(a) Within 30 business days of a request from a data subject for correction or amendment of a record or personal information that is reasonably described and that pertains to the data subject, the commission will:

1. (1) make the amendment or correction in whole or in part, as is reasonable under the circumstances, and inform the data subject that, on request, such correction or amendment will be provided to any person or governmental unit to which the record or personal information has been or is disclosed pursuant to paragraph (d), (i) or (l) of subdivision 1 of section 96 of the Public Officers Law; or
2. (2) inform the data subject in writing of its refusal to correct or amend the record, including the reasons therefor.

(b) If correction or amendment of a record or personal information is denied in whole or in part upon appeal, the determination rendered pursuant to the appeal shall inform the data subject of the right to:

1. (1) file with the commission a statement of reasonable length setting forth the data subject's reasons for disagreement with the determination;
2. (2) request that such a statement of disagreement be provided to any person or governmental unit to which the record has been or is disclosed pursuant to paragraph (d), (i) or (l) of subdivision 1 of section 96 of the Public Officers Law.

(c) Upon receipt of a statement of disagreement by a data subject, the commission will:

1. (1) clearly note any portions of the record that are disputed; and
2. (2) attach the data subject's statement as part of the record.