N.Y. Comp. Codes R. & Regs. tit. 19 § 226.5
When the Division of Consumer Protection acts on behalf of a consumer to investigate, mediate and/or mitigate an identity theft complaint, the Division may require substantiating and/or supporting documentation and/or records from any State agency, including the Division of State Police, State public authority, municipal department or agency, county or municipal police department, and any non-governmental entity, including, but not limited to, consumer credit reporting agencies. A consumer credit reporting agency shall comply with the written request of the Division for such documentation and/or records within 10 business days of service of such request, consistent with applicable laws and this Part.
N.Y. Comp. Codes R. & Regs. Tit. 19 § 226.5