(a) Any data subject whose request under section 365.4 or 365.5 of this Part is denied in whole or in part may, within 30 business days, appeal such denial in writing to the commissioner or the department's reviewing official at the department's main address. The commissioner or reviewing official shall, within seven business days of the receipt of an appeal concerning denial of access, or within 30 business days of the receipt of an appeal concerning denial of correction or amendment either:

1. (1) provide access to or correction or amendment of the record sought and inform the data subject that upon his or her request, such correction or amendment will be provided to any or all persons or governmental units to which the record or personal information has been or is disclosed, pursuant to paragraph (c) of subdivision 3 of section 94 of the Public Officers Law; or
2. (2) fully explain in writing to the data subject the factual and statutory reasons for further denial and inform the data subject of his or her right to seek judicial review of the department's determination pursuant to section 97 of the Public Officers Law.