N.Y. Comp. Codes R. & Regs. tit. 21, § 462.3 – Assignment of responsibilities.

(a) The Corporate Secretary of the Power Authority is hereby designated the officer responsible for ensuring that the Power Authority complies with the provisions of the Personal Privacy Protection Law and the regulations in this Part.
(b) The Executive Vice President-Business Services & Administration is responsible for coordinating the Power Authority's response to requests for records or personal information or amendments of records or personal information relating to data subjects who are employees or former employees of the authority. The Executive Vice President-Business Services & Administration may designate the Director - Employee Benefits and Human Resource Data, the human resources data supervisor and the human resources managers at the facilities as deputies who may coordinate responses to requests for records or personal information relating to data subjects who are authority employees or former employees.
(c) The Corporate Secretary is responsible for coordinating the Power Authority's response to requests for records or personal information or amendment of records or personal information relating to data subjects who are not employees or former employees of the authority.
(d) The address of the Corporate Secretary and the Executive Vice President-Business Services & Administration is:
Power Authority of the State of New York
123 Main Street
White Plains, NY 10601
(e) The Executive Vice President-Business Services & Administration and/or his or her deputies, with respect to requests relating to employees or former employees of the authority, and the Corporate Secretary, with respect to requests relating to other persons, are responsible for:
1. (1) assisting a data subject in identifying and requesting a record or personal information, if necessary;
2. (2) describing the contents of systems of records orally or in writing in order to enable a data subject to learn if a system of records includes a record or personal information identifiable to a data subject requesting such record or personal information;
3. (3) taking one of the following actions upon locating the record or personal information sought:
  1. (i) making the record or personal information available for inspection in a printed form without codes or symbols, unless an accompanying document explaining such codes or symbols is also provided;
  2. (ii) providing the data subject with a copy of the record or personal information upon payment of or offer to pay established fee; or
  3. (iii) denying access to the record or personal information in whole or in part and explaining in writing the reasons therefor;
4. (4) upon request, certifying that a copy of a record or personal information is a true copy; or
5. (5) upon request, certifying that:
  1. (i) the Power Authority does not have possession of the record or personal information sought;
  2. (ii) the Power Authority cannot locate the record or personal information sought after having made a diligent search; or
  3. (iii) the record or personal information sought cannot be retrieved by use of the description thereof, or by use of the name or other identifier of the data subject without extraordinary search methods being employed by the Power Authority.