Sec. 616.25. Requests for records

(a) All requests or voluntary consents shall be made in writing.

(b) A request shall reasonably describe the record sought and, if by someone other than the data subject, must state the uses which will be made of such personal information. Whenever possible, the individual should supply identifying information that assists the department in locating the records sought.

(c) Other than the data subject, other parties that may have access to personal records are officers, employees or contractors of the department if such disclosure is necessary to perform their duties and to those parties and for the uses set forth in paragraph (b) through (n) of section 96 of the Personal Privacy Protection Act of the Public Officers Law.

(d) Requests based upon categories of information described in a notice of a system of records or a privacy impact statement shall be deemed to reasonably describe the record sought. (Such notices and statements provide information about the department's maintenance and use of records containing personal information.)

(e) Within five business days of the receipt of a request, the department shall:

(1) provide access to the record;

(2) deny access in writing, explaining the reasons therefor; or

(3) acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied. This date shall not exceed 30 business days from the date of the acknowledgment.

(f) Nothing in this Part shall require disclosure of personal information which is otherwise prohibited by law from being disclosed.