9 CRR-NY 166-3.4NY-CRR
9 CRR-NY 166-3.4
9 CRR-NY 166-3.4
166-3.4 Privacy impact statement; supplemental statement.
(a) Before instituting a system of records, a privacy impact statement shall be submitted for review to the committee, which shall include the following information:
(1) the name of the unit within the division that will maintain the system of records, and the name or title of the system of records;
(2) the title and business address of the unit official responsible for the system of records;
(3) where applicable, the procedures by which a data subject may gain access to personal information pertaining to such data subject in the system of records and the procedures by which a data subject may seek to amend or correct its contents;
(4) the categories and the approximate number of persons on whom records will be maintained in the system of records;
(5) the categories of information which will be collected and maintained in the system of records;
(6) the purposes for which each category of information within the system of records will be collected and maintained;
(7) the disclosures of personal information within the system of records that will regularly be made for each category of information, and the authority for such disclosures;
(8) the general or specific statutory authority for the collection, maintenance and disclosure of each category of information, and the authority for such disclosures;
(9) policies governing retention and timely disposal of information within the system of records;
(10) each and every source for each category of information within the system of records;
(11) a statement indicating whether the system of records will be maintained manually, by automated data system, or both; and
(12) any other information required by rule of the committee adopted pursuant to the Public Officers Law, section 93(4).
(b) Before modifying a system of records in any way which would render inaccurate any information set forth in a privacy impact statement or a notice filed pursuant to chapter 677 of the Laws of 1980, a supplemental statement shall be submitted to the committee which shall conform the privacy impact statement or notice to the proposed modification.
9 CRR-NY 166-3.4
Current through September 15, 2021
| End of Document |
IMPORTANT NOTE REGARDING CONTENT CURRENCY: The "Current through" date indicated immediately above is the date of the most recently produced official NYCRR supplement covering this rule section. For later updates to this section, if any, please: consult editions of the NYS Register published after this date; or contact the NYS Department of State Division of Administrative Rules at [email protected]. See Help for additional information on the currency of this unofficial version of NYS Rules.