(c) The privacy compliance officer is responsible for:

1. (1) assisting a data subject in identifying and requesting personal information, if necessary;
2. (2) describing the contents of systems of records orally or in writing in order to enable a data subject to learn if a system of records includes a record or personal information identifiable to a data subject requesting such record or personal information;

3. (3) taking one of the following actions upon locating the record sought: Note:

   1. (i) make the record available for inspection, in a printed form without codes or symbols, unless an accompanying document explaining such codes or symbols is also provided;
   2. (ii) permit the data subject to copy the record; or

   3. (iii) deny access to the record in whole or in part, and explain in writing the reasons therefor.

      Note:

      Records maintained pursuant to sections 837, 837-a, 837-b, 837-c, 838, 839, 845 and 845-a of the Executive Law are public safety agency records, as defined in article 6-A of the Public Officers Law, and are not subject to the provisions of this Part. Any individual may review his or her criminal history record maintained by the agency pursuant to the provisions of Part 6050 of this Title;

4. (4) making a copy available, upon request, upon payment of or offer to pay established fees, if any;
5. (5) certifying, upon request, that a copy of a record is a true copy; or

6. (6) certifying, upon request, that:

   1. (i) the agency does not have possession of the record sought;
   2. (ii) the agency cannot locate the record sought, after having made a diligent search; or
   3. (iii) the information sought cannot be retrieved by use of the description thereof, or by use of the name or other identifier of the data subject, without extraordinary search methods being employed by the agency.