N.Y. Comp. Codes R. & Regs. tit. 4, § 209.7 – Appeals of denial of access to records.

(a) Any person who has been denied access to records by the privacy compliance officer may appeal such denial within 30 days to the privacy compliance appeals officer, by submitting a written request, which shall set forth:
1. (1) the date of the request for records;
2. (2) the records to which the requestor was denied access;
3. (3) the name and return address of the requestor; and
4. (4) the requestor's position, concisely stated, setting forth the reason why the decision of the privacy compliance officer should be changed.
(b) The time for deciding on an appeal by the privacy compliance appeals officer shall commence upon receipt of the written appeal.
(c) The privacy compliance appeals officer shall, within seven business days of the receipt of a written appeal, review the matter and affirm, modify or reverse the denial.
(d) If the privacy compliance appeals officer determines that the denial of access was erroneous, such officer shall instruct the privacy compliance officer to allow prompt inspection or copying of the record as requested.
(e) If the privacy compliance appeals officer affirms or modifies the denial, such officer shall communicate the reasons in writing by either first class mail or certified mail, return receipt requested, to the person making the appeal and inform such person of the right of judicial review.
(f) The privacy compliance appeals officer shall immediately forward to the Committee on Open Government a copy of such appeal and the determination thereon.