Current through Register Vol. 46, No. 12, March 20, 2024
(a) The privacy compliance officer and deputy
privacy compliance officers shall be designated by the general counsel from
among the counsels, associate attorneys and attorneys in the office of general
counsel in the department's Albany and New York City offices and shall be
responsible for ensuring that the department complies with the provisions of
the Personal Privacy Protection Law and the regulations herein and for
coordinating the agency's response to requests for records and amendment of
records.
(b) The address and
telephone number of the privacy compliance officer is:
Office of General Counsel
Insurance Department
One Commerce Plaza
Albany, NY 12257
(518) 473-0785
and
Office of General Counsel
Insurance Department
25 Beaver Street
New York, NY 10004
(212) 480-5259
(c) The privacy compliance officer
and/or his deputies are responsible for:
(1)
assisting a data subject in identifying and requesting personal information, if
necessary;
(2) describing the
contents of systems of records, orally or in writing, in order to enable a data
subject to learn if a system of records includes a record or personal
information identifiable to a data subject requesting such record or personal
information;
(3) taking one of the
following actions upon locating the record sought:
(i) make the record available for inspection,
in a printed form without codes or symbols, unless an accompanying document
explaining such codes or symbols is also provided;
(ii) permit the data subject to copy the
records; or
(iii) deny access to
the record, in whole or in part, and explain in writing the reasons
therefor;
(4) making a
copy available, upon request, upon payment of or offer to pay established fees,
if any, or permitting the data subject to copy the record;
(5) upon request, certifying that a copy of a
record is a true copy; and
(6)
certifying, upon request, that:
(i) the
agency does not have possession of the record sought;
(ii) the agency cannot locate the record
sought after having made a diligent search; or
(iii) the information sought cannot be
retrieved by use of the description thereof, or by use of the name or other
identifier of the data subject without extraordinary search methods being
employed by the agency.
