N.Y. Comp. Codes R. & Regs. tit. 4, § 209.9 – Appeals of denial of correction or amendment of records.

(a) Any person whose request for correction or amendment of records has been denied by the privacy compliance officer may appeal such denial within 30 business days to the privacy compliance appeals officer. Such a request may be submitted by electronic mail to an email address designated by the board, and posted on the agency’s website. All responsive communications to such a request, when submitted by electronic mail, shall also be in electronic mail, provided that the request does not seek a response in another form. Such appeal shall be in writing and shall set forth:
1. (1) the date of the request for records;
2. (2) the records whose correction or amendment was denied and the requestor's justification for changes sought; and
3. (3) the name and return address of the requestor.
(b) The time for deciding on an appeal by the privacy compliance appeals officer shall commence upon receipt of the written appeal.
(c) The privacy compliance appeals officer shall, within 30 business days of the receipt of a written appeal, review the matter and affirm, modify or reverse the denial.
(d) If the privacy compliance appeals officer determines that the denial was erroneous, such officer shall instruct the privacy compliance officer to allow correction or amendment of the record as requested and notify appropriate parties, if requested, by the requestor.
(e) If the privacy compliance appeals officer affirms or modifies the denial, such officer shall communicate the reasons in writing by either first class mail or certified mail, return receipt requested, to the person making the appeal and inform such person of the right of judicial review. In addition, the records appeals officer shall notify the requestor of its right to file with the board a statement of reasons for disagreement with its determination, and that the board will attach requestor's statement to the disputed record. Upon an individual's request, such statement will be provided to parties to whom such data has been disclosed in accordance with section 94.3(c) of the Public Officers Law together, if appropriate, with a concise statement of the board's reasons for not making the requested amendment.
(f) The privacy compliance appeals officer shall immediately forward to the Committee on Open Government a copy of such appeal and the determination thereon.