§ 94 — Agency obligations

§ 94. Agency obligations. (1) Each agency that maintains a system of\nrecords shall:\n (a) except when a data subject provides an agency with unsolicited\npersonal information, maintain in its records only such personal\ninformation which is relevant and necessary to accomplish a purpose of\nthe agency required to be accomplished by statute or executive order, or\nto implement a program specifically authorized by law;\n (b) consistent with the standards of paragraph (a) of this\nsubdivision, maintain all records used by the agency to make any\ndetermination about any data subject with accuracy, relevance,\ntimeliness and completeness provided however, that personal information\nor records received by an agency from another governmental unit for\ninclusion in public safety agency records shall be presumed to be\naccurate;\n (c) collect personal information directly from the data subject\nwhenever practicable, except when collected for the purpose of making\nquasi-judicial determinations;\n (d) provide each data subject whom it requests to supply information\nto be maintained in a record, at the time of the initial request, with\nnotification as provided in this paragraph. Where such notification has\nbeen provided, subsequent requests for information from the data subject\nto be maintained in the same record need not be accompanied by\nnotification unless the initial notification is not applicable to the\nsubsequent request. Notification shall include:\n (i) the name of the agency and any subdivision within the agency that\nis requesting the personal information and the name or title of the\nsystem of records in which such information will be maintained;\n (ii) the title, business address and telephone number of the agency\nofficial who is responsible for the system of records;\n (iii) the authority granted by law, which authorizes the collection\nand maintenance of the information;\n (iv) the effects on such data subject, if any, of not providing all or\nany part of the requested information;\n (v) the principal purpose or purposes for which the information is to\nbe collected; and\n (vi) the uses which may be made of the information pursuant to\nparagraphs (b), (e) and (f) of subdivision one of section ninety-six of\nthis article;\n (e) ensure that no record pertaining to a data subject shall be\nmodified or destroyed to avoid the provisions of this article;\n (f) cause the requirements of this article to be applied to any\ncontract it executes for the operation of a system of records, or for\nresearch, evaluation or reporting, by the agency or on its behalf;\n (g) establish written policies in accordance with law governing the\nresponsibilities of persons pertaining to their involvement in the\ndesign, development, operation or maintenance of any system of records,\nand instruct each such person with respect to such policies and the\nrequirements of this article, including any other rules and regulations\nand procedures adopted pursuant to this article, and the penalties for\nnoncompliance;\n (h) establish appropriate administrative, technical and physical\nsafeguards to ensure the security of records;\n (i) establish rules governing retention and timely disposal of records\nin accordance with law;\n (j) designate an agency employee who shall be responsible for ensuring\nthat the agency complies with all of the provisions of this article;\n (k) whenever a data subject is entitled under this article to gain\naccess to a record, disclose such record at a location near the\nresidence of the data subject whenever reasonable, or by mail;\n (l) upon denial of a request under subdivision one or two of section\nninety-five of this article, inform the data subject of its procedures\nfor review of initial determinations and the name and business address\nof the reviewing officials.\n (2) In order to carry out the provisions of this article each agency\nthat maintains a system of records shall promulgate rules which shall\nset forth the following:\n (a) procedures by which a data subject can learn if a system of\nrecords contains any records pertaining to him or her;\n (b) reasonable times, places and means for verifying the identity of a\ndata subject who requests access to his or her record;\n (c) procedures for providing access, upon the data subject's request,\nto the data subject's record;\n (d) procedures for reviewing a request from a data subject for access\nto, and for correction or amendment of his or her record, for making a\ndetermination on such request, and for an appeal within the agency of an\ninitial adverse agency determination.\n (3) Each agency, for disclosures made pursuant to paragraphs (d), (i)\nand (l) of subdivision one of section ninety-six of this article, except\nfor disclosures made for inclusion in public safety agency records when\nsuch record is requested for the purpose of obtaining information\nrequired for the investigation of a violation of civil or criminal\nstatutes within the disclosing agency, shall:\n (a) keep an accurate accounting of the date, nature and purpose of\neach disclosure of a record or personal information, and the name and\naddress of the person or governmental unit to whom the disclosure is\nmade;\n (b) retain the accounting made under paragraph (a) of this subdivision\nas part of said record for at least five years after the disclosure for\nwhich the accounting is made, or for the life of the record disclosed,\nwhichever is longer;\n (c) at the request of the data subject, inform any person or other\ngovernmental unit to which a disclosure has been or is made of any\ncorrection, amendment, or notation of dispute made by the agency,\nprovided that an accounting of the prior disclosure was made or that the\ndata subject to whom the record pertains provides the name of such\nperson or governmental unit;\n (d) with respect to a disclosure made for inclusion in a public safety\nagency record or to a governmental unit or component thereof whose\nprimary function is the enforcement of civil or criminal statutes,\nnotify the receiving governmental unit that an accounting of such\ndisclosure is being made pursuant to this subdivision and that such\naccounting will be accessible to the data subject upon his or her\nrequest unless otherwise specified by the receiving governmental unit\npursuant to paragraph (e) of this subdivision;\n (e) with respect to a disclosure made for inclusion in a public safety\nagency record or to a governmental unit or component thereof whose\nprimary function is the enforcement of civil or criminal statutes, if in\nits request for the record the receiving governmental unit states that\nit has determined that access by the data subject to the accounting of\nsuch disclosure would impede criminal investigations and specifies the\napproximate date on which such determination will no longer be\napplicable, refuse the data subject access to such accounting or\ninformation that such accounting has been made, except upon court\nordered subpoena, during the applicable time period. Upon the expiration\nof said time period the disclosing agency shall inquire of the receiving\ngovernmental unit as to the continued relevancy of the initial\ndetermination and, unless requested in writing by the receiving\ngovernmental unit to extend the determination for a specified period of\ntime, shall make available to the data subject an accounting of said\ndisclosure; and\n (f) in making a disclosure pursuant to subdivision one of section\nninety-six of this article, an agency shall make such disclosure\npursuant to paragraph (d), (i) or (l) of said subdivision only when such\ndisclosure cannot be made pursuant to any other paragraph of said\nsubdivision.\n (4) (a) Any agency which established or substantially modified a\nsystem of records after December fifteenth, nineteen hundred eighty, but\nbefore the effective date of this article, or which did not report to\nthe committee a system of records which it maintained prior to December\nfifteenth, nineteen hundred eighty, shall file notice with the committee\npursuant to chapter six hundred seventy-seven of the laws of nineteen\nhundred eighty within thirty business days of the effective date of this\narticle.\n (b) Any agency which seeks to establish a system of records subsequent\nto the effective date of this article shall file with the committee a\nprivacy impact statement as prescribed by subdivision four of section\nninety-three of this article. Any agency which seeks to modify a system\nof records in a way which would render inaccurate any information set\nforth in the privacy impact statement, in the notice described in\nparagraph (a) of this subdivision or in the notice filed pursuant to\nchapter six hundred seventy-seven of the laws of nineteen hundred\neighty, shall file with the committee a supplemental statement to\nconform the privacy impact statement or notice to the proposed\nmodification. Unless the date by which such proposed system or\nmodification is required by law to be instituted is less than thirty\nbusiness days from the date of the filing of the privacy impact\nstatement, no such proposed system or modification shall be instituted\nuntil the completion of the procedures set forth in subdivision three of\nsection ninety-three of this article.\n (5) Each agency shall, within fifteen business days of the receipt of\nan advisory opinion issued by the committee, respond in writing to the\ncommittee as to the following:\n (a) the actions it has taken, or will take, to comply with the\nadvisory opinion; or\n (b) the reasons for disagreement and noncompliance with the advisory\nopinion.\n (6) On or before the first day of September of each year, each agency\nshall submit a report covering the preceding year to the committee. The\nreport shall include, with respect to requests for access to records and\nwith respect to requests for correction or amendment of records pursuant\nto subdivisions one and two of section ninety-five of this article,\nrespectively, the following information:\n (i) the number of determinations made to grant such requests; and\n (ii) the number of determinations made to deny such requests, in whole\nor in part, respectively.\n (7) The provisions of paragraphs (c) and (d) of subdivision one of\nthis section shall not apply to the following:\n (a) personal information that is collected for inclusion in a public\nsafety agency record;\n (b) personal information that is maintained by a licensing or\nfranchise-approving agency or component thereof for the purpose of\ndetermining whether administrative or criminal action should be taken to\nrestrain or prosecute purported violations of law, or to grant, deny,\nsuspend, or revoke a professional, vocational, or occupational license,\ncertification or registration, or to deny or approve a franchise;\n (c) personal information solicited from a data subject receiving\nservices at a treatment facility, provided that each such data subject\nshall, as soon as practicable, be provided a notification including\ninformation specified in subparagraphs (i), (ii), (iii), (iv), (v) and\n(vi) of paragraph (d) of subdivision one of this section describing\nsystems of records concerning the data subject maintained by the\ntreatment facility.\n (8) The provisions of subdivisions two, three and six of this section\nshall not apply to public safety agency records.\n (9) Nothing in this article shall abrogate in any way any obligation\nregarding the maintenance of records otherwise imposed on an agency at\nlaw or in equity.\n (10) Each agency record which is transferred to the state archives as\na record which has sufficient historical or other value to warrant its\ncontinued preservation by the state shall, for the purposes of this\narticle, be considered to be maintained by the state archives and shall\nbe exempt from the requirements of this article, except as otherwise\nprovided in this section and except that such record shall continue to\nbe subject to inspection and correction by the data subject by\napplication to the agency which compiled it, as provided in subdivisions\none through four of section ninety-five of this chapter.\n