§ 8-c. Enterprise fraud prevention and detection system. 1. In furtherance of the comptroller's constitutional and statutory functions, duties and responsibilities, the comptroller may, within his or her discretion, establish, implement and update as necessary an electronic data analytical enterprise fraud prevention and detection system for the prevention of fraud, waste and abuse in state government and the detection and prevention of improper payments of public moneys. 2. State agencies shall fully support and cooperate with the state comptroller by providing the state comptroller with access to data requested by the state comptroller, in accordance with applicable state and federal law, to allow such data to be integrated into such analytic efforts as the state comptroller may deem necessary. For this purpose, the term "state agency" shall mean any of the following performing a governmental or proprietary function for the executive department of the state: a state department, the state university of New York, the city university of New York, and any board, bureau, division, commission, committee, council, office or similar governmental entity. 3. In support of the enterprise fraud prevention and detection system, the state comptroller shall establish protocols:

(a) for data sharing, secure file transfers and/or other methods to obtain real-time, regular and/or periodic data from state agencies, provided, however, that access to such data by the state comptroller shall not waive any privilege or right of confidentiality;

(b) to ensure the safety, security, integrity and privacy of all data shared with his or her office in accordance with the system; and

(c) for the authorized retention and deletion of data obtained from state agencies. 4. In connection with such system, the state comptroller, in his or her discretion, may:

(a) develop a long-range plan for preventing or detecting improper payments of public moneys, and the prevention and detection of waste, fraud and abuse in government operations;

(b) acquire technology including, but not limited to, software that enhances the following capabilities: (i) automated detection and alerting; (ii) continuous monitoring of program transactions and activity, to detect fraud and improper payments both prospectively (before the payment is made) and retrospectively (after payments are made); (iii) detection of non-transactional fraud such as program eligibility issues and identify theft; and

(c) evaluate potential savings resulting from such efforts. 5. The state comptroller shall report annually to the legislature no later than the first day of September, two thousand sixteen and annually thereafter on the progress, status and results of the system created pursuant to this section and subdivision two of section twenty-eight hundred three of the public authorities law.