(a) The purpose of these regulations is to implement procedures relating to requests for records or personal information by a data subject pursuant to the Personal Privacy Protection Law, in accordance with the provisions of article 6-A of the Public Officers Law. These procedures shall apply to records or personal information directly maintained by the authority and maintained under any contract it executes for the operation of a system of records, or for research, evaluation, or reporting by the authority or on its behalf.

(b) It is the intent of the authority to maintain in its records, except when a data subject has submitted unsolicited personal information, only such personal information that is relevant and necessary to accomplish a purpose of the authority that is required to be accomplished by statute or executive order or to implement a program specifically authorized by law. It is the intent of the authority to collect personal information directly from the data subject whenever practicable and to seek to ensure that all records used by the authority to make a determination about a data subject are accurate, relevant, timely, and complete.