§ 95. Access to records. (1) (a) Each agency subject to the provisions
of this article, within five business days of the receipt of a written
request from a data subject for a record reasonably described pertaining
to that data subject, shall make such record available to the data
subject, deny such request in whole or in part and provide the reasons
therefor in writing, or furnish a written acknowledgement of the receipt
of such request and a statement of the approximate date when such
request will be granted or denied, which date shall not exceed thirty
days from the date of the acknowledgement.

(b) An agency shall not be required to provide a data subject with
access to a record pursuant to this section if:

(i) the agency does not have the possession of such record;

(ii) such record cannot be retrieved by use of the data subject's
description thereof, or by use of the name or other identifier of the
data subject, without extraordinary search methods being employed by the
agency; or

(iii) access to such record is not required to be provided pursuant to
subdivision five, six or seven of this section.

(c) Upon payment of, or offer to pay, the fee prescribed by section
eighty-seven of this chapter, the agency shall provide a copy of the
record requested and certify to the correctness of such copy if so
requested. The record shall be made available in a printed form without
any codes or symbols, unless accompanied by a document fully explaining
such codes or symbols. Upon a data subject's voluntary request the
agency shall permit a person of the data subject's choosing to accompany
the data subject when reviewing and obtaining a copy of a record,
provided that the agency may require the data subject to furnish a
written statement authorizing discussion of the record in the
accompanying person's presence.

(d) Each agency shall, provided such agency has reasonable means
available, accept requests for records submitted through electronic mail
and shall respond to such requests by electronic mail, using forms, to
the extent practicable, consistent with the form or forms developed by
the committee on open government, provided that the electronic mail
requests do not seek a response in some other form.

(2) Each agency shall, within thirty business days of receipt of a
written request from a data subject for correction or amendment of a
record or personal information, reasonably described, pertaining to that
data subject, which he or she believes is not accurate, relevant, timely
or complete, either:

(a) make the correction or amendment in whole or in part, and inform
the data subject that upon his or her request such correction or
amendment will be provided to any or all persons or governmental units
to which the record or personal information has been or is disclosed,
pursuant to paragraph (c) of subdivision three of section ninety-four of
this article; or

(b) inform the data subject of its refusal to correct or amend the
record and its reasons therefor.

(3) Any data subject whose request under subdivision one or two of
this section is denied in whole or in part may, within thirty business
days, appeal such denial in writing to the head, chief executive or
governing body of the agency, or the person designated as the reviewing
official by such head, chief executive or governing body. Such official
shall within seven business days of the receipt of an appeal concerning
denial of access, or within thirty business days of the receipt of an
appeal concerning denial of correction or amendment, either provide
access to or correction or amendment of the record sought and inform the
data subject that, upon his or her request, such correction or amendment
will be provided to any or all persons or governmental units to which
the record or personal information has been or is disclosed, pursuant to
paragraph (c) of subdivision three of section ninety-four of this
article, or fully explain in writing to the data subject the factual and
statutory reasons for further denial and inform the data subject of his
or her right to thereupon seek judicial review of the agency's
determination under section ninety-seven of this article. Each agency
shall immediately forward to the committee a copy of such appeal, the
determination thereof and the reasons therefor.

(4) If correction or amendment of a record or personal information is
denied in whole or in part upon appeal, the agency shall inform the data
subject of the right to file with the agency a statement of reasonable
length setting forth the reasons for disagreement with the agency's
determination and that, upon request, his or her statement of
disagreement will be provided to any or all persons or governmental
units to which the record has been or is disclosed, pursuant to
paragraph (c) of subdivision three of section ninety-four of this
article. With respect to any personal information about which a data
subject has filed a statement of disagreement, the agency shall clearly
note any portions of the record which are disputed, and shall attach the
data subject's statement of disagreement as part of the record. When
providing the data subject's statement of disagreement to other persons
or governmental units pursuant to paragraph (c) of subdivision three of
section ninety-four of this article, the agency may, if it deems
appropriate, also include in the record a concise statement of the
agency's reasons for not making the requested amendment.

(5) (a) Any agency which may not otherwise exempt personal information
from the operation of this section may do so, unless access by the data
subject is otherwise authorized or required by law, if such information
is compiled for law enforcement purposes and would, if disclosed:

(i) interfere with law enforcement investigations or judicial
proceedings;

(ii) deprive a person of a right to a fair trial or impartial
adjudication;

(iii) identify a confidential source or disclose confidential
information relating to a criminal investigation; or

(iv) reveal criminal investigative techniques or procedures, except
routine techniques and procedures.

(b) When providing the data subject with access to information
described in paragraph (b) of subdivision seven of section ninety-four
of this article, an agency may withhold the identity of a source who
furnished said information under an express promise that his or her
identity would be held in confidence.

(6) Nothing in this section shall require an agency to provide a data
subject with access to:

(a) personal information to which he or she is specifically prohibited
by statute from gaining access;

(b) patient records concerning mental disability or medical records
where such access is not otherwise required by law;

(c) personal information pertaining to the incarceration of an
incarcerated individual at a state correctional facility which is
evaluative in nature or which, if such access was provided, could
endanger the life or safety of any person, unless such access is
otherwise permitted by law or by court order;

(d) attorney's work product or material prepared for litigation before
judicial, quasi-judicial or administrative tribunals, as described in
subdivisions (c) and (d) of section three thousand one hundred one of
the civil practice law and rules, except pursuant to statute, subpoena
issued in the course of a criminal action or proceeding, court ordered
or grand jury subpoena, search warrant or other court ordered
disclosure.

(7) This section shall not apply to public safety agency records.

(8) Nothing in this section shall limit, restrict, abrogate or deny
any right a person may otherwise have including rights granted pursuant
to the state or federal constitution, law or court order.