N.Y. Comp. Codes R. & Regs. tit. 11, § 242.2 – Designation of privacy compliance officer.

(a) The privacy compliance officer and deputy privacy compliance officers shall be designated by the general counsel from among the counsels, associate attorneys and attorneys in the office of general counsel in the department's Albany and New York City offices and shall be responsible for ensuring that the department complies with the provisions of the Personal Privacy Protection Law and the regulations herein and for coordinating the agency's response to requests for records and amendment of records.
(b) The address and telephone number of the privacy compliance officer is:
Office of General Counsel
Department of Financial Services
One Commerce Plaza
Albany, NY 12257
(518) 473-3795
and
Office of General Counsel
Department of Financial Services
One State Street
New York, NY 10004
(212) 480-5287
(c) The privacy compliance officer and/or his deputies are responsible for:
1. (1) assisting a data subject in identifying and requesting personal information, if necessary;
2. (2) describing the contents of systems of records, orally or in writing, in order to enable a data subject to learn if a system of records includes a record or personal information identifiable to a data subject requesting such record or personal information;
3. (3) taking one of the following actions upon locating the record sought:
  1. (i) make the record available for inspection, in a printed form without codes or symbols, unless an accompanying document explaining such codes or symbols is also provided;
  2. (ii) permit the data subject to copy the records; or
  3. (iii) deny access to the record, in whole or in part, and explain in writing the reasons therefor;
4. (4) making a copy available, upon request, upon payment of or offer to pay established fees, if any, or permitting the data subject to copy the record;
5. (5) upon request, certifying that a copy of a record is a true copy; and
6. (6) certifying, upon request, that:
  1. (i) the agency does not have possession of the record sought;
  2. (ii) the agency cannot locate the record sought after having made a diligent search; or
  3. (iii) the information sought cannot be retrieved by use of the description thereof, or by use of the name or other identifier of the data subject without extraordinary search methods being employed by the agency.