCMass.com with the subject line, “Inadvertent Records Release,” or calling (774) 415-0200.