(a) Within 30 business days of the receipt of a privacy impact statement or supplemental statement from an agency, the committee shall review such statement to determine whether the maintenance of the system of records is within the lawful authority of the agency, and to determine whether there have been established rules and procedures as required by section 94 of the Public Officers Law.

(b) After review of such information, the committee may notify the agency of the result of its review.