After Goodridge: the Potential of Equal Protection Challenges Under the Massachusetts Constitution Involving Non-Economic, Personal InterestsPosted: February 19, 2020
Massachusetts courts apply an enhanced version of rational basis review where regulations infringe on non-economic, personal interests. In light of Goodridge v. Department of Public Health, 440 Mass. 309 (2003), this analysis has the potential to support constitutional challenges on equal protection grounds to two existing Massachusetts statutes related to families. They are: (1) M.G.L. c. 119, § 39D, the grandparent visitation statute; and (2) M.G.L. c. 209C, § 10, custody of children born out of wedlock.
Equal Protection and Enhanced Rational Basis Review in Massachusetts
Equal protection requires “that all persons in the same category and in the same circumstances be treated alike.” Opinion of the Justices, 332 Mass. 769, 779-80 (1955). The standard of review in Massachusetts for equal protection claims that do not involve a fundamental right or suspect class is rational basis review. See Tobin’s Case, 424 Mass. 250, 252-53 (1997).
The Massachusetts Constitution requires that a regulation be “rationally related to the furtherance of a legitimate State interest.” Mass. Fed’n of Teachers, AFT, AFL-CIO v. Bd. of Educ., 436 Mass. 763, 777 (2002) (quoting Chebacco Liquor Mart, Inc. v. Alcoholic Beverages Control Comm’n, 429 Mass. 721, 722 (1999)). However, the Supreme Judicial Court (SJC) has determined that in cases involving non-economic regulations, Massachusetts’s Constitution “may guard more jealously against the exercise of the State’s police power” than the Federal Constitution. That is, the SJC has applied an enhanced version of rational basis review where classifications affect personal, non-economic interests that are not considered fundamental. See Friedman, supra note 2.
The most prominent example of this analysis is Goodridge. There, same-sex couples alleged that the denial of their access to marriage licenses and the status of civil marriage violated the Massachusetts Constitution. The Court held that this exclusion violated equal protection. The Court concluded that “[t]he marriage ban works a deep and scarring hardship on a very real segment of the community for no rational reason,” noting that “[t]he absence of any reasonable relationship between” the exclusion of same-sex couples from marriage and the protection of the general welfare. Goodridge, 440 Mass. at 341 (emphasis added).
As exemplified by Goodridge, enhanced rational basis review under the Massachusetts Constitution requires that there be an actual, rather than merely a conceivable, connection between the government’s legitimate regulatory interest and the imposed regulation, and that the connection be reasonable. See Friedman, supra note 2 at 418. Moreover, Massachusetts’s rational basis review for equal protection claims, “requires that an impartial lawmaker could logically believe that the classification would serve a legitimate public purpose that transcends the harm to the members of the disadvantaged class.” Goodridge, 440 Mass. at 330 (emphasis added) (internal quotations omitted) (quoting English v. New England Med. Ctr., Inc., 405 Mass. 423, 429 (1989)).
Under this enhanced rational basis review, Massachusetts’s grandparent visitation statute, as-applied, arguably violates equal protection under the Massachusetts Constitution.
M.G.L. c. 119, § 39D states in relevant part:
If the parents of an unmarried minor child are divorced, married but living apart, under a temporary order or judgment of separate support, or if either or both parents are deceased, or if said unmarried minor child was born out of wedlock whose paternity has been adjudicated by a court of competent jurisdiction or whose father has signed an acknowledgement of paternity, and the parents do not reside together, the grandparents of such minor child may be granted reasonable visitation rights . . . upon a written finding that such visitation rights would be in the best interest of the said minor child . . . .
The statute, as interpreted by Blixt v. Blixt, 437 Mass. 649 (2002), essentially imposes two conditions for grandparents to seek visitation: that the parents are separated or divorced; and that the grandparents have either a significant preexisting relationship with the grandchildren, or that the grandchildren will suffer significant harm absent visitation with the grandparents. Under Blixt, the second condition amounts to a heightened pleading requirement that grandparents must meet in order to seek visitation.
As-applied, the law discriminates against grandparents of grandchildren whose parents are not divorced or separated with respect to their ability to seek visitation when it is in the grandchildren’s best interest. The statute creates two classes of grandparents: (1) those who can seek visitation because the parents are divorced or separated; and (2) those who cannot because the parents are not divorced or separated. The classes are similarly situated because both sets of grandparents would presumably seek visitation regardless of the parents’ marital or living status on the grounds that it would be in the best interests of their grandchildren.
Applying enhanced rational basis review, the statutorily-created classifications of grandparents do not rationally serve a legitimate public purpose that transcends the harm in denying the opportunity for grandparents of parents who are not separated or divorced from seeking visitation when it is in the grandchildren’s best interest. Three potential rationales for the discrimination are: preserving judicial resources; preventing infringement of parental rights; and safeguarding the welfare of children and giving deference to Blixt’s rationale “that the burden of the traumatic loss of a grandparent’s significant presence may fall most heavily on the child whose unmarried parents live apart” in using parental status to distinguish between classes of grandparents. 437 Mass. at 664; see Goodridge, 440 Mass. at 331. Each of these rationales likely fails enhanced rational basis scrutiny.
First, the requirements for visitation would continue to preserve judicial resources even if grandparents of parents who are not separated or divorced petitioned for visitation because the heightened pleading requirements would serve as a gatekeeping mechanism. Second, the heightened pleading requirements would protect the rights of parents to make child-rearing decisions because only grandparents who can demonstrate that there was a significant preexisting relationship with the grandchildren, or that the grandchildren will be significantly harmed, could seek visitation. Finally, denying certain grandparents the right to seek visitation when it is in the grandchildren’s best interests would not safeguard children’s interests, especially when Blixt acknowledges that there may be children whose parents are not divorced or separated who would be harmed without visitation with their grandparents. See 437 Mass. at 664. It is precisely these factual circumstances that would serve as the basis for an as-applied challenge to the statute, where a court can reconsider the law in the context of an actual dispute. See Wash. State Grange v. Wash. State Republican Party, 552 U.S. 442, 449-50, 457-58 (2008).
Custody of Children Born Out of Wedlock
Similarly, Massachusetts’s statute pertaining to custody of children born out of wedlock arguably violates equal protection under the Massachusetts Constitution pursuant to enhanced rational basis review analysis.
M.G.L. c. 209C, § 10(a)-(b) provides in relevant part:
(a) Upon or after an adjudication or voluntary acknowledgment of paternity, the court may award custody to the mother or the father or to them jointly . . . as may be appropriate in the best interests of the child . . . . In awarding the parents joint custody, the court shall do so only if the parents have entered into an agreement pursuant to section eleven or the court finds that the parents have successfully exercised joint responsibility for the child prior to the commencement of proceedings pursuant to this chapter and have the ability to communicate and plan with each other concerning the child’s best interests.
(b) Prior to or in the absence of an adjudication or voluntary acknowledgment of paternity, the mother shall have custody of a child born out of wedlock. In the absence of an order or judgment of a probate and family court relative to custody, the mother shall continue to have custody of a child after an adjudication of paternity or voluntary acknowledgment of parentage.
As-applied, the law denies unwed fathers not cohabitating with the mother, the right to equal protection by discriminating against these fathers as compared to divorcing fathers when joint legal custody is in the child’s best interest. Pursuant to M.G.L. c. 208, § 31, divorcing fathers are presumed to have joint legal custody of a child until otherwise ordered and need only prove that it is in the child’s best interest for it to be awarded. Whereas, pursuant to M.G.L. c. 209C, § 10(a)-(b), unwed fathers not cohabitating with the mother are not presumed to have joint legal custody and must meet additional and burdensome requirements to have it awarded. The fathers are similarly situated because both groups are men whose parentage has either been assumed due to their marital status or established by adjudication or acknowledgment, and whose children would presumably benefit from their involvement in their life.
To be awarded joint legal custody absent an agreement with the mother, in addition to satisfying the best interest standard, an unwed father not cohabitating with the mother is required to prove that he and the mother “have successfully exercised joint responsibility for the child prior to the commencement of proceedings;” and he and the mother have “the ability to communicate and plan with each other concerning the child’s best interests.” M.G.L. c. 209C, § 10(a). A divorcing father, however, enjoys “temporary shared legal custody of any minor child of the marriage” and he need only ultimately prove that an award of joint custody is in the child’s best interest. M.G.L. c. 208, § 31.
Under an enhanced rational basis review analysis, the different treatment of unwed fathers not cohabitating with the mother and divorcing fathers pursuant to M.G.L. c. 209C, § 10(a)-(b) likely does not rationally serve a legitimate public purpose that transcends the harm in requiring that unwed fathers meet more onerous requirements. Potential public purposes that may be advanced to justify the discrimination are: preserving judicial resources; and safeguarding the wellbeing of children.
First, judicial resources would not be further expended if both classes of fathers were afforded the same presumption and held to the same standard to be awarded joint legal custody. In fact, judicial resources may be conserved if all fathers were afforded the presumption and only the child’s best interest governed. Second, the wellbeing of children is not enhanced by requiring that unwed fathers not cohabitating with the mother meet more burdensome requirements or be denied a presumption of joint legal custody because an analysis of the child’s best interest should afford all children the same protection, especially where there are divorcing fathers who do not have a history of successfully exercising joint responsibility for the child and cannot communicate or cooperate with the mother. If children of unwed fathers not cohabitating with the mother are afforded greater protections than children of divorcing fathers, this likely violates “the Commonwealth’s strong public policy to abolish legal distinctions between marital and nonmarital children in providing for the support and care of minors.” Goodridge, 440 Mass. at 325 (citations omitted); see M.G.L. c. 209C, § 1 (“Children born to parents who are not married to each other shall be entitled to the same rights and protections of the law as all other children.”). Further, these additional and burdensome requirements may discourage fathers whose children would benefit from their participation in important decisions from pursuing these rights. See Cuadra, supra note 6 at 634-35.
Looking to Goodridge as a roadmap for an enhanced rational basis review analysis, some Massachusetts statutes impacting personal interests, like a grandparent’s ability to pursue visitation or an unwed father’s ability to participate in important child rearing decisions, may well be vulnerable to challenges on equal protection grounds. This kind of judicial review recognizes that there may be instances in which legislative classifications draw lines that infringe on personal interests without adequate justification. This review does not mean every statute that differentiates among significant personal interests will fail—just that the Commonwealth must be able to articulate a reason for the discrimination that has a basis in fact. On the right facts, an enhanced rational basis review analysis has the potential to push the legal landscape to better serve families by pushing the Commonwealth either to justify the discrimination or abandon distinctions that no longer make sense.
Steven E. Gurdin is a partner at Fitch Law Partners LLP, concentrating his practice in and frequently presenting on family law and probate litigation matters. He represents clients in all aspects of family law including, divorce proceedings, paternity actions, child removal actions, modification and contempt actions, grandparent visitation cases, and alimony and child support issues.
Kelly A. Schwartz is an associate at Fitch Law Partners LLP. Her practice is in family law, which includes matters involving divorce, child custody, alimony, child support, and asset division.
 Special thanks to Lawrence Friedman, Professor of Law at New England Law, for his input and support.
 See Blue Hills Cemetery, Inc. v. Bd. of Reg. in Embalming & Funeral Directing, 379 Mass. 368, 373 n.8 (1979); Coffee-Rich, Inc. v. Comm’r of Pub. Health, 348 Mass. 414, 421-22 (1965); Lawrence Friedman, Ordinary and Enhanced Rational Basis Review in the Massachusetts Supreme Judicial Court: A Preliminary Investigation, 69 Albany L. Rev. 415 (2006) (discussing history of Massachusetts cases in which courts applied less deferential rational basis review under the Massachusetts Constitution); see also Goodridge, 440 Mass. at 328 (“The Massachusetts Constitution protects matters of personal liberty against government incursion as zealously, and often more so, than does the Federal Constitution, even where both Constitutions employ essentially the same language.”), n.18 (“We have recognized that our Constitution may more extensively protect individual rights than the Federal Constitution in widely different contexts.”).
 See Friedman, supra note 2 at 419-22, 440.
 Of note, Massachusetts House Bill No. 1534, which was submitted in the current session on January 18, 2019, provides that any grandparent may file an original action for visitation rights if it is in the child’s best interest and if, among other conditions, “the child is living with biological parents, who are still married to each other, whether or not there is a broken relationship between either or both parents of the minor and the grandparent and either or both parents have used their prenatal authority to prohibit a relationship between the child and the grandparent.”
 See Dep’t of Revenue v. C.M.J., 432 Mass. 69, 77 (2000) (determining that under M.G.L. c. 209C, § 10(b), an unwed father cohabitating with the mother and providing support to his children was presumed a custodial parent even absent a court order regarding custody); Trial Court Judgment of Dismissal and Memorandum of Decision (Gibson, J. Nov. 5, 2013); see also Com. v. Gonzalez, 462 Mass. 459, 464 & n.12 (2012); 14B Mass. Prac., Summary of Basic Law, § 8:264 (5th ed. 2019) (“[I]f the father is living with the mother and the child or children born out of wedlock, the mother’s custody is not sole custody, but joint custody with the father.”) & nn.4-5.
 See Bernardo Cuadra, Family Law–Maternal and Joint Custody Presumptions for Unmarried Parents: Constitutional and Policy Considerations in Massachusetts and Beyond, 32 W. New Eng. L. Rev. 599, 620-22 (2010) (footnote notation omitted) (discussing the difference in Massachusetts between divorcing parents and unmarried parents with regard to the presumption of joint legal custody).
 Department of Revenue v. C.M.J. did not, however, address whether unwed fathers cohabitating with the mother must also meet the additional requirements outlined in M.G.L. 209C, § 10(a) to be awarded joint legal custody.
 See Cuadra, supra note 6 at 633-34 (“Joint legal custody has been shown in the context of divorce to increase a father’s involvement with his child, including parenting time and overnights. Subsequent research suggests the same outcome for unwed fathers.”).
 See Goodridge, 440 Mass. at 330; see also Cuadra, supra note 6 at 639 (suggesting that Massachusetts’s different treatment of divorcing and unwed fathers should be examined pursuant to a rational basis review where the statute would “be scrutinized with something greater than sweeping deference.”) & n.251 (citing and quoting Goodridge).
 See Goodridge, 440 Mass. at 331; Blixt, 437 Mass. at 663; Trial Court Judgment, supra note 5.
Fair Housing Enforcement in the Age of Digital Advertising: A Closer Look at Facebook’s Marketing AlgorithmsPosted: February 19, 2020
The increasing use of social media platforms to advertise rental opportunities creates new challenges for fair housing enforcement. The Fair Housing Act, 42 U.S.C. §§ 3601-19 (“FHA”) makes it unlawful to discriminate in the sale or rental of housing on the basis of race, color, religion, sex, familial status, national origin, and disability (“protected classes”). The FHA also prohibits discriminatory advertising, including distributing advertisements in a way that denies people information about housing opportunities based on their membership in a protected class. Accordingly, advertisers and digital platforms that intentionally or unintentionally cause housing advertisements to be delivered to users based on their membership in a protected class may be liable for violating the FHA.
In March 2018, in response to what they perceived to be discriminatory advertising on Facebook, the National Fair Housing Alliance (“NFHA”) and several housing organizations filed suit in federal court in New York City. The lawsuit alleged that Facebook’s advertising platform enabled landlords and real estate brokers to prevent protected classes from receiving housing ads. Facebook settled the suit on March 19, 2019. As part of the settlement, Facebook agreed to make a number of changes to its advertising portal so that housing advertisers can no longer choose to target users based on protected characteristics such as age, sex, race, or zip code. Facebook also committed to allow experts to study its advertising platform for algorithmic bias. It remains to be seen whether this agreement goes far enough in curtailing discriminatory advertising practices, as Facebook is confronting further enforcement action from a government watchdog in respect to similar issues. Moreover, a recent research study found that Facebook’s digital advertising platform may still lead to discriminatory outcomes despite changes already made.
On August 13, 2018, the Assistant Secretary for Fair Housing and Equal Opportunity filed a complaint with the Department of Housing and Urban Development (“HUD”) alleging that Facebook is in violation of the FHA. The Office of Fair Housing and Equal Opportunity determined in March, 2019 (the same time as the settlement agreement with NFHA) that reasonable cause exists and issued an official Charge against Facebook.
Notwithstanding these suits and administrative actions, it remains that, for fair housing claims to survive in court against media giants like Facebook, HUD and future plaintiffs must first successfully argue that Facebook is not protected by the Communications Decency Act (“CDA”).
Communications Decency Act
Congress enacted the CDA, in part, to prohibit obscene or indecent material from reaching children on the internet, and also to safeguard internet ingenuity. What was meant as a protectionist measure for the young, impressionable, and inventive, however, evolved into a powerful defense tool used by web applications, like Facebook. Section 230 of the CDA immunizes providers of interactive computer services against liability arising from content created by third parties. To overcome the CDA hurdle, litigants have to demonstrate that Facebook “materially contributes” to the management of content on their platform. Fair Hous. Counsel of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157, 1163 (9th Cir. 2008). While many online service providers have successfully used Section 230 in their defense, the protections offered to internet service providers are not absolute.
The CDA contains requirements that restrict the application of Section 230. The language in Section 230 prevents a “provider or user of an interactive computer service” from being “treated as the publisher or speaker of any information” that is exclusively “provided by another content provider.” The U.S Court of Appeals for the Ninth Circuit concluded that publishing amounts to “reviewing, editing, and deciding whether to publish or to withdraw from publication third-party content.” Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1102 (9th Cir. 2009). The idea is that website operators would no longer be liable for deciding to edit or remove offending third-party content.
Based on this reading, the law immunizes only “certain internet-based actors from certain kinds of lawsuits.” The statute, as discussed in Roommates.com, LLC, 521 F.3d at 1162, provides no protection to online content that was created by a website operator or developed – in whole or in part – by the website operator. Courts have reaffirmed the CDA’s limited scope to protect self-policing service providers that act as “publishers” of third-party content, as opposed to liability against all categories of third-party claims (i.e. violations of civil rights laws at issue in this article). Barnes, 570 F.3d at 1105; Accord Doe v. Internet Brands, Inc., 824 F.3d 846, 852-53 (9th Cir. 2016). These limitations are crucial. If a plaintiff can show that Facebook developed the content on its platform in whole or in part or, content aside, that Facebook produces discriminatory outcomes via mechanisms on its platform developed by Facebook, it may be excluded from Section 230 immunity.
Optimization Discrimination Study
In a recent study by researchers at Northeastern University,  evidence of Facebook’s control over ad dissemination demonstrates how Facebook manages output of information based on headlines, content, and images, using “optimization.” In short, the Study set out to determine how advertising platforms themselves play a role in creating discriminatory outcomes. The Study highlighted the mechanisms behind, and impact of, ad delivery, which is a process distinct from ad creation and targeting. For example, the Study found that inserting musical content stereotypically associated with Black individuals was delivered to over 85% Black users, while musical content stereotypically associated with White people was delivered to over 80% White users. The researchers concluded that “ad delivery process can significantly alter the audience the ad is delivered to compared to the one intended by the advertiser based on the content of the ad itself.” The study also simulated marketing campaigns and found that Facebook’s algorithms “skewed [ad] delivery along racial and gender lines,” which are protected categories under the FHA. These results suggest that, even if a housing advertiser can no longer choose to explicitly target ads based on attributes like age, gender, and zip code, a housing advertiser could still use Facebook’s marketing platform to steer ads away from protected segments of users by manipulating the content of the ad itself. Moreover, the platform may cause such discriminatory outcomes regardless of whether or not the advertiser intended such results.
Case Law Interpreting CDA
The Study’s findings set the foundation for evaluating Facebook’s control over the manipulation of content and ad distribution on their platform. Two seminal cases, Zeran v. America Online, Inc., 129 F.3d 327 (4th Cir. 1997) and Roommates.com, LLC, 521 F.3d 1152 (2008), outline tests to determine when online platforms are considered content managers versus content providers. The Study makes a strong case for why Facebook is a content manager, eliminating immunity under Section 230. Litigants can also persuasively distinguish their arguments against Facebook from a recent decision interpreting Section 230 liability. In Herrick v. Grindr, LLC, 306 F. Supp.3d 579 (2018), the U.S. Court of Appeals for the Second Circuit ruled in favor of Grindr (a same-sex dating application) on all but one of the plaintiff’s claims. The plaintiff had argued that Grindr failed to monitor and remove content created by the plaintiff’s ex-partner, and the court concluded that Section 230 barred several of his claims because they were “inextricably related” to Grindr’s role in editing or removing offending content (which is protected conduct under the CDA). Herrick v. Grindr, LLC, 306 F. Supp.3d 529, 588. The Supreme Court denied Herrick’s petition to review on October 7, 2019.
A major distinguishing feature between the facts in Herrick and the Study’s findings against Facebook is how the two websites handle third-party content. In Herrick, the claim against Grindr was based on Grindr’s failure to remove content generated by a third-person. The issue with Facebook exists in the use of optimization algorithms. The point is that discriminatory outcomes are ultimately a result of Facebook’s manipulation of ad delivery for the purpose of reaching certain groups at the exclusion of others in protected categories. Facebook’s tools go well beyond the function of “neutral assistance,” because its platform directs advertisements to sectors of people using discriminatory preferences created by Facebook, not third-parties.
If it can be successfully argued that Facebook is not immune from suit under the CDA, housing advertisers and digital platforms that intentionally or unintentionally target ads to certain groups of users based on their membership in a protected class may be sued for violating the FHA. As described above, the Facebook Study determined that housing advertisers may still be able to use Facebook’s marketing platform to steer housing ads away from protected classes of tenants by manipulating the content of the ad. In such circumstances, the housing advertiser who uses the ad’s content as a covert method of discriminatory distribution may be violating the FHA. The digital platform may also be liable either because they are actively involved in facilitating the selective distribution of ads, or as an agent vicariously liable for the advertiser’s conduct.
Even if it cannot be shown that a housing advertiser intended to discriminate, if the ad delivery mechanism has the effect of distributing housing ads in a discriminatory way, the advertiser and platform may still be liable for violating the FHA under a theory of disparate impact. Disparate impact discrimination occurs when a neutral policy or practice has a discriminatory effect on members of a protected class. See Texas Dep’t of Hous. & Cmty. Affairs v. Inclusive Communities Project, Inc., 135 S. Ct. 2507, 2523 (2015); see also 24 C.F.R. § 100.500. A three-part burden shifting framework is used to evaluate liability. Id. Protected class members have the initial burden of establishing that a practice has a disproportionate adverse effect on a protected class. To meet this initial burden, a plaintiff must “allege facts at the pleading stage or produce statistical evidence demonstrating a causal connection” between the policy and the disparate impact. Inclusive Communities, 135 S. Ct. 2507, 2523 (2015).
If a protected class member makes out a prima facie claim of disparate impact, the burden then shifts to the accused party to show that the practice is necessary to achieve a valid interest. See Robert G. Schwemm, Calvin Bradford, Proving Disparate Impact in Fair Housing Cases After Inclusive Communities, 19 N.Y.U.J. Legis. & Pub. Pol’y 685, 696-697 (2016). The protected class members then have an opportunity to show that the interest could be achieved through less discriminatory means. Id.
In the digital advertising context, protected class members would have the initial burden of showing that they were denied equal access to information about a housing opportunity as a result of a housing advertiser’s marketing campaign.
While the Facebook Study was able to demonstrate the potential for “skewed” ad delivery based on protected characteristics, further research is needed to determine how a plaintiff might marshal statistical evidence to support a particular claim. As the Facebook Study notes, without access to a platform’s “data and mechanisms” it may be difficult to assess whether or not a particular advertising campaign has led to discriminatory outcomes. Therefore, it may be challenging for adversely affected users to develop the necessary data at the pleading stage to make out a prima facie claim of disparate impact. This might explain why HUD is continuing to pursue its legal challenge against Facebook despite the remedial measures it has already agreed to undertake, including allowing research experts to study its advertising platform for algorithmic bias. In other words, HUD’s intent may be to better understand how Facebook’s ad delivery algorithm works now so it can limit its discriminatory impact.
Because digital advertising companies play an active role in the ad delivery process, it follows that a discriminatory distribution of ads could be attributed to the platform. While there are limited case decisions involving FHA liability and algorithmic decision-making programs, the court in Connecticut Fair Hous. Ctr. v. Corelogic Rental Prop. Sols, LLC, 369 F. Supp. 3d 362 (D. Conn. 2019), found that plaintiffs had pled sufficient facts to establish a causal connection between a tenant screening company’s alleged activity and unlawful housing denials to support a claim of disparate impact based on race. Id. at 378-379. The court found that the defendant had created and provided the automated screening process, suggested the categories by which the housing provider could screen potential tenants, made eligibility determinations, and sent out letters to potential tenants notifying them of these decisions. Id.
Digital advertising companies similarly create the marketing platform for housing advertisers to use, provide criteria from which to choose the users, and design and maintain the algorithms that decide to whom the ads will be delivered. Therefore, a sufficient nexus should exist between the advertising platform’s activity and the selective distribution of ads to support a disparate impact claim.
Housing providers and digital advertising platforms arguably have a “valid interest” in being able to effectively market their housing services, and ad delivery algorithms are an efficient way to reach relevant users. However, given the abundance of print and online advertising options available for housing advertisers that do not rely solely on ad delivery algorithms, such as Craigslist, Zillow, Trulia, and Apartments.com etc., less discriminatory means exist by which housing advertisers can successfully market their services.
HUD recently proposed a new disparate impact rule that would raise the bar even higher for plaintiffs bringing disparate impact claims and provide housing advertisers with a defense if a digital advertising platform’s algorithmic model was the cause of a discriminatory outcome. A number of tenant advocacy groups and other stakeholders, such as Harvard Law School’s Cyberlaw Clinic, have submitted comments opposing the proposed rule, arguing, among other concerns, that it would perpetuate discrimination by “significantly reduc[ing] incentives for algorithm users and vendors to test their tools for bias” contrary to the purpose of the FHA.
The FHA was designed to provide all home-seekers, who have the resources, with equal access to housing stock and opportunity. It seems clear that online platforms in the business of designing and maintaining their algorithms have an impact on large segments of protected populations. The tension between the need for more information to combat discriminatory algorithms and propriety interests remain. However, one important way to move forward is to balance these interests by staying within the bounds of the FHA, including incentives for platforms to evaluate their ad delivery tools for distribution bias, and ensure a more inclusive participation in the housing market for all social media users.
Nadiyah J. Humber is the Assistant Clinical Professor of Law and Director of the Corporate Counsel, Government, and Prosecution Clinical Externship Programs at Roger Williams University School of Law (“RWU”). RWU students earn academic credit externing for in-house legal offices of corporations, offices of prosecution, and government agencies in Rhode Island and beyond. Professor Humber teaches related seminars for each program on the role of one client entities and professional development through practice.
James Matthews is a Clinical Fellow in Suffolk Law School’s Accelerator Practice and Housing Discrimination Testing Program (HDTP) where he supervises law students in housing discrimination, landlord-tenant, and other consumer protection matters related to housing. Attorney Matthews also has significant teaching and professional presenting experience. He helps conduct fair housing trainings and presentations as part of HDTP’s community education and outreach. He also teaches an upper-level landlord-tenant course he developed which includes instruction on state and federal fair housing law.
 Nat’l Fair Housing Alliance, et al v. Facebook, Inc., No. 18 Civ. 2689, Complaint (detailing allegations), available at https://nationalfairhousing.org/wp-content/uploads/2018/03/NFHA-v.-Facebook.-Complaint-w-Exhibits-March-27-Final-pdf.pdf (last visited Jan. 13, 2020).
 National Fair Housing Alliance, Facebook Settlement, available at https://nationalfairhousing.org/facebook-settlement/ (last visited Jan. 20, 2020).
Assistant Sec’y of Fair Hous. & Equal Opportunity v. Facebook, Inc., No 01-18-0323-8, 1, Charge of Discrimination (detailing procedural history), available at https://www.hud.gov/sites/dfiles/Main/documents/HUD_v_Facebook.pdf (last visited Dec. 8, 2019).
 47 U.S.C. § 230(c) (2019).
 Brief of Internet, Business, and Local Government Law Professors as Amici Curiae Supporting the Respondents at 7 Homeaway.com & Airbnb, Inc. v. City of Santa Monica, Nos. 2:16-cv-06641-ODW, 2:16-cv-06645-ODW (9th Cir. May 23, 2018). See generally 47 U.S.C. §§ 230(b) (detailing policy goals for freedom on the internet).
 Brief of Internet, Business, and Local Government Law Professors as Amici Curiae Supporting the Respondents at 9, Homeaway.com & Airbnb, Inc. v. City of Santa Monica, Nos. 2:16-cv-06641-ODW, 2:16-cv-06645-ODW (9th Cir. May 23, 2018).
 47 U.S.C. §§ 230(c)(1), (f)(3) (2019).
 Brief of Internet, Business, and Local Government Law Professors as Amici Curiae Supporting the Respondents at 4, Homeaway.com & Airbnb, Inc. v. City of Santa Monica, Nos. 2:16-cv-06641-ODW, 2:16-cv-06645-ODW (9th Cir. May 23, 2018).
 Ali, Muhammad, et. al, Discrimination through Optimization: How Facebook’s Ad Delivery Can Lead to Skewed Outcomes, available at https://www.ccs.neu.edu/home/amislove/publications/FacebookDelivery-CSCW.pdf (last visited Dec. 6, 2019).
 Id. at 7 (explaining optimization on Facebook).
 See Nadiyah J. Humber, In West Philadelphia Born and Raised or Moving to Bel-Air? Racial Steering as a Consequence of Using Race Data on Real Estate Websites, 17 Hastings Race & Poverty L.J. 129, 153-155 (2020) (analyzing pertinent case law precedent for Section 230 immunity). There is a difference between online services that manage content (content provider) on their sites versus those that act more as a store house of information (service provider). Id.
 47 U.S.C. § 230(c) (2019).
 Bloomberg Law available at https://news.bloomberglaw.com/tech-and-telecom-law/grindr-harassment-case-wont-get-supreme-court-review
 47 U.S.C. § 230(c) (2019) (citing language from the act). Distinguishing O’Kroley v. Fastcase Inc., No. 3-13-0780, 2014 WL 2881526, at *1–2 (M.D. Tenn. June 25, 2014) (finding that providing search returns based on automated algorithms and user inputs does not constitute creating content).
 Muhammad, supra note 9.
 See supra note 2.
 See HUD’s Implementation of the Fair Housing Act’s Disparate Impact Standard, 84 Fed. Reg. 42853 (proposed Aug. 19, 2019) (for example, providing a defense where a “(2) plaintiff alleges that the cause of a discriminatory effect is a model, such as a risk assessment algorithm, and the defendant . . . (ii) Shows that the challenged model is produced, maintained, or distributed by a recognized third party that determines industry standards, the inputs and methods within the model are not determined by the defendant, and the defendant is using the model as intended by the third party . . .”)
 See Cathy O’Neil, Comment Regarding Docket No. FR-6111-P-02, http://clinic.cyber.harvard.edu/files/2019/10/HUD-Rule-Comment-ONEIL-10-18-2019-FINAL.pdf (last visited Jan. 20, 2020).
by Simone R. Liebman
In October, the Supreme Court of the United States heard argument in three cases that involve an unconventional division between the U.S. Department of Justice (DOJ) and the Equal Employment Opportunity Commission (EEOC), the federal agency authorized to interpret and enforce Title VII of the Civil Rights Act of 1964 (Title VII). These cases concern whether Title VII’s prohibition against bias “because of . . . sex” encompasses employment discrimination based on sexual orientation and transgender status. At the federal circuit court level, the EEOC argued that discriminating against an employee because of sexual orientation and gender identity amounts to sex discrimination under Title VII. When the cases were appealed to the Supreme Court, however, the DOJ took the extraordinary step of filing briefs on behalf of the EEOC, rather than permitting the agency to do so. Moreover, the DOJ urged the Court to review Title VII restrictively, contrary to the EEOC’s established position, and argued that the law does not explicitly prohibit sexual orientation or gender identity discrimination. The split in the federal government was further underscored when former federal officials, including the EEOC’s former chairs, commissioners, and general counsels, filed briefs arguing that sexual orientation and gender identity are intrinsically functions of sex and predicated on sex stereotypes.
The DOJ’s effort to override the authority and precedent of the EEOC is unique and historically noteworthy. And it provides a sharp contrast with the robust protections ensuring equal opportunities in employment available to Massachusetts employees through chapter 151B of the Massachusetts General Laws as enforced by the Massachusetts Commission Against Discrimination (MCAD). In enacting G.L. c. 151B in 1946, the Legislature granted the MCAD broad remedial powers and significant enforcement authority. The MCAD is a law enforcement agency with police powers designed to vindicate public rights. This legislative mandate has shaped judicial precedent, often putting Massachusetts at the vanguard in providing protection for employees. The statutory scheme includes a case process that is accessible to victims of discrimination regardless of socio-economic class and results in remedies designed to compensate past wrongs and deter future illegal workplace conduct. Due to the independent, prosecutorial nature of the agency, courts have found that victims of discrimination at the MCAD may proceed in situations where private litigants would otherwise have been barred. The current battle in the Supreme Court over who interprets Title VII, and whether the law should be broadly or restrictively construed, demonstrates the importance of the MCAD’s ability to act in its own name as a public law enforcement agency to protect civil rights in Massachusetts.
G.L. c. 151B grants the MCAD law enforcement authority.
Chapter 151B has always prohibited religious, race, national origin and ancestry discrimination. The Legislature acknowledged that discriminatory conduct is no less than a “harmful influence to our democratic institutions” and stated that “no well-informed, right thinking person can be oblivious or indifferent to this evil.” The elimination of discrimination, the Legislature declared, was a “corner-stone” upon which “world peace must be based.” With extraordinary legislative foresight, the statute authorized the MCAD at its inception to act as a civil prosecutor with significant enforcement authority. The legislation granted the MCAD the ability to conduct investigations; subpoena individuals; and issue complaints in its own name, even where no complaint has been filed by an aggrieved person. To ensure that the MCAD has the opportunity to identify trends and, if appropriate, take action, MCAD’s enforcement proceedings “shall, while pending, be exclusive,” taking precedence over any other type of recourse available. The statute imposed criminal sanctions, including imprisonment, where an employer willfully resists, prevents, impedes, or interferes with the MCAD in the performance of its statutory duties.
G.L. c. 151B Mandates Liberal Construction.
Of considerable importance, the legislation explicitly requires that G.L. c. 151B “be construed liberally for the accomplishment of the purposes” of the statute. This directive has resulted in significant protections for Massachusetts employees. In 2013, the Supreme Judicial Court held that G.L. c. 151B prohibits discriminating against an employee based on the employee’s association with an individual who is disabled, despite the absence of an explicit statutory prohibition against associational disability discrimination. In 2017, the SJC was the first state appellate court to conclude that under specific circumstances, an employer may be required to reasonably accommodate an employee with a debilitating medical condition that is treated through the use of medical marijuana. This year, the SJC concluded that an employer could be found to have engaged in illegal discrimination even when the discriminatory act in question was a lateral transfer, without any effect on the employee’s base salary, work responsibilities, or title. Each of these cases relied, in large part, on the long-standing mandate that G.L. c. 151B must be interpreted liberally to achieve its remedial purposes. In contrast, Title VII has no such mandate.
The MCAD’s case processing furthers the remedial goals of the statute.
There is no fee for filing a charge of discrimination with the MCAD and no requirement to obtain legal assistance in filing. If the investigating commissioner concludes that the case has “probable cause” to proceed, and the charging party does not hire private counsel, the matter is assigned to a Commission attorney to prosecute the matter in the public interest. Almost half of the cases found by the MCAD to have probable cause are assigned to a Commission attorney, who generally prosecutes the matter through public hearing at no cost to the complainant. After probable cause has been found, the Commission schedules a mandatory conciliation conference, again at no cost to the parties, in which an MCAD conciliator “will attempt to achieve a just resolution of the complaint and to obtain assurances that the Respondent will satisfactorily remedy any violations . . . and take such action as will assure the elimination of the discriminatory practices, or the prevention of their occurrence in the future.” Many cases are resolved at the conciliation conference, and include public interest relief such as training or policy change.
The case is certified to public hearing if the investigating commissioner determines that the public interest so requires, and a complaint is issued in the name of the Commission. It will then be heard by an MCAD hearing officer or a commissioner with expertise in G.L. c. 151B. If the employer is found to have violated the statute, the MCAD issues remedies designed to deter future illegal conduct, including a cease and desist order, a wide array of injunctive and affirmative relief such as training, reinstatement, policy change, and civil penalties, in addition to attorneys’ fees and compensatory damages to make the complainant whole. See Stonehill College v. Massachusetts Comm’n Against Discrimination, 441 Mass. 549, 563 (2004).
The MCAD may proceed where private litigants may not.
The MCAD’s “police powers” allow it to proceed with civil prosecutions in situations where a private litigant seeking redress in court could not. For example, where an employer files for bankruptcy during a civil proceeding, the automatic stay preventing the continuation of any civil proceeding generally applies. Cases pursued through the administrative process at the MCAD, however, fall within the exception to the automatic stay that allows governmental units to exercise police or regulatory power. Recognizing the “strongly felt” public policy against discrimination and the enforcement powers granted to the MCAD, the court in In re Mohawk Greenfield Motel Corp., 239 B.R. 1 (Bankr. D. Mass. 1999), held that the MCAD possessed police or regulatory power that qualified for the exception. The court further acknowledged that while back pay awards have a financial benefit to an employee who proves liability and is awarded victim-specific relief, the imposition of this remedy ensures future compliance and serves a public purpose: ensuring that the employer at issue “as well as others who might contemplate similar odious behavior, would be dissuaded from its future practice.” Id. at 9. Crucial to this decision exempting MCAD proceedings from the automatic stay was the recognition that it is fundamental to the MCAD’s authority to act in the public good to identify and remediate discriminatory conduct without excessive delay, and that “the benefit to the public arising from the continuing capability of MCAD to identify and sanction discriminatory behavior overshadows any associated pecuniary benefit to the victim of that discrimination.” Id. at 9.
Similarly, it was the public enforcement nature of the MCAD’s process that led the SJC in Joulé, Inc. v. Simmons, 459 Mass. 88 (2011), to permit the continued prosecution of an MCAD claim even where a binding pre-employment arbitration agreement required the victim of discrimination to arbitrate the claim rather than file a private right of action. Acknowledging that it is the MCAD and not the complainant that prosecutes the discrimination claim, the SJC concluded that mandatory arbitration clauses, otherwise applicable to private claims of workplace discrimination, do not and cannot bar administrative enforcement proceedings under G. L. c. 151B, § 5. Id. at 95-96. Given that over half of American private-sector nonunion employees are subject to mandatory arbitration procedures, the ability to proceed with a claim at the MCAD despite a binding arbitration agreement is of notable significance to employees in the Commonwealth. In Whelchel v. Regus Management Group, LLC, 914 F. Supp. 2d 83 (D. Mass. 2012), the substantial state interest in preserving the MCAD’s oversight role over discrimination claims led the court to refuse to allow an employer to remove an MCAD matter to federal court. These practical advantages to proceeding at the MCAD all flow from the Legislature’s recognition over seventy years ago that the main object of an MCAD proceeding is to “vindicate the public’s interest in reducing discrimination in the workplace by deterring and punishing, instances of discrimination by employers against employees.” Stonehill College, 441 Mass. at 563.
When the Legislature enacted G.L. c. 151B in 1946, no one could have foreseen the current divisiveness in the federal government, nor were there any federal civil rights protections or an EEOC in place to enforce them. That was not to come into play until 1964. But the Massachusetts Legislature created safeguards resilient enough to withstand the winds of change.
Rather than merely creating a forum through which private litigants resolve disputes, the Legislature recognized the need for an independent, public agency to promote and protect the fundamental right of Massachusetts citizens to obtain equal opportunities in the workplace.
Simone R. Liebman is Commission Counsel at the MCAD where she where she represents the agency in Massachusetts trial and appellate courts, files amicus briefs in select cases, assists with the drafting of policy and guidance, prosecutes cases through public hearing, and conducts affirmative litigation. This article represents the opinions and legal conclusions of its author and not necessarily those of the MCAD. Opinions of the MCAD are formal documents rendered pursuant to specific statutory authority.
 Altitude Express, Inc. v. Zarda, No. 17-1623 and Bostock v. Clayton County, Georgia, No. 17-1618 involve the question of whether sex discrimination under Title VII includes bias based on sexual orientation. R.G. & G.R. Harris Funeral Homes, Inc. v. Equal Employment Opportunity Commission, No. 18-107, addresses the question of whether it is a violation of Title VII to discriminate against an employee based on the employee’s transgender status or under a theory of sex stereotyping under Price Waterhouse v. Hopkins, 490 U.S. 228 (1989).
 http://www.abajournal.com/news/article/eeoc-doesnt-sign-us-brief-telling-supreme-court-that-transgender-discrimination-is-legal; https://www.reuters.com/article/us-otc-doj/once-again-trump-doj-busts-convention-splits-government-in-high-profile-employment-case-idUSKBN1AC32U.
 See G. L. c. 151B, inserted by St. 1946, c. 368, § 4. Since its enactment, G.L. c. 151B has been expanded to include other protected categories. Currently, G.L. c. 151B prohibits discrimination based on race, color, religious creed, national origin, disability, sex, gender identity, sexual orientation, genetic information, pregnancy (including a pregnancy-related condition), veteran status, age, and active military service. G.L. c. 151B, § 4. The MCAD also has jurisdiction over a host of other types of discriminatory conduct including retaliation, failure to accommodate disabilities, housing discrimination, certain inquiries regarding criminal records, parental leave, public accommodation discrimination, mortgage lending and credit discrimination, and certain types of education discrimination.
 REPORT OF THE SPECIAL COMMISSION RELATIVE TO THE MATTER OF DISCRIMINATION AGAINST PERSONS IN EMPLOYMENT BECAUSE OF THEIR RACE, COLOR, RELIGION, OR NATIONALITY, H.R. Rep. No. No. 337, 154th Leg., 1st Sess. at 2 (Mass. 1945).
 REPORT OF THE GOVERNOR’S COMMITTEE TO RECOMMEND FAIR EMPLOYMENT PRACTICE LEGISLATION, H.R. REP. No. 400, 154th Leg., 2nd Sess., at 7 (Mass. 1946).
 G. L. c. 151B, §§ 1(7) & 5, inserted by St. 1946, c. 368, § 4.
 G. L. c. 151B, § 9, inserted by St. 1946, c. 368, § 4.
 G. L. c. 151B, § 8, inserted by St. 1946, c. 368, § 4.
 G. L. c. 151B, § 9.
 Flagg v. AliMed, Inc., 466 Mass. 23 (2013) (“reading the statutory language broadly in light of its remedial purpose, and in order best to effectuate the Legislature’s intent, we think that the concept of associational discrimination also furthers the more general purposes of c. 151B as a wide-ranging law, ‘seek[ing] … removal of artificial, arbitrary, and unnecessary barriers to full participation in the workplace’ that are based on discrimination”).
 Barbuto v. Advantage Sales and Marketing, LLC, 477 Mass. 456 (2017) (employee use of medical marijuana is not facially unreasonable as a reasonable accommodation).
 Yee v. Massachusetts State Police, 481 Mass. 290 (2019) (where there are material differences between two positions in the opportunity to earn compensation, or in the terms, conditions, or privileges of employment, the failure to grant a lateral transfer to the preferred position may constitute an adverse employment action under G.L. c. 151B).
 2018 MCAD Annual Report, p. 11 (Commission counsel were assigned 46% of these cases in 2018).
 804 C.M.R. § 1.18(1)(a).
 804 C.M.R. § 1.20(3).
 See A. Colvin, Economic Policy Institute (EPI), “The Growing Use of Mandatory Arbitration” 1-2, 4 (Sept. 27, 2017).
by Christopher E. Hart
A critical component of data governance is the written information security program or policy, or “WISP” for short. WISPs are important for three reasons: first, they are often required by specific statutes or regulations. Second, their drafting and maintenance often force organizations to consider more closely the adequacy of their security practices. Third, they can be excellent defenses against liability in the event of a data security incident. Yet organizations often find themselves caught by surprise when they learn that they are either legally required to have a WISP, or ought to have one as a best practice or risk mitigator.
This article discusses what a WISP is, when they are required, what they are good for, why organizations should consider creating and maintaining them, and what the future holds. In the end, you will hopefully consider the WISP to be a critically important component of your or your client’s overall data governance strategy.
What is a WISP?
A WISP is a set of organizational practices relating to certain information, normally personally identifiable information (PII) that the organization maintains (such as a person’s name, email, password, social security number, and credit card information), memorialized in an inward-facing document. While the WISP really refers to the practices or program of information security, the memorialized document is often what people are referring to when they think of WISPs. A WISP is inward-facing in the sense that it is meant to be used internally by an organization, both as a reference and as a memorialization of practices, and not necessarily meant for consumption by consumers or the general public. (In contrast, privacy policies tend to be outward-facing documents, meant to notify potential consumers about an organization’s data use and security practices at or before the point that data is provided.)
To illustrate, one of the most important laws relating to WISPs, the Massachusetts regulations on Standards for the Protection of Personal Information of Residents of the Commonwealth, requires that “[e]very person that owns or licenses personal information” about a Massachusetts resident must “develop, implement, and maintain a comprehensive information security program that is written in one or more accessible parts.” 201 CMR 17.03(1).
What Does a WISP Require?
The purpose of the WISP is to “[i]nsure the security and confidentiality of customer information,” “protect against any anticipated threats or hazards to the security or integrity of such information,” and “[p]rotect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.” 201 CMR 17.01(1). The WISP is a security requirement, not a privacy requirement: it mandates certain technical and administrative safeguards relating to specific kinds of information. To accomplish these objectives, regulations mandating WISPs focus on a number of common elements:
- Risk Assessment. WISPs generally require that organizations implement practices that are commensurate with the sensitivity and volume of data the organization has, and the resources the organization can bring to bear to protect that data.
- Minimum Technical Security. WISPs will carry requirements that computer systems have adequate encryption, anti-malware software, and other perimeter and internal defenses.
- Third-Party Contracts. Central to a WISP is the concept that organizations that collect information but contract with vendors or other organizations to handle data ensure that those third parties protect the data at least as adequately as the collecting organization, requiring both that vendors be adequately vetted and that assurances regarding security programs by third parties are placed into contracts as specific obligations.
- Specific Accountability. WISPs normally require that a specific individual be held out as having responsibility for implementation of the security program.
- Regular Auditing. WISPs, and the specific requirements within them (such as risk assessments), must normally be reevaluated on at least an annual basis.
- Employee Training. Employees must be trained on the organization’s security requirements, and must be knowledgeable of the WISP, in order for the WISP to be a useful instrument.
As these requirements make clear, a WISP is best seen as a bundle of living practices, rather than merely a document that allows an organization to paper its liability.
When is a WISP Required?
As creatures of statute or regulation, WISPs are legally required if an entity falls within the jurisdictional scope of a regulatory regime. So, for example, the Gramm-Leach-Bliley Act, or GLBA, will only apply to those entities that fall under the definition of a “financial institution” as defined by the statute. See 15 U.S.C. § 6809(3) (“The term ‘financial institution’ means any institution the business of which is engaged in financial activities as described in section 1843(k) of title 12”). On the state level, states such as Pennsylvania, New Hampshire, and South Carolina have a WISP requirement for certain insurers as defined by the state’s insurance code. See, e.g., 31 Pa. Code § 146c.3 (“A licensee shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information.”).
Given the relatively narrow scope of many of these WISP requirements, the Massachusetts regulations stand out as particularly broad. Far from being cabined to entities within a particular industry, the Massachusetts regulations do not limit their application to entities that are domiciled or headquartered in Massachusetts, or even that specifically do business in Massachusetts. Rather, they apply to “all persons [that is, natural person, corporation, other legal entity, etc.] that own or license personal information about a resident of the Commonwealth.” 201 CMR 17.01(2). In other words, if a business “owns or licenses” the personal information about a single resident of Massachusetts, the regulations (and thus the requirement to develop a WISP) will apply. This is true even if an organization is already regulated by some other regulatory scheme, such as HIPAA. See Commonwealth v. Milton Pathology Assocs., P.C., Civ. A. No. 12-4568 H, 2012 Mass. Super. LEXIS 2902 (Super. Ct. Dec. 20, 2012) (requiring a HIPAA-covered entity to maintain a WISP).
Why Should You Have a WISP?
The first reason to have a WISP is because the law might require it, and being out of compliance can prove to be an expensive and embarrassing risk. The Commonwealth of Massachusetts has entered into consent judgments with parties in part (if not exclusively) to bring them into compliance with this requirement. The Attorney General of Massachusetts is an avid enforcer of the WISP requirement. See, e.g., Commonwealth v. Briar Grp., LLC, Civ. A. No. 11-1185 B, 2011 Mass. Super. LEXIS 2939 (Mass. Super. Ct. March 28, 2011) (requiring implementation of a WISP against a restaurant group accused of “failing to take reasonable steps to protect the personal information obtained from its patrons” in point of sale credit and debit card transactions); Commonwealth v. Haney, Civ. S. No. 16-00183m 2016 Mass. Super. LEXIS 915 (Super. Ct. January 14, 2016) (requiring a solo real estate practitioner to implement a WISP after allegedly failing to notify clients of a data breach); Milton Pathology Assocs., P.C., 2012 Mass. Super. LEXIS 2902. So is the Federal Trade Commission with regard to the WISP requirement in the GLBA’s Safeguards Rule. See In the Matter of Paypal, Inc., 162-3102, ¶ 40a (Fed. Trade Commission, 2017) (bringing a complaint against Venmo for failing to have a WISP through “at least August 2014”).
Having a good WISP might be as important as simply having one at all. In the wake of the 2017 Equifax breach affecting millions of individuals, the Attorney General of Massachusetts (among countless others) sued Equifax. Among the claims made by the Attorney General was that Equifax had violated the Massachusetts Data Security Regulations by having an insufficient WISP: “Equifax failed to develop, implement, and maintain an adequate written information security program . . . and . . . this failure made the data breach possible.” Commonwealth v. Equifax, Inc., Opinion No. 139895; 2018 Mass. Super. LEXIS 66 at *2 (Mass. Super Ct. April 3, 2018) (emphasis supplied). Specifically, the Commonwealth alleged that “Equifax knew or should have known” that there was “a serious security vulnerability” in Equifax’s systems; that Equifax “failed to patch or upgrade its software to eliminate this vulnerability,” and that “Equifax did not even take reasonable steps to determine whether unauthorized parties were infiltrating its computer systems.” Id. Considering the issue at the motion to dismiss stage, the court concluded that the Commonwealth stated a claim and denied the motion to dismiss. Id. at *3. Critically, the Commonwealth used the WISP requirements as a basis for a series of allegations that Equifax did not take reasonable measures to prevent or mitigate the breach—emphasizing that it is not the mere existence of the document, but the adequacy of the practices, that the regulations are intended to control.
In fact, in Massachusetts, the data protection statute authorizing the regulations that require the WISP has itself recently changed, requiring that in the event of a breach triggering notification to the Attorney General and the Office of Consumer Affairs and Business Regulations, the company notify these agencies whether a WISP was in place at the time of the breach. See G.L. c. 93H § 3(b). The clear intent of this change to the statute is to (1) create an in terrorem motivation to put a WISP in place if one has not yet been developed, and (2) to make it easier for the Commonwealth to prosecute cases in which a breach occurred without adequate safeguards.
Conversely, failing to have a WISP can potentially be evidence of negligence. When in search of a working theory of liability for a claim against an organization suffering a data breach, plaintiffs can turn to WISP requirements as evidence of a duty, and thus bring a claim sounding in negligence (whether or not it succeeds). See Baum v. Keystone Mercy Health Plan, 826 F. Supp. 2d 718, 721 (E.D. Pa. 2011) (remanding a removal case to state court when the state statute requiring a “comprehensive” WISP potentially allowed for a negligence per se claim even though HIPAA did not provide a private right of action); Rebello v. Lender Processing Servs., 30 N.E. 3d 999, 1016 (Ohio App. 2015) (holding that the GLBA “manifests a clear public policy against the unauthorized access and disclosure of the nonpublic personal information of consumers” applicable to plaintiff in an unlawful termination suit, as manifested in part through the WISP requirement, and allowing the claim to proceed).
The third reason to have a WISP is that it is simply good practice. While having a WISP can help an organization avoid compliance and litigation risk, having a WISP—that is, having actual practices to safeguard PII, memorialized in a document read and understood by those who handle such data—can, before any discussion of liability, help avoid a data breach or minimize the fallout from a data breach if it occurs. In the end, isn’t that the point?
What Does the Future Hold?
The WISP is not only here to stay; it stands a good chance of becoming a universal instrument in a complete data management tool kit, both as a matter of good practice and a matter of law. For example, the EU’s General Data Protection Regulation, or GDPR, does not specifically require a WISP. But the law has a host of requirements suggesting something like a WISP is prudent, if not required. See, e.g., GDPR Art. 5(2) (noting that the controller of personal data “shall be responsible for, and able to demonstrate compliance with” the requirement that personal data be processed lawfully, which includes processing with adequate security); id., Art. 25(2) (“The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.”). Given the GDPR’s potentially global territorial scope, something like a WISP is almost certainly going to become a legal norm.
In short, the WISP is a deeply important instrument for organizations in their privacy and security programs. While sometimes overlooked, it is both an increasingly important and ubiquitous regulatory requirement and a critical tool for creating robust security practices in an organization.
 For purposes of this article, unless otherwise indicated I will use “PII” to refer to the kind of information the practices outlined in WISPs are intended to safeguard. However, protected information can often be referred to by other terms of art, depending on the regulatory scheme: non-public financial information (the Gramm-Leach-Bliley Act); protected health information (the Health Insurance Portability and Accountability Act); and personal data (the European General Data Protection Regulation), to name three.
 A deep dive into the regulations reveals just how broad their scope is. A “person” can be a natural person or any legal entity; “owns or licenses” can mean, simply to “process” or simply “have access to” the personal information of a Massachusetts resident. 201 CMR 17.02.
Chris is Counsel and Partner-Elect in Foley Hoag’s Litigation Department, and an active member of the firm’s Data Privacy and Security Group. Chris has an active practice assisting organizations with their privacy compliance, data breach response, and government defense and litigation needs. In addition, Chris teaches data privacy compliance as a Part-Time Lecturer at Northeastern University School of Law.
Anyone who owns, constructs, or finances a construction project involving public funds, public ownership, and/or public use must carefully consider whether the project may be classified as “public construction.” If so, the project will be strictly regulated under an array of local, state, and federal requirements, including competitive bidding and procurement requirements, prevailing wages, bonding, and affirmative action goals. Mistakenly treating a project with a strong public-private interdependence as exempt from the public construction laws can expose the hybrid project to bid disputes, financial penalties, unenforceable contracts, and costly delays in the permitting, acquisition, funding, rehabilitation, and construction of critically needed housing. But compliance with the Massachusetts system of procurement when not required to will also constrain the construction process, significantly increase project cost and time, and result in other inefficiencies. This article reviews two bid protests recently decided by the Massachusetts Office of Attorney General (“AG”) to illustrate the challenges inherent in determining when affordable housing projects undertaken through public-private partnerships (“P3”)[i] may be “public construction” for purposes of the competitive bidding requirements under G.L. c. 149, §§ 44A–44H (“statute”).
I. Background: Public-Private Partnerships for Affordable Housing
Greater Boston perennially ranks nationally among the top-five highest average in rents and home prices. But because of the lack of funding, most low-income people in Massachusetts do not receive rental assistance, and three in ten low-income people are either homeless or must pay over half of their income in rent. The need for affordable housing preservation and production is at a crisis level in Massachusetts and nationally.[ii]
As the supply of affordable housing in the private market has lagged, public housing has been dying a slow death of divestment for decades. Established under the United States Housing Act of 1937, the public housing program produced nearly 1.4 million units nationwide, but today, only about 1 million units remain with a combined $49 billion backlog in unaddressed repairs.[iii] This backlog will continue to rise even as more federal public housing units are lost permanently with the U.S. Housing and Urban Development’s (“HUD”) effort to “reposition” the public housing inventory through public-private partnerships under the Section 18 demolition and disposition, Rental Assistance Demonstration (“RAD”), and Moving to Work programs.
The trend favors increased P3 initiatives with an expectation of greater efficiencies through risk sharing, leveraging financing from both public and private sectors, and accessing broader innovations, knowledge and skills. Already, “most HUD programs are structurally public-private partnerships (P3s) or have some public-private aspects.” Yet the legal uncertainty and fact-specific scrutiny necessary to determine when P3 arrangements are subject to the competitive bidding requirements may inadvertently chill critically-needed private investments for affordable housing in Massachusetts.
II. Massachusetts Public Construction Law
A. Massachusetts Competitive Bidding Statute
The Massachusetts public construction bidding law mandates that “[e]very contract for the construction, reconstruction, installation, demolition, maintenance or repair of any building by a public agency estimated to cost more than $150,000 … shall be awarded to the lowest responsible and eligible general bidder on the basis of competitive bids in accordance with the procedure set forth in section 44A to 44H.” G.L. c. 149, § 44A(1)(D).[iv] The dual remedial purpose of the statute is to eliminate favoritism and corruption through “an honest and open procedure for competition for public contracts,” Interstate Engineering Corp. v. Fitchburg, 367 Mass. 751, 757 (1975), and to ensure that taxpayers dollars obtain the lowest price for competent construction by qualified bidders under uniform criteria. Fordyce v. Town of Hanover, 457 Mass. 248, 259-60 (2010).
The AG is “charged with investigating allegations of violations of the competitive bidding statute and enforcing its provisions” through “bid protests.” Brasi Development Corp. v. Attorney General, 456 Mass. 684, 691 (2010) (“Brasi”). Awards of contracts can also be challenged in Superior Court where “the potential class of plaintiffs … is not necessarily limited to the low bidder on each contract” because standing is interpreted liberally in furtherance of the statute’s remedial purpose.[v] Barr Inc. v. Town of Holliston, 462 Mass. 112, 119 (2012).
The AG may enforce her bid protest decision by filing an action in the Superior Court. See G. L. c. 149, §§ 27C (a), 44H. However, the AG’s bid protest decision is accorded no deference by the courts which construe the statute de novo. Brasi, 456 Mass. at 694. Accordingly, a bid protest decision cannot settle the legal uncertainty as to whether and under what circumstances the statute applies to P3s.
B. The Brasi “Totality of Circumstances” Test
In Brasi, the Supreme Judicial Court (“SJC”) held that the competitive bidding statute applied to a “build to lease” arrangement between a private developer, Brasi Development Corporation (“BDC”), and the University of Massachusetts at Lowell (“University”). In so deciding, the SJC adopted a totality of circumstances test to conclude that the so-called “lease back” scenario[vi] in Brasi was in fact “the functional equivalent of a construction contract.” Id. at 684. The SJC reasoned that “limiting the inquiry to the [Request for Proposal (‘RFP’) as has been done in other contexts] ignores relevant circumstances that have a direct bearing on the transaction that the parties contemplated,” and that the totality of circumstances indicated the creation of a project by “an agency for the agency’s use in carrying out its public purpose” which constitutes “construction of a building by a public agency” to which the statute applies. Id. at 697-699.
Specifically, the SJC concluded that where BDC was obligated to construct a dormitory and lease it back to the University for up to 30 years subject to the University’s option to purchase and automatic transfer of ownership at the end of the lease, the “character of the agreement was, in essence, a contract for construction by a public agency… rather than a lease.” Id. at 684. The SJC admonished that “[o]therwise, the parties could easily employ long-term leases to evade the ‘competitive bidding requirement’ of the procurement statute.” Id. at 695. Brasi underscores that in evaluating whether public bidding laws apply to a P3, (1) public ownership is not necessary or dispositive and, (2) the “totality of the circumstances” of all agreements focuses on whether there is a “creation of a project by the [public] agency” that is “for the agency’s use in carrying out its public purposes.” Id. at 697.
III. Recent Attorney General Decisions on P3 Projects
A. Holyoke Housing Authority Decision: Public Housing Conversion under RAD
On June 20, 2019, the AG issued a detailed decision in In re Holyoke Housing Authority Rehabilitation of Lyman Terrace (“Holyoke Housing”) methodically applying the Brasi factors to the P3 rehabilitation of Lyman Terrace (“Project”) and found that the project constituted a public construction subject to the statute. However, the AG expressly declared that the decision in Holyoke Housing was “prospective only and, therefore, does not apply to this specific project, but will serve as guidance to other awarding authorities.” Holyoke Housing, p. 2.
This Project involved the conveyance and rehabilitation of 167-units of distressed federal public housing built in 1939 and owned by the Holyoke Housing Authority (“HHA”) to The Community Builders, Inc. (“TCB”), a private developer, as part of HUD’s RAD program under a 75-year ground lease (“Ground Lease”).[vii] Largely consistent with HHA’s RFP, the Master Development Agreement (“MDA”) required TCB to “initiate, coordinate and administer all planning, design, development, financing, construction and management activities in connection with” the Project,[viii] subject to certain rights of HHA to approve the general contractor and to review the plans, and subject to procedures for the selection of the contractor to help ensure competitive pricing, payment of prevailing wages, and compliance with other contracting standards.
To implement the Project, TCB formed a separate private limited liability company (“Owner”) to own Phase 1 of the Project pursuant to G.L. c. 121A, and HHA obtained HUD’s approval for the disposition of the public housing units under the RAD program. The Owner paid a base rent of $2,710,000 to HHA, and obtained over $35 million of financing for Phase 1 (including a $1 million loan from HHA, eight other loans from different public and private lenders, and almost $16 million of private equity contribution from the allocation of low-income housing tax credits (“LIHTC”)).[ix] TCB provided all corporate construction completion guarantees required by financing sources.
In exchange, as required for the RAD conversion, HHA entered into new Housing Assistance Payment (“HAP”) contracts with HUD to ensure the Owner would receive subsidy payments for the continued operation of the rehabilitated units under the Section 8 program. HHA and HUD also retained regulatory and enforcement rights with respect to the Section 8 HAP contracts, and HHA retained a limited right of first refusal and the option to buy back the buildings in 15 years. Other agreements obligated the Owner to “maintain the public purpose of the housing development” by operating and managing the rehabilitated units as affordable for low-income residents. Holyoke Housing, at 12.
According to the AG, the RAD Project posed the question under Brasi: “whether the public bidding laws apply when a private entity undertakes construction on a housing project that was initially owned by a public housing authority, was initiated by the public housing authority, is funded by public money, serves a governmental purpose, with control over the design and construction process retained by the public housing authority which may revert to the public housing authority if the authority pays fair market value, within a relatively short amount of time.” Holyoke Housing, p. 11. Notably, absent from the Project is the “lease back” arrangement that troubled the SJC in Brasi.[x] Rather, Holyoke Housing reveals a complex and pervasively regulated set of transactions typical of RAD conversions, which is one of the limited options available to some housing authorities to preserve distressed public housing units as affordable housing.
Nonetheless, the AG decided the Project was subject to the statute, applying the Brasi factors and following the SJC’s focus on whether the Project will “assist the public entity in ‘carrying out its public purposes.” Id. at 11-12. The AG also queried why a home-rule waiver from the statute had not been sought for the Project, as had been successfully done in other similar public housing redevelopments undertaken by TCB. See Holyoke Housing, p. 4.
B. Chestnut Park Preservation Decision: Privately-Owned, LIHTC Housing
On September 25, 2019, the AG decided In re MHFA, DHCD, and City of Springfield: Chestnut Park Apartments (“Chestnut Park”) finding that the P3 project there did not constitute public construction. Chestnut Park involved the occupied-rehabilitation of a privately-owned and privately-developed, 489-unit, LIHTC-financed, mixed-income rental housing development (“LIHTC Project”). In concluding that the LIHTC Project was not a “construction of a building by a public agency” subject to the statute, the AG recognized that there are “two separate legislative systems for creating and maintaining affordable housing…on both the state and federal levels”: a public housing system owned by public agencies that rely on grants and operating subsidies (as in Holyoke Housing), and a private affordable rental housing system developed, owned, and operated by private for-profit and non-profit entities relying on public and quasi-public loans, subsidies, and tax incentives. Chestnut Park, pp. 9-11. The AG then declared that nevertheless, even privately-owned affordable housing like the LIHTC Project is subject to the Brasi test. The AG also rejected a narrow interpretation of Brasi that the “totality of circumstances” test is “confined to cases involving leases.” Chestnut Park, p. 11. Finally, the AG distinguished Chestnut Park from the facts in Brasi and Holyoke Housing to conclude that because the public lenders, MHFA, DHCD, and the City of Springfield (collectively “Public Agencies”), “did not initiate or plan the design or construction of the Project; have never owned and will not own the Project land, buildings or improvements; do not have an absolute right to acquire the premises; and do not control the design or construction of the Project in any way other than as lenders, the public bidding laws do not apply” to the LIHTC Project. Id., p. 2 (italics added).
Applying Brasi to each indicia of public ownership, project control, use, purpose, and funding, the AG rejected the argument that Chestnut Park Apartments is a government agency-financed and controlled affordable housing facility subject to the statute, and determined that the conditions of financing in the Public Agencies’ regulatory agreements did not constitute “significant control over either the design or the construction of the Project” but were “programmatic” requirements for the operation of the LIHTC Project as affordable housing consistent with the Public Agencies’ public purpose and underwriting requirements.[xi] Id., pp. 12-15. The AG concluded that “public financing alone ‘does not render a private development … a public building or public work, or make [an owner] an agent or servant of a public instrumentality,” and noted that “[i]f that were the case, the private businesses that invest in low-income communities while benefiting from the New Markets Tax Credit Program … would become subject to laws governing public construction and prevailing wage,[xii] since they [likewise] advance the public purpose of serving low-income communities.” Chestnut Park, pp. 16-17 (quoting Salem Bldg. Supply Co. v. J.B.L. Constr. Co., 10 Mass. App. Ct. 360, 362 (1980)).
IV. More Challenges on the Horizon?
The AG’s recent bid protest decisions applying the Brasi totality of circumstances test underscore that in Massachusetts, all public and privately-owned P3 projects are well-advised to continue to consider carefully the applicability of the statute and all other public construction requirements [xiii] when one or more of the following “red flags” of potential challenge is present: (1) direct or indirect public ownership in part or all of the project, (2) public or quasi-public financing in the form of equity or debt, or assumption of risks or provision of guarantees, (3) significant public entity control over the construction, rehabilitation, or design of the project, and/or (4) construction to serve a specific public purpose or public use. By addressing the legal requirements for public construction early, P3 projects will be optimally positioned to provide badly needed affordable housing efficiently, with quality construction, within budget, and in a timely manner, and avoid costly public relations hiccups and litigation.
Lauren D. Song is a Senior Attorney at Greater Boston Legal Services where her practice focuses on affordable housing preservation and development through public-private partnerships, including under the federal “Section 18,” “RAD,” and state demonstration programs. Lauren is a current member of the Boston Bar Journal and the Citizens’ Housing and Planning Association.
Tyler Creighton is a law student at Boston University and former legal intern with Greater Boston Legal Services. Prior to law school, Tyler worked on election and voting policies with Common Cause Massachusetts and ReThink Media.
[i] The U.S. General Accounting Office defines “public-private partnerships” as joint efforts between the public and either the private for-profit or private nonprofit sectors.
[ii] All five Greater Boston counties rank nationally in the top 10 percent for income inequality. The median rent of $2,450 for a one bedroom apartment in Boston in 2019 is unaffordable for most lower-income and working-class households.
[iii] ”Public housing” refers to federal public housing in this article unless otherwise specified. Public housing is funded exclusively by Congressional appropriations. HUD administers the public housing operating and capital funds appropriated by Congress to approximately 3,300 public housing authorities (“PHAs”). However, Massachusetts (along with New York, Connecticut, and Hawaii) also has a state public housing program comprised of more than 240 local PHAs and overseen by the Massachusetts Department of Housing and Community Development (“DCHD”) which also faces a $2 billion capital funding shortfall.
[iv] In Massachusetts, “public construction” falls generally under two categories of either “vertical construction” of “public buildings” governed by G.L. c. 149, or “horizontal construction” of “public works” governed by G.L. c. 30, § 39M. Generally, the vertical projects are subject to more requirements than the horizontal projects. The AG has jurisdiction to investigate bid protests in both vertical and horizontal construction.
[v] See e.g., Andrews v. City of Springfield, 75 Mass. App. Ct. 678 (2009) (standing for group of city residents); Associated Subcontractors of Mass., Inc. v. Univ. of Mass. Bldg. Authority, 442 Mass. 159 (2004) (standing for subcontractors’ association); East Side Const. Co. v. Town of Adams, 329 Mass. 347 (1952) (standing for group of taxpayers).
[vi] Lease backs typically involve creative arrangements where a public entity leases land to a private developer (often for a de minimus amount) in exchange for the developer’s promise to build on the land and then enter into a [sub]lease-to-own agreement for the construction with the public entity. See, e.g., Andrews v. City of Springfield, 75 Mass. App. Ct. 678, 679 (2009) (invalidating lease and option to purchase because “Springfield’s request for proposal (RFP), while styled as a lease, was in reality a construction project subject to the bidding procedures set forth in c. 149” which Springfield did not follow).
[vii] RAD allows for significant PHA discretion in how the public-private interdependence is structured. At a minimum, RAD conversions of public housing to the more reliable Section 8 platform allow PHAs greater access to private financing and on better loan terms for renovations. See, e.g., Fischer, Will. 2014. “Expanding Rental Assistance Demonstration Would Help Low-Income Families, Seniors, and People with Disabilities.” Center on Budget and Policy Priorities. See also, Meryl Finkel, Ken Lam, Christopher Blaine, R.J. de la Cruz, Donna DeMarco, Melissa Vandawalker, Michelle Woodford. (Nov. 2010). Capital Needs in the Public Housing Program.
[viii] HHA separately undertook the “horizontal” improvement of the public works for Lyman Terrace through grants. HHA used a contractor selected through a competitive bid process but subsequently contracted with a TCB affiliate to complete the site improvement.
[ix] The Low-Income Housing Tax Credit (LIHTC), created by the Tax Reform Act of 1986, is now the most significant private incentive for affordable rental housing production in the United States, involving more than 3.13 million housing units placed in service between 1987 and 2017.
[x] Some have argued that the Brasi totality of circumstances test applies only in similar “build to lease” or “lease back” scenarios.
[xi] The Public Agency loans impose certain affordability, unit-mix, tenant-selection, and other use restrictions for 52 years, after which the units can be converted into market-rate housing under G.L. c. 40T, § 3.
[xii] While the AG is charged with enforcing the state’s prevailing wage statute, the Massachusetts Department of Labor Standards is tasked with issuing state prevailing wage schedules and making applicability determinations, Felix A. Marino Co. v. Comm’r of Labor and Indus., 426 Mass. 458, 460 (1998), and has adopted Brasi’s totality of the circumstances test for determining whether a project is a “public work” subject to the prevailing wage law. See e.g., Re: Construction of Leasehold Space in Private Buildings by Charter Schools for the Purpose of Use as a School, Prevailing Wage Program Opinion Letter (Feb. 22, 2012). Notably, projects that are covered by the state’s prevailing wage statute, G.L. c. 149, § 26–27 are not necessarily subject to the competitive bidding statute and vice versa. This is because, for example, there are amount thresholds in the Competitive Bidding Statute not applicable to the Prevailing Wage Statute, and whereas the bidding laws cover “buildings by a public agency,” the prevailing wage laws apply to “public works.”
[xiii] Other issues that may affect P3 projects in addition to competitive bidding requirements include whether it is federal, state or local, such as relates to: (1) prevailing wages, (2) work force policy mandates relating to DBE, WBE, LBE, etc. (3) procurement restrictions on materials and equipment, (4) bonding requirements, and (5) mechanics lien rights, and (6) even the timing of presentation of claims or commencing an action or the applicability of sovereign immunity or limits on damages.
by Eric A. Haskell
As great quantities of data have come to repose in electronic devices, obtaining access to the content of those devices has come to be greatly important to law enforcement in many criminal investigations. It sometimes happens that law enforcement has a right—typically pursuant to a search warrant—to search for data on a particular device, but is prevented from doing so by the presence of a password or other “key” that makes the data inaccessible or unreadable. Law enforcement sometimes can bypass the password on its own. See generally O.S. Kerr & B. Schneider, Encryption Workarounds, 106 Geo. L.J. 989 (2018). But, other times, the only practical way law enforcement can execute the search is with the help of a person who knows the password. Because the person who knows the password often is the suspect, their help generally is available only if compelled by court order. Such “compelled decryption” implicates not only the constitutional requirement that the search of the device be “reasonable,” but also the suspect’s constitutional privilege against compelled self-incrimination.
Basic Principles of the Privilege Against Self-Incrimination
The Fifth Amendment to the federal Constitution provides that “[n]o person . . . shall be compelled . . . to be a witness against himself . . . .” Article 12 of the Massachusetts Declaration of Rights similarly provides that “[n]o subject shall . . . be compelled to accuse, or furnish evidence against himself.” Decisional law has interpreted these privileges to bar the government from: (1) compelling a person; (2) to make a testimonial communication; (3) that is incriminating. Fisher v. United States, 425 U.S. 391, 408 (1976); Commonwealth v. Burgess, 426 Mass. 206, 218 (1997).
The privilege does not protect against compelled provision of a physical identifier such as fingerprints, a blood sample, or a handwriting exemplar. See generally Schmerber v. California, 384 U.S. 757, 767 (1966); Commonwealth v. Brennan, 386 Mass. 772, 776-83 (1982). This is because such identifiers do not “extort . . . information from the accused” or “attempt to force him to disclose the contents of his own mind,” and thus are not viewed as sufficiently “testimonial” for the privilege to attach. Doe v. United States, 487 U.S. 201, 210-11 (1988). Nor does the privilege shield documents from being disclosed pursuant to compulsion, even if their contents are incriminating. United States v. Hubbell, 530 U.S. 27, 35-36 (2000). This is because “the creation of those documents was not ‘compelled’ within the meaning of the privilege.” Id.
The privilege may apply where the mere act of producing a document or a thing is “testimonial” in that it implies an incriminating assertion of fact, such as: that the demanded object exists; that the object produced is authentic; or that the suspect possesses or controls the object. Fisher, 425 U.S. at 410; Commonwealth v. Hughes, 380 Mass. 583, 588-93 (1980). But this “act of production” doctrine does not apply where law enforcement already has independent evidence of the incriminating assertions that the act of production would imply. In other words, if the act of production “adds little or nothing to the sum total of [law enforcement’s] information,” then any facts implied by the act of production are “foregone conclusions” and the privilege does not apply. Fisher, 425 U.S. at 411; Hughes, 380 Mass. at 592.
Commonwealth v. Gelfgatt
In Gelfgatt, the defendant was arrested in connection with a complex fraud scheme that involved the creation and recording of forged mortgage assignments. Commonwealth v. Gelfgatt, 468 Mass. 512, 514-15 (2014). On the day of his arrest, investigators seized several encrypted devices from his home and also interviewed the defendant, who asserted that he was capable of decrypting them. Id. at 516-17. After the defendant was charged with forgery, uttering, and attempted larceny, the Commonwealth filed a motion seeking to compel him to enter the passwords into the encrypted devices. Id. at 517-18 & n.10. The Superior Court denied the motion and reported the case to the SJC.
The SJC determined that the contents of the devices were not privileged on self-incrimination grounds because they had been “voluntarily created by the defendant in the course of his real estate dealings.” Id. at 522 n.13. The SJC then held that the defendant’s act of entering the passwords would be a testimonial act of production, because it would implicitly acknowledge his “ownership and control of the computers and their contents.” Id. at 522. But, the SJC continued, the defendant had already acknowledged as much in his statement to the police; thus, any facts implied by his entering the passwords were foregone conclusions. Id. at 523-24. In doing so, the SJC commented that the “foregone conclusion” exception would apply where law enforcement already was aware of “(1) the existence of the evidence demanded; (2) the possession or control of that evidence by the defendant; and (3) the authenticity of the evidence.” Id. at 522 (citing Fisher, 425 U.S. at 410-13).
Commonwealth v. Jones
In Jones, the defendant was arrested and later charged with sex trafficking and deriving support from prostitution. Commonwealth v. Jones, 481 Mass. 540, 543-44 (2019). At the time of his arrest, he possessed a cellular telephone that, the police learned from other sources, he had used to facilitate prostitution transactions. Id. The Commonwealth filed a motion seeking to compel him to decrypt the telephone (although, as discussed below, the motion imprecisely described what it sought to compel him to do). The motion judge demurred, interpreting Gelfgatt to require the Commonwealth to establish “(1) the existence of the evidence demanded; (2) the possession or control of that evidence by the defendant; and (3) the authenticity of the evidence,” and concluding that the Commonwealth had failed to demonstrate those propositions with “reasonable particularity.” Id. at 545, 548, 553 n.14. The Commonwealth subsequently made a renewed motion, furnishing additional evidence that, it argued, showed that the defendant’s knowledge of the telephone’s password was a foregone conclusion. Id. But the motion judge declined to consider the newly-furnished evidence without a showing that it had been unknown or unavailable to the Commonwealth at the time of the initial motion. Id. at 545, 558-59. The Commonwealth then sought relief before a single justice of the SJC, who reserved and reported the case to the full Court on three questions: (1) what burden of proof the Commonwealth must bear to establish the “foregone conclusion” exception to the privilege under Gelfgatt; (2) whether the Commonwealth had met that burden; and (3) whether the Commonwealth was required, in a renewed Gelfgatt motion, to show that any newly-furnished evidence had been unknown or unavailable at the time of the initial motion.
Before answering those questions, the SJC addressed a threshold issue: What factual assertions must the Commonwealth demonstrate are “foregone conclusions” in order to obtain a Gelfgatt order? The SJC answered that, when the Commonwealth seeks to compel a defendant to enter a password into a device, “the only fact conveyed . . . is that the defendant knows the password, and can therefore access the device.” Id. at 547-48. The Court rejected the proposition that the compelled entry of a password also asserts the defendant’s ownership and control of the device, observing that “individuals may very well know the password to an electronic device that is owned and controlled by another person.” Id. at 547 n.8. Accordingly, the SJC concluded, the Commonwealth may invoke the “foregone conclusion” exception simply by showing that the defendant knows the password. Id.
Turning to the reported questions and relying on article 12, the SJC held that the Commonwealth must make that showing beyond a reasonable doubt. Id. at 551-55. Applying that standard, the Court found that the Commonwealth had shown the defendant’s knowledge of the password beyond a reasonable doubt, where: (1) the defendant possessed the telephone at the time of his arrest; (2) one month before his arrest, when asked by the police for his number, the defendant had provided the telephone’s number; (3) a woman told the police that the defendant used the telephone to facilitate prostitution transactions; (4) the telephone’s subscriber records were associated with a second number that was associated with the defendant; and (5) the telephone’s cellular site location information (CSLI) placed it in the same locations at the same times as another telephone that was confirmed to belong to the defendant. Id. at 555-58 (“[S]hort of a direct admission, or an observation of the defendant entering the password himself and seeing the phone unlock, it is hard to imagine more conclusive evidence of the defendant’s knowledge of the [telephone’s] password.”). Finally, the Court found that the motion judge abused his discretion by declining to consider evidence presented in the Commonwealth’s renewed motion that was not shown to have been unknown or unavailable at the time of the initial motion. Id. at 558-61. The Court observed that a Gelfgatt motion, “[m]uch like a search warrant application,” is an “investigatory tool,” the factual support for which may evolve over the course of an investigation. Id. at 559-60.
The Future of Compelled Decryption
Although Gelfgatt and Jones mark the SJC as a national leader on compelled decryption issues, important questions remain to be answered.
- Non-Gelfgatt Decryption Procedures
The order in Gelfgatt required the defendant to appear at a digital forensic lab, to enter the password into each device, and “immediately [to] move on . . . .” 468 Mass. at 517 n.10. It also forbade the Commonwealth from viewing or recording the password entered by the defendant. Id. In contrast, the order sought in Jones was “not perfectly clear” as to what it would require the defendant to do, but “suggested that it sought to require the defendant to make a written disclosure of the actual password.” 481 Mass. at 546 n.9. Acknowledging the possible infirmity with such a procedure, the SJC construed the order sought in Jones as tracking the one sought in Gelfgatt, and approved its issuance on that basis. Id.
The SJC was correct to hesitate when faced with a request to compel the defendant to disclose his password to law enforcement. This is because the compelled disclosure of a password is not a testimonial act of production to which the “foregone conclusion” exception might apply: Rather, it is a “pure” testimonial statement to which the “foregone conclusion” exception cannot apply. See id. (acknowledging as much in dicta); see also United States v. Oloyede, Nos. 17-4102, 17-4186, 17-4191, & 17-4207, — F.3d —, 2019 WL 3432459 (4th Cir. Jul. 31, 2019) (distinguishing between suspect’s typing password into device and giving password to law enforcement).
Furthermore, in both Gelfgatt and Jones, the suspect was not compelled to produce any particular files from the device after decrypting it; that was left to the analyst executing the warrant. In Jones, the SJC highlighted this aspect of the decryption procedure, observing that “the analysis would have been different” if the suspect had been compelled to produce particular files, because doing so “would implicitly testify to the existence of the files, [the suspect’s] control over them, and their authenticity.” 481 Mass. at 548 n.10. In that situation, the Commonwealth would have been obligated to prove, beyond a reasonable doubt, that those additional assertions were foregone conclusions before it could obtain a corresponding Gelfgatt order. Cf. Hubbell, 530 U.S. at 44-45 (act of production is privileged where grand jury subpoena would require recipient to produce documents whose existence and location were previously unknown to government).
- Cloud-Based Storage
Gelfgatt and Jones both involved a tangible device that was in the physical possession of law enforcement. But their holdings as to the privilege against compelled self-incrimination can also be applied to a request to compel decryption of a cloud-based digital space. Such a request would follow the same analysis, with law enforcement required to: (1) have a right to search the cloud location; (2) show beyond a reasonable doubt that the suspect knows the password to access the cloud location, thereby availing itself of the “foregone conclusion” exception; and (3) allow the suspect to input the password in a way that law enforcement does not see or record.
- Biometric Keys
In both Gelfgatt and Jones, the sought-after “key” was an alphanumeric password. But a key can also take the form of a biometric such as a facial scan, retinal scan, or fingerprint. Biometric keys introduce two novel questions: (1) is compelled biometric decryption properly viewed as a testimonial act of production, and thus within the scope of the privilege against compelled self-incrimination?; and, if so, (2) what must law enforcement show is a “foregone conclusion” before it can compel such biometric decryption?
Courts have answered the first question both ways. Some have viewed the compelled biometric decryption as no different than compelled provision of a traditional physical identifier, and thus nontestimonial. See, e.g., State v. Diamond, 905 N.W.2d 870, 875-76 (Minn. 2018); In re Search of [Redacted], 317 F. Supp. 3d 523, 535-37 (D.D.C. 2018); In re Search Warrant Application for [Redacted], 279 F. Supp. 3d 800, 803-05 (N.D. Ill. 2017); Commonwealth v. Baust, 89 Va. Cir. 267, 2014 WL 10355635 (Va. Cir. Ct. Oct. 28, 2014). Others have reasoned that, unlike providing a physical identifier, compelled biometric decryption implies factual assertions about the suspect’s relationship with the device. See, e.g., Seo v. State, 109 N.E.3d 418 (Ind. App. 2018), vacated and transferred to Ind. Supreme Court, 112 N.E.3d 1082 (Ind. 2018); In re Application for Search Warrant, 236 F. Supp. 3d 1066, 1073-74 (N.D. Ill. 2017); In re Search of a Residence in Oakland, Cal., 354 F. Supp. 3d 1010, 1015-16 (N.D. Cal. 2019); In re Search of White Google Pixel 3 XL Cellphone, No. 1:19-mj-10441, 2019 WL 2082709 at *3-4 (D. Idaho May 8, 2019). No Massachusetts court has yet issued a published opinion on this issue.
In this author’s view, law enforcement should be prepared for a Massachusetts court to depart from the traditional treatment of compelled provision of a physical identifier, and instead to view compelled biometric decryption as a testimonial act of production. Compelled provision of a physical identifier has been deemed nontestimonial not because it does not assert facts, but rather because the facts that it does assert are so “self-evident” as to be “[in]sufficiently testimonial for purposes of the privilege.” Fisher, 425 U.S. at 411 (compelled handwriting exemplar is nontestimonial for purposes of the privilege, despite its asserting both that handwriting belongs to suspect and that suspect is literate); accord Commonwealth v. Nadworny, 396 Mass. 342, 363-64 (1985) (fact that defendant is right-handed, unlike handwriting exemplar itself, is testimonial, although “trivial”). But, when law enforcement seeks to compel biometric decryption, its object is not merely provision of the biometric standing alone: If it were, the method of capturing the biometric would not matter, and investigators could just as well take a photograph of the suspect’s face, or ink-and-paper impressions of his fingerprints. Rather, the object of compelled biometric decryption is the interaction of the biometric, in a pre-programmed fashion, with a particular device. The successful interaction of biometric and device, in contrast to the biometric standing alone, asserts at least one fact that neither is trivial nor is self-evident from the biometric—specifically, it asserts that the suspect’s biometric is capable of decrypting the device. See In re Application for Search Warrant, 236 F. Supp. 3d at 1073. In other words, compelled biometric decryption asserts facts that are basically similar to those asserted by compelled decryption using a password.
This reasoning simultaneously answers both the first question of whether compelled biometric decryption should be viewed as a testimonial act of production (it should) and the second question of what law enforcement must establish is a “foregone conclusion” before it can compel such a biometric. If the assertion implied by the compelled biometric decryption is that the suspect’s biometric is capable of decrypting the device, then, pursuant to Jones, that is what the Commonwealth must prove beyond a reasonable doubt. As in Jones, the Commonwealth can do so through either direct evidence (e.g., that the suspect actually used his biometric to decrypt the device) or circumstantial evidence (e.g., that the suspect used the device in a manner indicating that he must have had the ability to do so).
As a practical matter, the utility of compelled biometric decryption to law enforcement may be circumscribed. This is because some biometric-based security technologies—including Apple’s popular fingerprint-based Touch ID—self-disable if, since the last time the device was unlocked, too much time has passed, or the device has been restarted or has lost power, or multiple attempts to unlock the device have been unsuccessful. See About Touch ID Advanced Security Technology. In addition, law enforcement may have limited ability to both maintain power to a biometrically locked device and to secure it from network activity (i.e., to minimize the risk of remote wiping or deletion of data). Perhaps for these reasons, federal practice has often encountered requests to compel biometric decryption made as part of an application for an omnibus search warrant to also authorize law enforcement: (1) to seize the device; and (2) to search the device for particular data after it has been seized and decrypted using the compelled biometric. See, e.g., In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1013; In re Search of [Redacted], 317 F. Supp. 3d at 525-26; In re Search Warrant Application for [Redacted], 279 F. Supp. 3d at 801-02; In re Application for Search Warrant, 236 F. Supp. 3d at 1066-67.
- Ex Parte Gelfgatt Proceedings
Gelfgatt and Jones each arose in the posture of a motion filed in a criminal case in the Superior Court. This posture suggests that, in those cases, any evidence contained on the encrypted device was not necessary to support charges against the defendant. But some investigations will require a compelled decryption before charges can be brought. It thus seems likely that some Gelfgatt motions will arise in an ex parte posture.
The Appeals Court has already addressed a Gelfgatt motion arising out of a grand jury investigation, concerning a device that the police had previously obtained a warrant to search. See In re Grand Jury Investigation, 92 Mass. App. Ct. 531 (2017), further appellate review denied, 478 Mass. 1109 (2018). The Commonwealth filed a sealed Gelfgatt motion in the Superior Court and attached documents containing grand jury evidence that, the Commonwealth argued, satisfied its burden under the “foregone conclusion” exception. Id. at 532. The Commonwealth served the motion, but not the attachments, on counsel for the individual whom it sought to compel. The Appeals Court affirmed the Superior Court’s issuance of a Gelfgatt order, concluding that the attachments showed that it was a foregone conclusion that the individual knew the password, among other things. Id. at 534-35; see also Burgess, 426 Mass. at 215-16 (Fifth Amendment applies in same way to grand jury witness/target as to indicted defendant). The Appeals Court also specifically affirmed the non-disclosure of the attachments to counsel, reasoning that grand jury materials are secret, and that both the Superior Court judge and the appellate court could review the attachments on an ex parte basis. Id. at 535-36.
It is a small step from In re Grand Jury Investigation to think that at least some Gelfgatt orders may be sought as part of a search warrant application. Indeed, search warrant applications bear similarities to the motions sustained in Gelfgatt, Jones, and/or In re Grand Jury Investigation: They are ex parte, they rely on affidavits rather than live testimony, and they form an “investigatory tool that aids investigators in obtaining material and relevant evidence related to a defendant’s conduct.” Jones, 481 Mass. at 559. As noted, search warrant applications seeking compelled biometric decryption have appeared in federal practice. See, e.g., In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1015-16; In re Search of [Redacted], 317 F. Supp. 3d at 535-37; In re Search Warrant Application for [Redacted], 279 F. Supp. 3d at 803-05; In re Application for Search Warrant, 236 F. Supp. 3d at 1073-74. Nonetheless, a search warrant application seeking a Gelfgatt order in state court would entail innovations to Massachusetts search warrant practice that the applicant must be prepared to address.
The applicant must be prepared to show that the act sought to be compelled is of a type of evidence for which the Legislature has authorized issuance of a search warrant. See G.L. c. 276, § 1 (enumerating categories of evidence that may be sought by search warrant). Compelled biometric decryption likely will fall into that category. See, e.g., In re Lavigne, 418 Mass. 831, 834-35 (1994) (statute authorizes use of warrant to procure bodily sample from suspect); cf. In re Search of [Redacted], 317 F. Supp. 3d at 540 n.13 (declining to decide whether Fed. R. Crim. P. 41 authorizes issuance of warrant to compel biometric decryption, and instead issuing warrant under All Writs Act, 28 U.S.C. § 1651). Compelled decryption using a password, on the other hand, might not.
The applicant must also be prepared to show that the application does not trigger an adversarial hearing, which the SJC has required as a prerequisite for issuance of warrants for some especially invasive searches. E.g., Lavigne, 418 Mass. at 835 (warrant to extract blood sample from suspect must be preceded by adversarial hearing at which court can weigh intrusiveness of procedure against need for evidence); Commonwealth v. Banville, 457 Mass. 530, 539-40 (2010) (warrant to obtain suspect’s DNA using buccal swab would have been preceded by adversarial hearing if it had occurred in Massachusetts). So long as compelled biometric decryption “[does] not involve penetration into [the suspect’s] body,” Banville, 457 Mass. at 539 n.2, it likely will not trigger such a hearing. See also Commonwealth v. Miles, 420 Mass. 67, 83 (1995) (ex parte order compelling suspect to appear and have his body inspected for poison ivy need not be preceded by hearing).
The applicant must take care to particularly identify the person whose biometric is to be compelled, perhaps by including a photograph and/or detailed physical description of that person in the warrant application papers. This stems in part from the “particularity” requirement applicable to any search warrant. See G.L. c. 276, § 2. It also follows from this author’s view (above) that compelled biometric decryption may be analyzed under the “foregone conclusion” exception to the “act of production” privilege: If that view is accepted, the identity of the person whose biometric is to be compelled would form one aspect of the “foregone conclusion” that, under Jones, the Commonwealth must prove beyond a reasonable doubt. The need for particularity in identifying the person whose biometric is to be compelled likely precludes law enforcement from obtaining a warrant to compel “any person present” at the warrant execution to apply his/her biometrics to a device. Cf. In re Search of a Residence in Oakland, 354 F. Supp. 3d at 1014 (denying such authorization); In re Application for Search Warrant, 236 F. Supp. 3d at 1068-70 (same).
And the applicant should be explicit about the different burdens it must sustain to obtain such a warrant. That a crime has occurred and that evidence related to the crime reasonably may be expected to be found in a particular place—requirements for issuance of any search warrant—need be demonstrated only to the level of probable cause. That it is a foregone conclusion that a particular person’s biometric is capable of decrypting the device, however, must be demonstrated beyond a reasonable doubt in accordance with Jones. The applicant should consider explicitly articulating the applicable burdens in the warrant application papers, for the benefit of the reviewing judicial officer.
Eric A. Haskell is an Assistant Attorney General and a member of the BBJ Board of Editors. This article represents the opinions and legal conclusions of its author and not necessarily those of the Office of the Attorney General. Opinions of the Attorney General are formal documents rendered pursuant to specific statutory authority.
 To ensure that even the act of placing a finger on the screen of a device does not disclose the suspect’s thoughts, the orders in some of those cases have required the police—not the suspect—to select the finger that the suspect must place on the screen. See In re Search of [Redacted], 317 F. Supp. 3d at 537, 539; In re Search Warrant Application for [Redacted], 279 F. Supp. 3d at 804.
 It also strongly implies that the suspect was the person who previously programmed the device to decrypt in response to his biometric; unlike an alphanumeric password, a biometric is unique and non-transferable. Contrast Jones, 481 Mass. at 547 n.8 (suspect’s knowledge of password to device does not necessarily imply that he owns or controls device, because password can be transferred between persons).
 An additional showing might be required to authorize the suspect’s temporary detention for the purpose of compelling his biometric, although that showing may well be subsumed by the two discussed in the body text. See Hayes v. Florida, 470 U.S. 811, 816-17 (1985) (holding that police cannot transport suspect to station for fingerprinting without probable cause or prior judicial authorization, but suggesting that seizure of suspect in field for fingerprinting may be permissible based on less than probable cause in some circumstances); see also In re Search of [Redacted], 317 F. Supp. 3d at 532-33 (applying Hayes to authorize warrant to detain person for compelled biometric decryption if: “(1) the procedure is carried out with dispatch and in the immediate vicinity of the premises to be searched, and if, at time of the compulsion, the government has (2) reasonable suspicion that the suspect has committed a criminal act that is the subject matter of the warrant, and (3) reasonable suspicion that the individual’s biometric features will unlock the device, that is, for example, because there is a reasonable suspicion to believe that the individual is a user of the device”); cf. Commonwealth v. Catanzaro, 441 Mass. 46, 52 (2004) (search warrant implies authority to detain occupants of premises while search is conducted).