(a) A person who wishes to determine whether he/she is a data subject in records maintained by the office may contact the personal privacy compliance officer, who will assist in identifying such records and, if appropriate, will describe the contents of the office's system of records orally or in writing.

(b) Requests for access to records must be made to the personal privacy compliance officer in writing and must reasonably describe the records sought. Whenever possible the data subject should supply identifying information that assists the office in locating the records sought. Requests will be accepted by mail, or in person at the address of the personal privacy compliance officer listed in section 804.3(b) of this Part on any business day between the hours of 9:00 a.m. and 4:30 p.m.

(c) Within five business days of the receipt of a request, the office shall either provide access to the record or deny access in writing, explaining the reasons therefor, or acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which shall be within 30 days from the date of the acknowledgment.

(d) When the record is located, the office shall:

(e) Records or copies shall be made available at the office of the personal privacy compliance officer at the address listed in section 804.3(b) of this Part or where they are kept and shall not be removed from that location without the express written consent of the director.

(f) Proof of identity, by presentation of a driver's license or other documentation or verification of signature or identifying facts, or other means, at the option of the office may be required of a person making a request.

(g) Upon request, the personal privacy compliance officer shall certify that: