§ 95. Access to records. (1) (a) Each agency subject to the provisions of this article, within five business days of the receipt of a written request from a data subject for a record reasonably described pertaining to that data subject, shall make such record available to the data subject, deny such request in whole or in part and provide the reasons therefor in writing, or furnish a written acknowledgement of the receipt of such request and a statement of the approximate date when such request will be granted or denied, which date shall not exceed thirty days from the date of the acknowledgement.

(b) An agency shall not be required to provide a data subject with access to a record pursuant to this section if:

(i) the agency does not have the possession of such record;

(ii) such record cannot be retrieved by use of the data subject's description thereof, or by use of the name or other identifier of the data subject, without extraordinary search methods being employed by the agency; or

(iii) access to such record is not required to be provided pursuant to subdivision five, six or seven of this section.

(c) Upon payment of, or offer to pay, the fee prescribed by section eighty-seven of this chapter, the agency shall provide a copy of the record requested and certify to the correctness of such copy if so requested. The record shall be made available in a printed form without any codes or symbols, unless accompanied by a document fully explaining such codes or symbols. Upon a data subject's voluntary request the agency shall permit a person of the data subject's choosing to accompany the data subject when reviewing and obtaining a copy of a record, provided that the agency may require the data subject to furnish a written statement authorizing discussion of the record in the accompanying person's presence.

(d) Each agency shall, provided such agency has reasonable means available, accept requests for records submitted through electronic mail and shall respond to such requests by electronic mail, using forms, to the extent practicable, consistent with the form or forms developed by the committee on open government, provided that the electronic mail requests do not seek a response in some other form.

(2) Each agency shall, within thirty business days of receipt of a written request from a data subject for correction or amendment of a record or personal information, reasonably described, pertaining to that data subject, which he or she believes is not accurate, relevant, timely or complete, either:

(a) make the correction or amendment in whole or in part, and inform the data subject that upon his or her request such correction or amendment will be provided to any or all persons or governmental units to which the record or personal information has been or is disclosed, pursuant to paragraph (c) of subdivision three of section ninety-four of this article; or

(b) inform the data subject of its refusal to correct or amend the record and its reasons therefor.

(3) Any data subject whose request under subdivision one or two of this section is denied in whole or in part may, within thirty business days, appeal such denial in writing to the head, chief executive or governing body of the agency, or the person designated as the reviewing official by such head, chief executive or governing body. Such official shall within seven business days of the receipt of an appeal concerning denial of access, or within thirty business days of the receipt of an appeal concerning denial of correction or amendment, either provide access to or correction or amendment of the record sought and inform the data subject that, upon his or her request, such correction or amendment will be provided to any or all persons or governmental units to which the record or personal information has been or is disclosed, pursuant to paragraph (c) of subdivision three of section ninety-four of this article, or fully explain in writing to the data subject the factual and statutory reasons for further denial and inform the data subject of his or her right to thereupon seek judicial review of the agency's determination under section ninety-seven of this article. Each agency shall immediately forward to the committee a copy of such appeal, the determination thereof and the reasons therefor.

(4) If correction or amendment of a record or personal information is denied in whole or in part upon appeal, the agency shall inform the data subject of the right to file with the agency a statement of reasonable length setting forth the reasons for disagreement with the agency's determination and that, upon request, his or her statement of disagreement will be provided to any or all persons or governmental units to which the record has been or is disclosed, pursuant to paragraph (c) of subdivision three of section ninety-four of this article. With respect to any personal information about which a data subject has filed a statement of disagreement, the agency shall clearly note any portions of the record which are disputed, and shall attach the data subject's statement of disagreement as part of the record. When providing the data subject's statement of disagreement to other persons or governmental units pursuant to paragraph (c) of subdivision three of section ninety-four of this article, the agency may, if it deems appropriate, also include in the record a concise statement of the agency's reasons for not making the requested amendment.

(5) (a) Any agency which may not otherwise exempt personal information from the operation of this section may do so, unless access by the data subject is otherwise authorized or required by law, if such information is compiled for law enforcement purposes and would, if disclosed:

(i) interfere with law enforcement investigations or judicial proceedings;

(ii) deprive a person of a right to a fair trial or impartial adjudication;

(iii) identify a confidential source or disclose confidential information relating to a criminal investigation; or

(iv) reveal criminal investigative techniques or procedures, except routine techniques and procedures.

(b) When providing the data subject with access to information described in paragraph (b) of subdivision seven of section ninety-four of this article, an agency may withhold the identity of a source who furnished said information under an express promise that his or her identity would be held in confidence.

(6) Nothing in this section shall require an agency to provide a data subject with access to:

(a) personal information to which he or she is specifically prohibited by statute from gaining access;

(b) patient records concerning mental disability or medical records where such access is not otherwise required by law;

(c) personal information pertaining to the incarceration of an incarcerated individual at a state correctional facility which is evaluative in nature or which, if such access was provided, could endanger the life or safety of any person, unless such access is otherwise permitted by law or by court order;

(d) attorney's work product or material prepared for litigation before judicial, quasi-judicial or administrative tribunals, as described in subdivisions (c) and (d) of section three thousand one hundred one of the civil practice law and rules, except pursuant to statute, subpoena issued in the course of a criminal action or proceeding, court ordered or grand jury subpoena, search warrant or other court ordered disclosure.

(7) This section shall not apply to public safety agency records.

(8) Nothing in this section shall limit, restrict, abrogate or deny any right a person may otherwise have including rights granted pursuant to the state or federal constitution, law or court order.