This matter arises out of the investigation of the January, 2002, murder of Christa Worthington. The plaintiff, Keith Amato, is a private citizen who (like many others) voluntarily provided a deoxyribonucleic acid (DNA) sample at the request of investigators. Amato did so based on promises that the sample and its related data would not be retained or used if his DNA did not match the biological evidence from the crime scene. Claiming that the defendants have not stood by those promises, Amato filed a class action complaint alleging violation of the Fair Information Practices Act (FIPA), invasion of privacy, and breach of contract. On motion of the defendants, a judge dismissed the complaint pursuant to Mass.R.Civ.P. 12(b)(6), 365 Mass. 755 (1974). We conclude that Amato’s allegations that the defendants continue to hold records related to his DNA sample without his consent, and in breach of promises of limited use and retention, state a claim for equitable relief3 under all three causes of action. Accordingly, we reverse the dismissal of Amato’s claims against the District Attorney for the Cape and Islands district (district attorney) and the Forensic *232and Technology Center of the Commonwealth of Massachusetts, Department of State Police (crime lab), and we remand for further proceedings.4

1. Background. We accept as true, as we must, all facts alleged in the complaint, drawing all reasonable inferences in favor of Amato. In addition, we take judicial notice of certain facts appearing in Commonwealth v. McCowen, 458 Mass. 461 (2010) .5 On January 6, 2002, Christa Worthington was found dead in her Truro home. Pursuant to G. L. c. 38, § 3(1) and (17), and G. L. c. 38, § 4, second par., the district attorney directed and controlled the subsequent investigation. During the investigation, State police detectives, acting on the district attorney’s behalf, solicited voluntary DNA samples from numerous male residents of Cape Cod for purposes of comparison with the biological evidence from the crime scene.

A State police detective approached Amato requesting such a sample in January or February of 2002. The detective assured Amato that if his DNA sample did not match the crime scene evidence, his sample and related records would be destroyed and would not become part of any State or Federal database. Relying on this promise, Amato consented to provide a voluntary saliva swab for DNA analysis. Between 150 and 200 other men, relying on similar promises, consented to provide voluntary DNA samples.

The State police sent these samples to the crime lab. The crime lab analyzed these samples, producing DNA profiles. The crime lab compared those DNA profiles to the profiles that resulted from its analysis of the biological evidence recovered from the crime scene. Amato’s DNA profile did not match.

The DNA profile of Christopher McCowen, another man who consented to provide a voluntary DNA sample, matched the crime scene DNA profile. He was arrested on April 14, 2005. In *233November, 2006, during McCowen’s subsequent trial, Amato contacted the district attorney to inquire about the status of the sample he had provided more than four years earlier. The district attorney instructed Amato to inquire again after the completion of McCowen’s trial.

After a Superior Court jury convicted McCowen in November, 2006, Amato again contacted the district attorney, who orally represented to Amato that his DNA sample had been destroyed. The district attorney declined to provide written details of the handling of the sample. Amato wrote to the district attorney requesting some written record of the treatment of his DNA sample. There was no reply.

On November 21, 2006, the district attorney issued a press release announcing the option for men who had consented to provide voluntary DNA samples between January, 2005, and March, 2005, to retrieve them. The press release announced that samples not retrieved by a certain date would be destroyed. A Cape Cod Times newspaper article reporting on the press release quoted the district attorney as saying, “I said a long time ago that I would do this [return the voluntarily provided DNA samples].” Neither the press release nor the district attorney mentioned DNA samples, like Amato’s, voluntarily provided between January, 2002, and January, 2005, or after March, 2005.

Over the next ten months, Amato wrote once to the Attorney General and, through counsel, twice to the acting director of the crime lab. In all three letters, Amato sought confirmation that the crime lab had destroyed his DNA sample and any accompanying records. In November, 2007, the acting director of the crime lab finally replied. She represented that (1) the crime lab had custody of the sample and associated records; (2) the crime lab had not and would not enter Amato’s DNA profile into the State convicted offender database6 or the combined DNA index system (CODIS) maintained by the Federal Bureau of Investigation (FBI); and (3) the crime lab could not release or destroy the DNA sample or the associated records without the district attorney’s authorization.

Amato, through counsel, wrote to the district attorney request*234ing that he authorize the crime lab to destroy the DNA sample and associated records of Amato and others who consented to provide DNA samples in similar circumstances. Amato also wrote to the Undersecretary of Forensic Sciences (undersecretary) of the Executive Office of Public Safety and Security (EOPSS) requesting promulgation of regulations regarding treatment and eventual destruction of voluntarily provided DNA samples. Both letters went without reply.

Amato filed this action in June, 2008, against the district attorney, the crime lab, EOPSS, and the undersecretary. His amended complaint asserted three claims: (1) a FIFA violation, G. L. c. 66A; (2) invasion of statutory privacy rights, G. L. c. 214, § IB; and (3) breach of contract. After the filing, the district attorney returned Amato’s DNA sample sometime in October, 2008. The district attorney has not returned other voluntarily provided DNA samples, and the crime lab continues to hold the DNA profiles and other records of the samples given by Amato and the other men.

Upon the defendants’ rule 12(b)(6) motion, the judge, in a thoughtful, comprehensive memorandum of decision, dismissed all three claims against all the defendants. This appeal followed.7

2. Standard of review. We review the decision to dismiss Amato’s complaint de novo,8 accepting as true all allegations in the complaint and drawing any reasonable inferences in the plaintiff’s favor. Curtis v. Herb Chambers I-95, Inc., 458 Mass. 674, 676 (2011). “[W]e look beyond the conclusory allegations in the complaint and focus on whether the factual allegations plausibly suggest an entitlement to relief.” Ibid.

3. Discussion. The district attorney, confronting a challenging investigation, asked over 100 men to provide DNA samples voluntarily. Amato and the others had a reasonable expectation *235of privacy in the bodily fluids they contributed and, accordingly, a constitutional right to be free from such a search absent a warrant issued upon a showing of probable cause. See Jansen, petitioner, 444 Mass. 112, 120-121 (2005); Commonwealth v. Cabral, 69 Mass. App. Ct. 68, 72 (2007). See also Horsemen’s Benevolent & Protective Assn. v. State Racing Commn., 403 Mass. 692, 700 (1989) (“an individual has reasonable expectations of privacy regarding the information which can be extracted from a urine specimen”); Guiney v. Police Commr. of Boston, 411 Mass. 328, 332 (1991) (“This court has never approved the nonconsensual taking of blood or urine of a person in the absence of a demonstrated, particularized basis for doing so”). Amato has pleaded, and we take as true, that he and the other men consented to such a search based on promises, made by the district attorney through the State police detectives acting on his behalf, of limited use and retention of the samples provided and the resulting records.

Clearly, the district attorney’s innovative approach worked. The perpetrator, McCowen, voluntarily provided biological evidence that matched that from the crime scene. He has been successfully prosecuted, and the conviction has withstood appellate scmtiny. But now that the difficult investigation has concluded, Amato has pleaded, and we take as true, that the defendants have broken their limited use and retention pledges to him and the others.

In response, the defendants assert a variety of arguments that, if accepted, would make the breaking of their pledges to Amato and the others per se reasonable and immune from judicial consideration. Given the circumstances under which the defendants induced Amato and the others to allow access to this intensely private information, including the promises of limited use and retention and the concomitantly restricted scope of consent granted, we are not convinced that the defendants have acted reasonably as matter of law.

Accordingly, we conclude that Amato may pursue his claims for equitable relief. We discuss each individual claim in turn.

a. Fair Information Practices Act. General Laws c. 66A, § 2(1), inserted by St. 1977, c. 691, § 12, provides, in relevant part, that government agencies shall “not collect or maintain more *236personal data than are reasonably necessary for the performance of [their] statutory functions.” Any agency “which violates . . . any of the provisions of [G. L. c. 66A] shall be subject to an action for injunction, declaratory judgment, or mandamus.” G. L. c. 214, § 3B, inserted by St. 1975, c. 776, § 3. Because Amato’s factual allegations plausibly suggest that the district attorney and the crime lab have violated G. L. c. 66A, § 2(1),9 he may pursue the equitable remedies authorized by G. L. c. 214, § 3B.10

Violations of any provision of FIFA give rise to a cause of action by a “data subject,” G. L. c. 66A, § 1, to enforce the statute, G. L. c. 214, § 3B. See Tivnan v. Registry of Motor Vehicles, 50 Mass. App. Ct. 96, 98-99 (2000). Once a data subject credibly alleges a FIFA violation, the burden falls on the agency to make an evidentiary showing justifying its action as to the individual data subject. See Torres v. Attorney Gen., 391 Mass. 1, 9-11 (1984); Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 418 (1988).

Here, Amato has pleaded that the defendants collected his DNA profile and other associated records in 2002, some nine years ago; when he consented to provide a DNA sample, he was assured that it and any associated records would be promptly destroyed if the DNA analysis did not match the crime scene evidence; notwithstanding this promise, the defendants reversed their position and presently maintain these records after the completion of their statutory function of securing McCowen’s conviction; and, finally, by keeping these records, the defendants, in essence, maintain a shadow DNA database outside the statutorily authorized State convicted offender database governed by G. L. c. 22E, and the FBI’s CODIS database.

These allegations, taken as true, plausibly suggest that the *237defendants have maintained more personal data11 than reasonably necessary to carry out their statutory functions. The defendants, however, argue that their retention of Amato’s DNA profile and other records is reasonable as matter of law because (1) G. L. c. 66A, § 2(0, does not require an agency to destroy or return personal data when no longer reasonably necessary; (2) the Massachusetts Statewide records retention schedule (retention schedule) sets forth per se reasonable retention periods for homicide investigation records and crime lab case records; and (3) “nothing in FIFA requires the [defendants] to litigate the merits of a pending criminal appeal in a collateral civil action.” We are not persuaded.

First, we reject the defendants’ argument that G. L. c. 66A, § 2(1), addresses only unreasonable collection, not maintenance, of personal data, and, accordingly, imposes no obligation to destroy or return personal data after a reasonable time. The statute prohibits both unreasonable collection and unreasonable maintenance. G. L. c. 66A, § 2(1). In the face of its plain language, we cannot artificially limit the statute’s operation to acts of collection. Guzman v. Commonwealth, 458 Mass. 354, 361 (2010) (“Unless the plain meaning of the statute requires it, we will not expand or limit its meaning”). The defendants’ interpretation would also have us read out the word “maintain.” This, too, we may not do.12 Commonwealth v. Millican, 449 Mass. 298, 300 (2007).

*238“Maintain” means, as relevant here, “to continue (something)” or “[t]o continue in possession of (property, etc.).” Black’s Law Dictionary 1039 (9th ed. 2009). A statutory requirement that an agency cannot “maintain more personal data than are reasonably necessary” therefore demands that the agency not continue in possession of personal data when doing so is no longer reasonably necessary. The statute therefore permits Amato to seek the remedy of return or destruction of his allegedly unreasonably-maintained DNA profile and associated records.

Second, the defendants argue that the retention schedule, a document promulgated by the records conservation board (board)13 pursuant to G. L. c. 30, § 42, sets forth retention periods which, for FIFA purposes, constitute a per se reasonable time to maintain the records.14 We disagree. The retention schedule is not a regulation as defined by G. L. c. 30A, § 1(5).15 It lacks the force and effect of law. See Global NAPs, Inc. v. Awiszus, 457 Mass. 489, 496-497 (2010); Golchin v. Liberty Mut. Ins. Co., 460 Mass. 222, 230 (2011). Contrast, e.g., Solomon v. School Comm. of Boston, 395 Mass. 12, 16 (1985). The retention schedule must therefore yield to a duly enacted statute like FIFA.16 Global NAPs, *239Inc. v. Awiszus, supra. See Massachusetts State Pharmaceutical Assn. v. Rate Setting Commn., 387 Mass. 122, 127 (1982); Solomon v. School Comm. of Boston, supra.

Third, the defendants argue that FIFA does not require them to defend, in litigation, their decision to retain these records while the underlying criminal matter is pending on direct appeal. Assuming without deciding that the defendants’ argument is correct, the argument is now moot because the underlying criminal matter is no longer pending on direct review.17 See Mancuso v. Massachusetts Interscholastic Athletic Assn., 453 Mass. 116, 133 n.31 (2009).

b. Invasion of privacy.18 The statute governing invasion of privacy claims, G. L. c. 214, § IB, inserted by St. 1974, c. 193, § 1, provides:

“A person shall have a right against unreasonable, substantial or serious interference with his privacy. The superior court shall have jurisdiction in equity to enforce such right and in connection therewith to award damages.”

“[T]he Legislature appears to have framed [G. L. c. 214, *240§ IB,] in broad terms so that the courts can develop the law thereunder on a case-by-case basis, by balancing relevant factors . . . and by considering prevailing societal values and the ability to enter orders which are practical and capable of reasonable enforcement” (citation omitted). Schlesinger v. Merrill Lynch, Pierce, Fenner & Smith, Inc., 409 Mass. 514, 519 (1991). Most G. L. c. 214, § 1B, cases involve “public disclosure of private facts.” Ayash v. Dana-Farber Cancer Inst., 443 Mass. 367, 382 n.16 (2005), cert. denied sub. nom. Globe Newspaper Co. v. Ayash, 546 U.S. 927 (2005). In such cases, the plaintiff must prove that disclosure or dissemination occurred. See id. at 382.

The statute proscribes other conduct as well. See id. at 382 n.16; Schlesinger v. Merrill Lynch, Pierce, Fenner & Smith, Inc., supra at 519-520; Prosser & Keeton, Torts § 117, at 851-866 (5th ed. 1984). See also Cort v. Bristol-Myers Co., 385 Mass. 300, 307 & n.9 (1982); Bratt v. International Bus. Machs. Corp., 392 Mass. 508, 517 n.14 (1984). Such conduct includes unreasonable intrusion upon a person’s right to seclusion. Ayash v. Dana-Farber Cancer Inst., supra. Pursuing a G. L. c. 214, § 1B, claim on this theory does not require proof of dissemination.19 See id. at 382 n.16; Schlesinger v. Merrill Lynch, Pierce, Fenner & Smith, Inc., supra at 517.

DNA information is highly sensitive. Citizens have a reasonable expectation of privacy in such information. See Landry v. Attorney Gen., 429 Mass. 336, 354 n.20 (1999), cert. denied, 528 U.S. 1073 (2000) (upholding State convicted offender database created by G. L. c. 22E as constitutional; however, “the indefinite storage of the entire DNA sample . . . creates some concern that the samples could be misused at some point in the future to search for and disclose private genetic information” [emphasis added]).20 See also Horsemen’s Benevolent & Protecfive Assn. v. State Racing Commn., 403 Mass. at 700 (discussing *241sensitive information discoverable through urinalysis); Commonwealth v. Cabral, 69 Mass. App. Ct. at 72, and cases cited. Amato has pleaded that the defendants continue to hold this highly sensitive information beyond the scope of the limited consent he gave at the time he provided the sample. Contrast O’Connor v. Police Commr. of Boston, 408 Mass. 324, 329-331 (1990). Amato has also pleaded that the defendants’ retention of up to 200 DNA profiles constitutes a shadow DNA database,21 with its constituent records available for disclosure by comparison in other criminal investigations.

The allegations that the defendants have retained Amato’s highly sensitive DNA records without his consent and made them available for nonconsensual use in other criminal investigations are sufficient to constitute an unreasonable,22 substantial, and serious interference with Amato’s privacy. These allegations therefore suffice to state a G. L. c. 214, § IB, claim.

c. Breach of contract. The district attorney and the crime lab23 argue that, in light of the requirements of the retention schedule, the State police detective who promised Amato the limited use and retention of his DNA sample and associated records lacked authority to bind the defendants. The defendants further argue that, in the absence of such authority, estoppel *242principles cannot apply to bind the defendants to the detective’s promise. Because we conclude that the detective had the authority to promise as he did, we disagree.24

The detective, acting in the course of the district attorney’s investigation, see G. L. c. 38, § 4, second par., had the authority to bind the defendants to the scope of consent granted to search. “[I]t is a suspect’s right to limit the scope of a search to which he consents” (emphasis added). Commonwealth v. Gaynor, 443 Mass. 245, 256 (2005), citing Florida v. Jimeno, 500 U.S. 248, 252 (1991). The defendants’ argument that a law enforcement officer’s promise to a suspect cannot bind his superiors would render this right to limit consent to a search meaningless.25 See ibid. See also id. at 253 (“a warrant [is] required for a search and seizure for purposes beyond the self limiting representation of police”). We therefore reject the defendants’ argument as to the scope of the detective’s authority and hold that Amato has adequately stated a breach of contract claim.26

4. Conclusion. The judgment is reversed, and the matter is remanded for further proceedings consistent with this opinion.

So ordered.