1. (1) The office and the Child Support Enforcement Unit (CSEU) shall maintain all information and data, including information and data in the State automated child support management system (automated system), in a confidential manner designed to protect the privacy rights of the parties and shall not use or disclose information or data except for the purpose of, and to the extent necessary to establish parentage, to establish, modify or enforce an order of support, or to administer the child support program, unless otherwise authorized by law.

   1. (i) The information to be safeguarded includes all information or data obtained in connection with performance of child support functions, including records or information received in electronic form.
   2. (ii) The requirements of this section apply to the office and CSEU, any other State or local agency or official to whom the office or CSEU delegates any of the functions of the child support program, and any official, person or entity performing child support functions pursuant to a cooperative agreement or purchase of services agreement.

2. (2) Except as provided in subparagraphs (i) and (ii) of this paragraph, office and CSEU employees may access, use or disclose information and data obtained in connection with the performance of functions under title IV-D of the Federal Social Security Act to the extent necessary to perform their duties within the child support program. The office or CSEU shall monitor use of and access to the automated system to prevent unauthorized use or access by its employees or contractors.

   1. (i) Access to and use of any information from the Internal Revenue Service, including Federal tax return information, is restricted as specified in the Internal Revenue Code.

      1. (a) The CSEU shall prohibit disclosure of location information by entry of a family violence indicator, if requested by any person, where that person provides reasonable evidence of domestic violence or child abuse against a party or the child and that the disclosure of such information could be harmful to the party or the child, including but not limited to evidence that:

         1. (1) the person resides or has resided in a domestic violence shelter or is receiving non-residential domestic violence services;
         2. (2) a temporary or final protective order has been entered;
         3. (3) the person is enrolled in an address confidentiality program;
         4. (4) the person provides a domestic violence or child abuse incident report or police report which describes domestic violence or child abuse;
         5. (5) a court has determined that contact with the other party creates a risk of physical or emotional harm to the person or child;
         6. (6) a good cause exemption has been issued due to domestic violence; or
         7. (7) a family violence option waiver is granted by the social services district.
      2. (b) As used in this subparagraph, location information shall include residential address, employer name, employer address, county of residence or employment, or other information identifying an employer, educational institution, or residence of an individual.
      3. (c) Upon request by any authorized person for location information from an account or case where a family violence indicator has been entered, the social services district shall advise that the location information cannot be provided absent a determination by a court of competent jurisdiction that disclosure to any other person of that information would not be harmful to a party, parent or child.
      4. (d) Notice of entry or deletion of a family violence indicator shall be transmitted to the Federal Case Registry within five days of receipt of information which would cause entry or deletion of an indicator.

      (ii)

   2. (iii) All new employees of the office or of the CSEU or social services district with access to child support information shall receive training in the permitted use, disclosure, and safeguarding of this information, as well as the penalties for its misuse. All employees of the office or of the CSEU or social services district with access to child support information shall receive periodic training regarding these subjects.

3. (3) The office or CSEU may disclose the following information to individuals who are parties to a support order being collected or enforced by a CSEU except where disclosure is otherwise prohibited by law or pursuant to subparagraph (2)(ii) of this subdivision:

   1. (i) a party to the support order may obtain disclosure of any of his or her confidential information, information regarding case status and pending court appearances, and payment histories, except that information regarding an investigation of the parent or guardian for fraud or criminal prosecution shall not be disclosed;
   2. (ii) a custodial parent or guardian may obtain information regarding current or pending support proceedings or processes and disclosure of information of the noncustodial parent, including location, employment, income, and assets, but only to the extent necessary to prepare for an administrative or court proceeding or for other child support purposes; or
   3. (iii) a parent or guardian may grant written authorization to a third person, including an attorney, translator or legislator, to obtain disclosure of such information as he or she is entitled to obtain. The written authorization shall be valid for one year from the date signed or the date it is received by the CSEU, whichever is earlier, or until revoked by the parent or guardian in writing filed with the office or CSEU.

4. (4) Authorized disclosures to government agencies or programs.

   1. (i) The office or CSEU may, subject to such requirements as the office may prescribe, disclose information to State agencies as necessary to carry out State agency functions under plans or programs under titles IV (including tribal programs under title IV), XIX, or XXI of the Federal Social Security Act, and the Supplemental Nutrition Assistance Program, including:

      1. (a) Any investigation, prosecution or criminal or civil proceeding conducted in connection with the administration of any such plan or program.
      2. (b) Information on known or suspected instances of physical or mental injury, sexual abuse or exploitation, or negligent treatment or maltreatment of a child under circumstances which indicate that the child's health or welfare is threatened may be provided to the Statewide Central Register of Child Abuse and Maltreatment or a social services official charged with protection of children or a law enforcement officer; provided, however, that information obtained from financial institution data matches, the National or State Directory of New Hires or Federal or State Case Registry may not be disclosed absent independent verification.
      3. (c) The office or CSEU shall require agencies authorized to receive information to enter into agreements setting out the frequency, scope, and manner of information exchanges, and the limitations on use and re-disclosure of child support information. Agreements shall require that information disclosed to the agency or public official shall not be re-disclosed unless authorized by law and shall only be used for the purpose for which it is provided.

   2. (ii) Notwithstanding anything in this section to the contrary, information obtained from the following sources may only be used for the purpose of, and to the extent necessary to, establish parentage, establish, modify, or enforce an order of support or for the administration of the child support program:

      1. (a) records or information of other State and local agencies which may not be re-disclosed pursuant to State or Federal law;
      2. (b) business or financial records of corporations, companies or other entities;
      3. (c) records of financial institutions and utility or cable companies;
      4. (d) use and disclosure of Federal tax return information is restricted as specified in the Internal Revenue Code, and shall not be otherwise re-disclosed absent independent verification; and
      5. (e) information obtained from financial institution data matches shall not be disclosed outside the administration of the child support program.

   3. (iii) Notwithstanding any other provision of this section, authorized disclosures under this paragraph shall be subject to the following limitations:

      1. (a) Information in the automated system obtained from the national or State directory of new hires or Federal or State case registry may be disclosed to agencies administering plans or programs under title IV-B and IV-E of the Federal Social Security Act to locate parents, alleged parents or intended parents for the purposes of establishing parentage or establishing parental rights with respect to a child.
      2. (b) Information obtained from the national directory of new hires or Federal or State case registry may be disclosed to agencies administering plans or programs under titles IV-A, IV-B, IV-D and IV-E of the Federal Social Security Act for the purpose of assisting that program to carry out its responsibilities of administering title IV-A, IV-B, IV-D and IV-E programs.
      3. (c) Information regarding the employee’s name, Social Security number and address and the employer’s name, address, and Federal employer identification number obtained from the State directory of new hires may be disclosed to agencies administering plans or programs under title IV-A of the Federal Social Security Act for the purpose of verifying income and eligibility.

      4. (d) For purposes of this section, independent verification is the process of acquiring and confirming information through the use of a secondary source. The information from the secondary source, which verifies the original information, may only be released for purposes permitted by and to persons or entities authorized to receive the information under Federal and State law and these regulations.

         (5)

   4. (i) If information is requested by court-issued subpoena, the office or the CSEU shall oppose release of the information unless:

      1. (a) disclosure is not prohibited by law;
      2. (b) the party requesting the information is entitled to disclosure of the information requested without resort to legal process;
      3. (c) the subpoena is accompanied by a written consent to release of the information by the person or persons whose information is the subject of the request; or
      4. (d) disclosure is required by other provisions of law.
   5. (ii) If disclosure is not authorized, the office or CSEU shall move to quash the subpoena, or request that the child support agency in the state of the court issuing the subpoena take like steps to prevent the disclosure of the information. In instances where disclosure is prohibited due to the existence of a family violence indicator, the CSEU shall move that the court, pursuant to Federal law, hold a hearing to determine if disclosure could result in harm to a family member or former family member, on notice to that individual. In such cases, the information will only be released to the court.

5. (6) Any person who discloses or uses child support information in violation of law or regulation shall be subject to legal sanctions for such disclosure, including:

   1. (i) a civil action pursuant to section 111-v (3) of the Social Services Law by any person who incurs damages due to the improper use or disclosure;
   2. (ii) if willful, referral for criminal prosecution pursuant to section 111-v (4) of the Social Services Law and/or for official misconduct pursuant to section 195.00 of the Penal Law. Improper disclosure of Federal tax return information may be subject to additional Federal criminal penalties; and
   3. (iii) administrative penalties, including dismissal from employment.

6. (7) Security, confidentiality and compliance for information and data flowing through, accessed and/or utilized by non-state computerized systems.

   1. (i) Information integrity, security and compliance. The CSEU shall have safeguards, protocols and policies in place protecting the integrity, accuracy, completeness of, access to, and use of information and data in any social services district computerized system, as well as meeting all compliance requirements. As used herein, computerized system means any system, network, hardware, software, program, or application which stores, produces, utilizes, manages, processes, accounts for, transmits, or monitors information or data used by the CSEU or any employee, agent, contractor or subcontractor in carrying out the CSEU’s duties.
   2. (ii) All computerized systems shall meet the applicable security and compliance requirements of Federal and State law, regulation, and policy, including but not limited to requirements for the security of Federal tax return information. The office shall establish security and compliance controls, standards, and policies as may be applicable to all computerized systems and the handling of data subject to the requirements in this subdivision and notify the CSEU by administrative directive.
   3. (iii) The office and/or its agents will audit, review, assess and inspect the planning, design, development, installation, provisioning and deprovisioning of users, enhancement and operation of computerized systems and the policies and procedures involved in the handling of data subject to the requirements in this subdivision to determine the extent to which they meet the requirements of this section.

   4. (iv) The office may require the CSEU to submit and implement a corrective action plan to correct any deficiencies.

      (b) State parent locator service.

7. (1) State parent locator service. The office shall maintain a State parent locator service to submit requests to the Federal parent locator service and to provide location information to authorized persons for authorized purposes.

   1. (i) For cases receiving child support services under title IV-D of the Social Security Act. The State parent locator service shall access the Federal parent locator service and other sources of information and records within the State or other states, if available, for locating custodial and noncustodial parents, alleged parents or intended parents, or children for the purpose of establishing parentage, for establishing, modifying or enforcing child support obligations, or for the administration of the child support program under title IV-D of the Social Security Act.

   2. (ii) For other individuals and purposes authorized under title IV-D of the Social Security Act.

      1. (a) The office and CSEU shall access State parent locator service and release information from the Federal parent locator service only if disclosure is authorized under title IV-D of the Social Security Act.
      2. (b) The office and CSEU shall access State parent locator service and release information from other state sources of information and records only if disclosure is authorized under title IV-D of the Social Security Act, and not otherwise prohibited by State law or regulation. Information may only be released upon the request of authorized persons specified in paragraph (2) of this subdivision, for authorized purposes specified in paragraph (3) of this subdivision.
      3. (c) The office and CSEU shall not release information from the automated system, State or Federal tax return information, or financial institution data match information, nor forward a request for such information to another State child support agency.
      4. (d) The office and CSEU need not make subsequent location attempts if locate efforts fail to find the individual sought.
      5. (e) The office and CSEU shall only access the State parent locator service in conjunction with a request for information from the Federal parent locator service.

8. (2) Authorized persons. The State parent locator service shall accept requests for locate information only from the following authorized persons/entities:

   1. (i) any State or local agency or official providing child and spousal support services pursuant to the State plan under title IV-D of the Social Security Act;

   2. (ii) a court that has authority to issue an order or to serve as the initiating court in an action to seek an order against a noncustodial parent for the support and maintenance of a child, or any agent of such court;

      1. (a) the custodial parent, legal guardian, or the attorney of the child or caretaker relative having custody of a child who is not receiving assistance under title IV-A of the Social Security Act, but only if the individual:

         1. (1) attests that the request is being made to obtain information on, or to facilitate the discovery of, the location of any individual for the purpose of establishing parentage, or establishing, modifying, or enforcing child support obligations;
         2. (2) attests that any information obtained through the Federal or State parent locator service shall be used solely for these purposes and shall be otherwise treated as confidential;
         3. (3) for a child not receiving assistance under title IV-D of the Social Security Act, provides evidence that the requestor is the custodial parent, legal guardian, caretaker relative with custody, or attorney of the child; and
         4. (4) pays the fee required for Federal parent locator service and an additional fee as set forth by the office based on actual or standardized costs for each search of the State parent locator service;
      2. (b) requests under this subparagraph shall be submitted on forms designated by the office. Copies of the request, attestation, and supporting evidence shall be retained for a period of three years;

      (iii)

   3. (iv) a court, authorized agent or attorney of a state which has an agreement in connection with parental kidnapping, child custody or visitation cases meeting the requirements of Federal law. Requests from such courts, agents or attorneys shall be made solely in the manner proscribed by the office; or
   4. (v) a State agency that is administering a program operated under a State plan under titles IV-B or IV-E of the Social Security Act.

9. (3) Authorized purposes for requests and scope of information provided. The State parent locator service shall obtain and disclose the information set out below, subject to the privacy safeguards required under title IV-D of the Social Security Act and the Social Services Law, only for the following purposes:

   1. (i) To locate an individual with respect to a child in a support or parentage proceeding (whether receiving services pursuant to title IV-D of the Federal Social Security Act or not) or a case under titles IV-B or IV-E of the Social Security Act. The State parent locator service shall locate individuals for the purpose of establishing parentage, or establishing, modifying, or enforcing child support obligations, for the administration of the child support program under title IV-D of the Social Security Act, or for determining who has or may have parental rights with respect to a child. For these purposes, only information available through the Federal or State parent locator services may be provided. This information is limited to Social Security number(s), most recent address, employer name and address, employer identification number, wages or other income from, and benefits of, employment, including rights to, or enrollment in, health care coverage, and asset and debt information.
   2. (ii) To assist State or local agencies in carrying out their responsibilities under programs established pursuant to titles IV-D, IV-A, IV-B, and IV-E of the Social Security Act. In addition to the information that may be released pursuant to subparagraph (i) of this paragraph, State parent locator service information may be disclosed to agencies administering programs pursuant to titles I-D, IV-A, IV-B, and IV-E of the Social Security Act for the purpose of assisting these agencies to carry out their responsibilities to administer such programs, including information to locate an individual who is a child or a relative of a child in a case under title IV-B or IV-E. For purposes of this section, relative of a child is a person related to such child by blood, marriage or adoption. Information that may be disclosed about relatives of children involved in title IV-B and IV-E cases is limited to name, Social Security number(s), most recent address, employer name and address and employer identification number.

   3. (iii) To locate an individual sought for the unlawful taking or restraint of a child or for child custody or visitation purposes. The State parent locator service shall locate individuals for the purpose of enforcing State law with respect to the unlawful taking or restraint of a child or for making or, upon request by a court of competent jurisdiction, enforcing a child custody or visitation determination. This information is limited to the most recent address and place of employment of a parent or child.

      (c) Credit bureau reporting.

10. (1) Information regarding the amount of support arrears/past due support owed by the respondent must be reported to consumer reporting agencies, and must indicate the name of any respondent who owes support arrears/past due support and the amount of the delinquency. Information shall not be made available to a consumer reporting agency that the office determines does not have sufficient capability to systematically and timely make accurate use of the information, or to an entity that has not furnished evidence satisfactory to the office that the entity is a consumer reporting agency. In determining whether a consumer reporting agency lacks sufficient capability to systematically and timely make accurate use of such information, the office may require such agency to demonstrate its ability to comply with the provisions of section 380-j of the General Business Law.

11. (2) At least 10 days prior to reporting the information to a consumer reporting agency, the local department or appropriate child support enforcement/support collection unit, hereafter SCU, must provide notice to the respondent stating that:

    1. (i) the SCU proposes to release the information to consumer reporting agencies;
    2. (ii) Federal and State law permit such release;
    3. (iii) release of the information can be prevented by payment of the total amount of support arrears/past due child support owed;
    4. (iv) if the support arrears/past due support amount indicated in the notice is paid in part or in full after the release, the appropriate consumer reporting agencies will be so notified; and
    5. (v) the procedures for contesting release of the information set out in paragraph (3) of this subdivision.

12. (3) If the respondent believes that there is a mistake of fact in the amount of the support arrears/past due support indicated in the notice or in the identity of the respondent or that the order of support does not exist or has been vacated, a review of the account can be requested and the SCU must complete such review as soon as practicable and notify the respondent of the results, in writing.

    1. (i) In order to obtain review of the account, the respondent must contact the SCU by using the address provided in the notice and comply with any requests for information.
    2. (ii) Prior to submitting any written documentation in connection with the review of the account, the respondent or his/her representative may obtain and review a copy of the SCU payment records relating to the account.
    3. (iii) The SCU may not release the information to consumer reporting agencies until after the review of the account, provided such release is still appropriate.
    4. (iv) In connection with the review of the account, the respondent may be represented by an attorney or assisted by another person.
    5. (v) The respondent may submit written documentation in support of his/her claim, including a written explanation of why the proposed release of information to consumer reporting agencies should not occur.
    6. (vi) The decision of the SCU will be based solely upon consideration of the court orders, SCU records and any written documentation submitted by the respondent in connection with the review of the account.
    7. (vii) The SCU must complete such review as soon as practicable and notify the respondent of the results, in writing.

(a) Use and disclosure.