December 31, 2013
As you know, I have received your letter and the materials attached to it. You have sought an advisory opinion relating to a request for records pertaining to yourself that are maintained by the state agency that employs you.
Following the agency’s receipt of your request, you were asked to sign an “Authorization for Release of Information Pursuant to the Personal Privacy Protection Law.” The form requires that the person seeking records pertaining to herself or himself, a “data subject”, must describe the intended use of the records. Specifically, the form states: “As required by Public Officers Law Section 96 (1)(a)(iii), I hereby state this personal information will be used for _______________” A “data subject” is “any natural person about whom personal information has been collected by an agency” [Personal Privacy Protection Law, hereafter “PPPL”, §92(3)].
Review of the PPPL indicates that a request by a data subject is based on §95 of that statute; §96 pertains to situations in which an agency may be authorized to disclose personal information about a data subject to a person or entity other than the data subject.
Section 95(1)(a) states in relevant part that:
“Each agency subject to the provisions of this article, within five business days of the receipt of written request from a data subject for a record reasonably described pertaining to that data subject, shall make such record available to the data subject, deny such request in whole or in part and provide the reasons therefor in writing, or furnish a written acknowledgement of the receipt of such request and a statement of the approximate date when such request will be granted or denied, which date shall not exceed thirty days from the date of the acknowledgement.”
The foregoing clearly deals with a request “from a data subject for a record…pertaining to that data subject…” No reference is made in §95 to a requirement that a data subject provide a reason for a request or an indication of the intended use of the records sought.
Paragraphs (a) through (n) of §96(1) detail the instances in which a state agency may disclose personal information pertaining to a data subject to persons or entities other than the data subject. The provision cited by the agency as the basis for requiring the Authorization referenced above, §96(1)(a)(iii), states that:
“No agency may disclose any record or personal information unless such disclosure is:
- Pursuant to a written request by or the voluntary written consent of the data subject, provided that such request or consent by its terms limits and specifically describes:
(i)the personal information which is requested to be disclosed;
(ii)the person or entity to whom such personal information is requested to be disclosed; and
(iii)the uses which will be made of such personal information by the person or entity receiving it…”
I can understand how an agency could believe that a request made pursuant the PPPL might require a description of the uses of the information. However, a careful reading of the specific language of and comparison of the thrust of §95(1)(a) and §96(1)(a) indicates that the latter involves a request or consent given by a data subject that authorizes an agency to disclose to a different person or entity. The introductory language of §96(1)(a) refers to consent by a data subject, which, according to subparagraphs (ii) and (iii), may be conferred upon “a person or entity.” In short, the PPPL distinguishes a “data subject” from a “person” to whom consent to disclose may be given.
In sum, when a request is made by a data subject, as in your situation, for records pertaining to herself, §95(1) is the governing statute. Again, there is no requirement in that statute that a data subject must provide a reason for the request. Section 96(1) pertains to the ability of an agency to disclose personal information about a data subject to a person other than the data subject or to an entity.
I hope that I have been of assistance.
Robert J. Freeman
cc: Allison Welsh