N.Y. Comp. Codes R. & Regs. tit. 9, § 551.7 – Designation of privacy compliance officer.

(a) The executive deputy commissioner of the Office of Information Technology Services shall designate a privacy compliance officer who is responsible for ensuring that the Office of Information Technology Services complies with the provisions of the Personal Privacy Protection Law and with these regulations. The director may, with respect to any one or more privacy compliance issues, delegate their authority hereunder to an appropriate employee of the Office of Information Technology Services.
(b) The address of the privacy compliance officer is:
Privacy Compliance Officer
NYS Office of Information Technology Services
State Capitol ESP, P.O. Box 2062
Albany, NY 12220-0062
(c) The privacy compliance officer shall coordinate the response to individuals' requests for access to records which contain personal information.
(d) The privacy compliance officer is responsible for:
1. (1) assisting an individual in identifying and requesting personal information, if necessary;
2. (2) describing the contents of systems of records orally or in writing in order to enable an individual to learn if a system of records includes a record or personal information identifiable to an individual requesting such record or personal information; and
3. (3) ensuring that Office of Information Technology Services personnel take one of the following actions upon locating the record sought:
  1. (i) make the record available for inspection, in a printed form without codes or symbols, unless an accompanying document explaining such codes or symbols is also provided;
  2. (ii) permit the individual to copy the record;
  3. (iii) deny access to the record in whole or in part and explain in writing the reasons therefore;
  4. (iv) make a copy available upon request, upon payment of or offer to pay established fees, if any, or permit the individual to copy the record;
  5. (v) upon request, certify that a copy of the record is a true copy; or
  6. (vi) certify, upon request, that:
    1. (a) the office does not have possession of the record sought;
    2. (b) the office cannot locate the record sought after having made a diligent search; or
    3. (c) the information sought cannot be retrieved by use of the description thereof, or by use of the name or other identifier of the individual without extraordinary search methods being employed by the office.