N.Y. Comp. Codes R. & Regs. Tit. 9 §§ 166-3.4

Current through Register Vol. 46, No. 50, December 11, 2024

Section 166-3.4 - Privacy impact statement; supplemental statement

(a) Before instituting a system of records, a privacy impact statement shall be submitted for review to the committee, which shall include the following information:

(1) the name of the unit within the division that will maintain the system of records, and the name or title of the system of records;

(2) the title and business address of the unit official responsible for the system of records;

(3) where applicable, the procedures by which a data subject may gain access to personal information pertaining to such data subject in the system of records and the procedures by which a data subject may seek to amend or correct its contents;

(4) the categories and the approximate number of persons on whom records will be maintained in the system of records;

(5) the categories of information which will be collected and maintained in the system of records;

(6) the purposes for which each category of information within the system of records will be collected and maintained;

(7) the disclosures of personal information within the system of records that will regularly be made for each category of information, and the authority for such disclosures;

(8) the general or specific statutory authority for the collection, maintenance and disclosure of each category of information, and the authority for such disclosures;

(9) policies governing retention and timely disposal of information within the system of records;

(10) each and every source for each category of information within the system of records;

(11) a statement indicating whether the system of records will be maintained manually, by automated data system, or both; and

(12) any other information required by rule of the committee adopted pursuant to the Public Officers Law, section 93(4).

(b) Before modifying a system of records in any way which would render inaccurate any information set forth in a privacy impact statement or a notice filed pursuant to chapter 677 of the Laws of 1980, a supplemental statement shall be submitted to the committee which shall conform the privacy impact statement or notice to the proposed modification.

N.Y. Comp. Codes R. & Regs. Tit. 9 §§ 166-3.4

Amended New York State Register December 23, 2015/Volume XXXVII, Issue 51, eff. 12/23/2015