(a) A request for a record or for correction or amendment of a record or personal information shall be made in writing, submitted by mail or in person, and must be accompanied by a reasonable proof of identity, as described in section 111.5 of this Part. A request for correction or amendment of a record or personal information shall not include matters the determination of which is within the exclusive authority of the Comptroller pursuant to sections 74 and 374 of the Retirement and Social Security Law.

(b) A request shall reasonably describe the record sought. Whenever possible, the data subject should supply identifying information that would assist this office in locating the record sought.

(c) A request based upon categories of information described in a notice of a system of records or a privacy impact statement shall be deemed to reasonably describe the record sought.

(d) Within five business days of the receipt of a request for a record, this office shall provide access to the record, deny access, or acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which date shall not exceed 30 days from the date of the acknowledgment. Whenever access to a record is denied, it shall be in writing, explaining the reasons therefor, and identifying the persons to whom an appeal may be made.

(e) Within 30 business days of the receipt of a request from a data subject for correction or amendment of a record or personal information, reasonably described, concerning the data subject, this office shall:

(f) A failure to grant or deny access to records within five business days of the receipt of a request or within 30 days of an acknowledgment of the receipt of a request, or a failure to respond to a request for amendment or correction of a record or personal information within 30 business days of receipt of such a request, shall be construed as a denial that may be appealed.