N.Y. Comp. Codes R. & Regs. tit. 12 § 450.12

Current through Register Vol. 46, No. 51, December 18, 2024

Section 450.12 - Access to personal information (Personal Privacy Protection Law)

(a)Purpose and scope.

(1) It is the responsibility and the intent of the State Insurance Fund to fully comply with the provisions of article 6-A of the Public Officers Law, the Personal Privacy Protection Law.

(2) The State Fund shall maintain in its records only such personal information that is relevant and necessary to accomplish a purpose of the State Fund that is required to be accomplished by statute or executive order, or to implement a program specifically authorized by law.

(3) Personal information will be collected, whenever practicable, directly from the person to whom the information pertains.

(4) The State Fund seeks to ensure that all records pertaining to or used with respect to individuals are accurate, relevant, timely and complete.

(5) This section provides information regarding the procedures by which members of the public may assert rights granted by the Personal Privacy Protection Law.

(b)Designation of privacy compliance officer.

(1) The Director of Administration, is hereby designated privacy compliance officer and is responsible for ensuring that the State Fund complies with the provisions of the Personal Privacy Protection Law and this section and for coordinating the State Fund's response to requests for records or amendment of records.

(2) The address and telephone number of the privacy compliance officer is:

199 Church Street

New York, NY 10007

(212) 312-9000

(3) Deputy privacy compliance officers, their titles, addresses and telephone numbers, are hereby designated as follows:

District Office Manager 15 Computer Drive West Albany, NY 12205 (518) 485-8800

District Office Manager 225 Oak Street Buffalo, NY 14203 (716) 851-2000

District Office Manager 159 North Franklin Street Hempstead, NY 11550 (516) 538-7800

District Office Manager 2950 Expressway Drive South Islandia, NY 11722 (516) 233-3700

District Office Manager 1045 7th North Street Liverpool, NY 13088 (315) 453-6500

District Office Manager 1000 Marine Midland Plaza Rochester, NY 14604 (716) 258-2000

District Office Manager 701 Westchester Avenue Suite 100E White Plains, NY 10604 (914) 997-4800

(4) The privacy compliance officer and/or his deputies are responsible for:

(i) assisting a data subject in identifying and requesting personal information, if necessary;

(ii) describing the contents of systems of records orally or in writing in order to enable a data subject to learn if a system of records includes a record or personal information identifiable to a data subject requesting such record or personal information;

(iii) taking one of the following actions upon locating the record sought:

(a) make the record available for inspection, in a printed form without codes or symbols, unless an accompanying document explaining such codes or symbols is also provided;

(b) permit the data subject to copy the record; or

(c) deny access to the record in whole or in part and explain in writing the reasons therefor;

(iv) making a copy available, upon request, upon payment of or offer to pay established fees, if any, or permitting the data subject to copy the records;

(v) upon request, certifying that a copy of a record is a true copy; or

(vi) certifying, upon request, that:

(a) the State Fund does not have possession of the record sought;

(b) the State Fund cannot locate the record sought after having made a diligent search; or

(c) the information sought cannot be retrieved by use of the description thereof, or by use of the name or other identifier of the data subject without extraordinary search methods being employed by the State Fund.

(c)Proof of identity.

(1) When a request is made in person, or when records are made available in person following a request made by mail, the State Fund may require appropriate identification, such as a driver's license, an identifier assigned to the data subject by the State Fund, a photograph, or similar information that confirms that the record sought pertains to the data subject.

(2) When a request is made by mail, the State Fund may require verification of a signature or inclusion of an identifier generally known only by a data subject, or similar appropriate identification.

(3) Proof of identity shall not be required regarding a request for a record accessible to the public pursuant to article 6 of the Public Officers Law.

(d)Location.

(1) Records shall be made available at the main office of the State Fund, which is located at 199 Church Street, New York, NY 10007.

(2) Whenever practicable, records shall be made available at a regional office most convenient to a data subject. Regional offices are located at:

15 Computer Drive West, Albany, NY 12205

225 Oak Street, Buffalo, NY 14203

159 North Franklin Street, Hempstead, NY 11550

2950 Expressway Drive South, Islandia, NY 11722

1045 7th North Street, Liverpool, NY 13088

1000 Marine Midland Plaza, Rochester, NY 14604

701 Westchester Avenue, Suite 100E, White Plains, NY 10604

(e)Hours for public inspection and copying.

The State Fund shall accept requests for records and produce records during regular business hours, which are 8:45 a.m. to 5 p.m.

(f)Requests for records.

(1) All requests shall be made in writing, except that the State Fund may make records available upon an oral request made in person after the applicant has demonstrated proof of identity.

(2) A request shall reasonably describe the record sought. Whenever possible, the data subject should supply identifying information that assists the State Fund in locating the records sought.

(3) Requests based upon categories of information described in a notice of a system of records or a privacy impact statement shall be deemed to reasonably describe the record sought.

(4) Within five business days of the receipt of a request, the State Fund shall provide access to the record, deny access in writing explaining the reasons therefor, or acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which date shall not exceed 30 days from the date of the acknowledgment.

(g)Amendment of records.

Within 30 business days of a request from a data subject, for correction or amendment of a record or personal information that is reasonably described and that pertains to the data subject, the State Fund shall:

(1) make the amendment or correction in whole or in part and inform the data subject that, on request, such correction or amendment will be provided to any person or governmental unit to which the record or personal information has been or is disclosed pursuant to paragraph (d), (i) or (l) of subdivision 1 of section 96 of the Public Officers Law; or

(2) inform the data subject in writing of its refusal to correct or amend the record, including the reasons therefor.

(h) Denial of request for a record or amendment or correction of a record or personal information.

(1) Denial of a request for records or amendment or correction of a record or personal information shall be in writing, explaining the reasons therefor and identifying the person to whom an appeal may be directed.

(2) A failure to grant or deny access to records within five business days of the receipt of a request or within 30 days of an acknowledgment of the receipt of a request, or a failure to respond to a request for amendment or correction of a record within 30 business days of receipt of such a request, shall be construed as a denial that may be appealed.

(3) Any such denial may be appealed to:

Executive Director

199 Church Street

New York, NY 10007

(i)Appeal.

(1) Any person denied access to a record or denied a request to amend or correct a record or personal information pursuant to subdivision (h) of this section may, within 30 days of such denial, appeal to the executive director.

(2) The time for deciding an appeal shall commence upon receipt of an appeal that identifies:

(i) the date and location of a request for a record or amendment or correction of a record or personal information;

(ii) the record that is the subject of the appeal; and

(iii) the name and return address of the appellant.

(3) Within seven business days of an appeal of a denial of access, or within 30 days of an appeal concerning a denial of a request for correction or amendment, the person determining such appeals shall:

(i) provide access to or correct or amend the record or personal information; or

(ii) fully explain in writing the factual and statutory reasons for further denial and inform the data subject of the right to seek judicial review of such determination pursuant to article 78 of the Civil Practice Law and Rules.

(4) If, on appeal, a record or personal information is corrected or amended, the data subject shall be informed that, on request, the correction or amendment will be provided to any person or governmental unit to which the record or personal information has been or is disclosed pursuant to paragraph (d), (i) or (l) of subdivision 1 of section 96 of the Public Officers Law.

(5) The State Fund shall immediately forward to the Committee on Open Government a copy of any appeal made pursuant to this section upon receipt, the determination thereof and the reasons therefor at the time of such determination.

(j)Statement of disagreement by data subject.

(1) If correction or amendment of a record or personal information is denied in whole or in part upon appeal, the determination rendered pursuant to the appeal shall inform the data subject of the right to:

(i) file with the State Fund a statement of reasonable length setting forth the data subject's reasons for disagreement with the determination; and

(ii) request that such a statement of disagreement be provided to any person or governmental unit to which the record has been or is disclosed pursuant to paragraph (d), (i) or (l) of subdivision 1 of section 96 of the Public Officers Law.

(2) Upon receipt of a statement of disagreement by a data subject, the State Fund shall:

(i) clearly note any portions of the record that are disputed; and

(ii) attach the data subject's statement as part of the record.

(3) When providing a data subject's statement of disagreement to a person or governmental unit in conjunction with a disclosure made pursuant to paragraph (d), (i) or (l) of subdivision 1 of section 96 of the Public Officers Law, the State Fund may also include a concise statement of its reasons for not making the requested amendment or correction.

(k)Fees.

(1) Unless otherwise prescribed by statute, there shall be no fee charged for:

(i) inspection of records;

(ii) search for records; or

(iii) any certification pursuant to this Part.

(2) Unless otherwise prescribed by statute, copies of records shall be provided:

(i) at a rate of 25 cents per page of up to 9 by 14 inches; or

(ii) upon payment of the actual cost of reproduction, if the record or personal information cannot be photocopied.

(3) The actual cost of reproduction shall be based upon the average unit cost for copying a record, excluding fixed costs of the State Fund, such as operator salaries and overhead.

(l)Severability.

If any provision of this section or the application thereof to any person or circumstances is adjudged invalid by a court of competent jurisdiction, such judgment shall not affect or impair the validity of the other provisions of this section of the application thereof to other persons and circumstances.

N.Y. Comp. Codes R. & Regs. Tit. 12 § 450.12