Section 95. Access to records

(1) (a) Each agency subject to the provisions
  of  this  article, within five business days of the receipt of a written
  request from a data subject for a record reasonably described pertaining
  to that data subject, shall make  such  record  available  to  the  data
  subject,  deny  such request in whole or in part and provide the reasons
  therefor in writing, or furnish a written acknowledgement of the receipt
  of such request and a  statement  of  the  approximate  date  when  such
  request  will  be  granted or denied, which date shall not exceed thirty
  days from the date of the acknowledgement.
    (b) An agency shall not be required to provide  a  data  subject  with
  access to a record pursuant to this section if:
    (i) the agency does not have the possession of such record;
    (ii)  such  record  cannot  be  retrieved by use of the data subject's
  description thereof, or by use of the name or other  identifier  of  the
  data subject, without extraordinary search methods being employed by the
  agency; or
    (iii) access to such record is not required to be provided pursuant to
  subdivision five, six or seven of this section.
    (c)  Upon  payment  of, or offer to pay, the fee prescribed by section
  eighty-seven of this chapter, the agency shall provide  a  copy  of  the
  record  requested  and  certify  to  the  correctness of such copy if so
  requested. The record shall be made available in a printed form  without
  any  codes or symbols, unless accompanied by a document fully explaining
  such codes or symbols. Upon  a  data  subject's  voluntary  request  the
  agency shall permit a person of the data subject's choosing to accompany
  the  data  subject  when  reviewing  and  obtaining  a copy of a record,
  provided that the agency may require  the  data  subject  to  furnish  a
  written   statement   authorizing   discussion  of  the  record  in  the
  accompanying person's presence.
    (d) Each agency shall,  provided  such  agency  has  reasonable  means
  available, accept requests for records submitted through electronic mail
  and  shall  respond to such requests by electronic mail, using forms, to
  the extent practicable, consistent with the form or forms  developed  by
  the  committee  on  open  government,  provided that the electronic mail
  requests do not seek a response in some other form.
    (2) Each agency shall, within thirty business days  of  receipt  of  a
  written  request  from  a  data subject for correction or amendment of a
  record or personal information, reasonably described, pertaining to that
  data subject, which he or she believes is not accurate, relevant, timely
  or complete, either:
    (a) make the correction or amendment in whole or in part,  and  inform
  the  data  subject  that  upon  his  or  her  request such correction or
  amendment will be provided to any or all persons or  governmental  units
  to  which  the  record or personal information has been or is disclosed,
  pursuant to paragraph (c) of subdivision three of section ninety-four of
  this article; or
    (b) inform the data subject of its refusal to  correct  or  amend  the
  record and its reasons therefor.
    (3)  Any  data  subject  whose request under subdivision one or two of
  this section is denied in whole or in part may, within  thirty  business
  days,  appeal  such  denial  in  writing to the head, chief executive or
  governing body of the agency, or the person designated as the  reviewing
  official  by such head, chief executive or governing body. Such official
  shall within seven business days of the receipt of an appeal  concerning
  denial  of  access,  or within thirty business days of the receipt of an
  appeal concerning denial of  correction  or  amendment,  either  provide
  access to or correction or amendment of the record sought and inform the
  data subject that, upon his or her request, such correction or amendment

  will  be  provided  to any or all persons or governmental units to which
  the record or personal information has been or is disclosed, pursuant to
  paragraph (c) of  subdivision  three  of  section  ninety-four  of  this
  article, or fully explain in writing to the data subject the factual and
  statutory  reasons for further denial and inform the data subject of his
  or  her  right  to  thereupon  seek  judicial  review  of  the  agency's
  determination  under  section  ninety-seven of this article. Each agency
  shall immediately forward to the committee a copy of  such  appeal,  the
  determination thereof and the reasons therefor.
    (4)  If correction or amendment of a record or personal information is
  denied in whole or in part upon appeal, the agency shall inform the data
  subject of the right to file with the agency a statement  of  reasonable
  length  setting  forth  the  reasons  for disagreement with the agency's
  determination  and  that,  upon  request,  his  or  her   statement   of
  disagreement  will  be  provided  to  any or all persons or governmental
  units to which  the  record  has  been  or  is  disclosed,  pursuant  to
  paragraph  (c)  of  subdivision  three  of  section  ninety-four of this
  article. With respect to any personal information  about  which  a  data
  subject  has filed a statement of disagreement, the agency shall clearly
  note any portions of the record which are disputed, and shall attach the
  data subject's statement of disagreement as part  of  the  record.  When
  providing  the data subject's statement of disagreement to other persons
  or governmental units pursuant to paragraph (c) of subdivision three  of
  section  ninety-four  of  this  article,  the  agency  may,  if it deems
  appropriate, also include in the  record  a  concise  statement  of  the
  agency's reasons for not making the requested amendment.
    (5) (a) Any agency which may not otherwise exempt personal information
  from  the operation of this section may do so, unless access by the data
  subject is otherwise authorized or required by law, if such  information
  is compiled for law enforcement purposes and would, if disclosed:
    (i)   interfere   with  law  enforcement  investigations  or  judicial
  proceedings;
    (ii) deprive a person  of  a  right  to  a  fair  trial  or  impartial
  adjudication;
    (iii)   identify   a  confidential  source  or  disclose  confidential
  information relating to a criminal investigation; or
    (iv) reveal criminal investigative techniques  or  procedures,  except
  routine techniques and procedures.
    (b)  When  providing  the  data  subject  with  access  to information
  described in paragraph (b) of subdivision seven of  section  ninety-four
  of  this  article,  an  agency may withhold the identity of a source who
  furnished said information under an express  promise  that  his  or  her
  identity would be held in confidence.
    (6)  Nothing in this section shall require an agency to provide a data
  subject with access to:
    (a) personal information to which he or she is specifically prohibited
  by statute from gaining access;
    (b) patient records concerning mental disability  or  medical  records
  where such access is not otherwise required by law;
    (c)  personal information pertaining to the incarceration of an inmate
  at a state correctional facility which is evaluative in nature or which,
  if such access was provided, could endanger the life or  safety  of  any
  person,  unless  such  access  is otherwise permitted by law or by court
  order;
    (d) attorney's work product or material prepared for litigation before
  judicial, quasi-judicial or administrative tribunals,  as  described  in
  subdivisions  (c)  and  (d) of section three thousand one hundred one of
  the civil practice law and rules, except pursuant to  statute,  subpoena

  issued  in  the course of a criminal action or proceeding, court ordered
  or  grand  jury  subpoena,  search  warrant  or  other   court   ordered
  disclosure.
    (7) This section shall not apply to public safety agency records.
    (8)  Nothing  in  this section shall limit, restrict, abrogate or deny
  any right a person may otherwise have including rights granted  pursuant
  to the state or federal constitution, law or court order.