§ 93 — Powers and duties of the committee

§ 93. Powers and duties of the committee. (1) The committee shall\nprepare a directory derived from the information provided pursuant to\nsection three of chapter six hundred seventy-seven of the laws of\nnineteen hundred eighty and subdivision four of section ninety-four of\nthis article. The directory shall include the name of each system of\nrecords subject to the provisions of this article, the name and\nsubdivision of the agency maintaining it, the title and business address\nof the person responsible therefor, the approximate number of data\nsubjects and the categories of information collected, and sufficient\ninformation for the identification of rules promulgated by agencies\npursuant to this article. Individuals shall be permitted to purchase the\ndirectory for a reasonable price as set by the committee in accordance\nwith law.\n (2) The committee may, upon request of a data subject eligible to make\na request under section ninety-five of this article, investigate, make\nfindings and furnish an advisory opinion in connection with the\nrequirements of section ninety-five of this article. Prior to the\nissuance of an advisory opinion, the committee may require an agency to\nprovide additional information which the committee deems necessary to\nrender an opinion. However, no system of records exempt from the\nprovisons of section ninety-five of this article shall be subject to the\nprovisions of this subdivision.\n (3) Within thirty business days of the receipt of a privacy impact\nstatement or supplemental statement by an agency the committee shall\nreview such statement to determine whether the maintenance of the system\nis within the lawful authority of the agency and to determine whether\nthere have been established rules and procedures as required by section\nninety-four of this article. However, such review by the committee shall\nnot include examination of personal information or records collected or\nmaintained by such agency. After review of such information the\ncommittee may notify the agency of the result of its review. Such\nnotification and result shall not constitute an advisory opinion and\nshall not be reported as such by the committee and there shall be no\nobligation upon the agency to respond to such notification or result.\n (4) The committee shall promulgate rules for the specification of the\nform of the privacy impact statement. Such privacy impact statement\nshall include the following:\n (a) the name of the agency and the subdivision within the agency that\nwill maintain the system of records, and the name or title of the system\nof records in which such information will be maintained;\n (b) the title and business address of the official within the agency\nresponsible for the system of records;\n (c) where applicable, the procedures by which a data subject may gain\naccess to personal information pertaining to such data subject in the\nsystem of records and the procedures by which a data subject may seek to\namend or correct its contents;\n (d) the categories and the approximate number of persons on whom\nrecords will be maintained in the system of records;\n (e) the categories of information which will be collected and\nmaintained in the system of records;\n (f) the purposes for which each category of information within the\nsystem of records will be collected and maintained;\n (g) the disclosures of personal information within the system of\nrecords that the agency will regularly make for each category of\ninformation, and the authority for such disclosures;\n (h) the general or specific statutory authority for the collection,\nmaintenance and disclosure of each category of information within the\nsystem of records;\n (i) policies governing retention and timely disposal of information\nwithin the system of records in accordance with law;\n (j) each and every source for each category of information within the\nsystem of records;\n (k) a statement indicating whether the system of records will be\nmaintained manually, by automated data system, or both.\n (5) The committee shall report its activities and findings, including\nrecommendations for changes in the law, to the governor and the\nlegislature annually, on or before December fifteenth.\n (6) In order to carry out the provisions of this article, the\ncommittee is authorized to:\n (a) enter into contracts or other arrangements or modifications\nthereof, with any government, any governmental unit, or any department\nof the state, or with any individual, firm, association or corporation\nwithin the amounts appropriated therefor and subject to the audit and\nwarrant of the state comptroller;\n (b) delegate any of its functions to such officers and employees of\nthe committee as the committee may designate;\n (c) establish model guidelines with respect to the implementation of\nthis article.\n