Can I ignore consumer requests for information or deletion in New York? What are the requirements?

Requirements for Consumer Requests for Information or Deletion in New York

Under New York law, consumers have the right to request access to their personal information held by businesses and to request deletion of their personal information under certain circumstances. Businesses must comply with these requests, subject to certain exceptions.

Request for Access to Personal Information

If a consumer requests access to their personal information, the business must provide the requested information within five business days of receipt of the request [21 NYCRR 701.3(b)]. If the business cannot provide the information within five business days, they must acknowledge receipt of the request and provide an approximate date when the request will be granted or denied [21 NYCRR 701.3(c)]. If access to the requested records is neither granted nor denied within 30 business days after the date of acknowledgment of receipt of a request, it shall be construed as a denial which may be appealed [21 NYCRR 701.3(c)].

Request for Deletion of Personal Information

If a consumer requests deletion of their personal information, the business must delete the information within a reasonable time, subject to certain exceptions [11 NYCRR 242.8(b)]. If the business denies the request, they must provide a written explanation of the reasons for the denial and identify the person to whom an appeal may be directed [11 NYCRR 242.8(a)(1)].

Exceptions

Businesses are not required to comply with a consumer’s request for access to or deletion of their personal information if the request is frivolous, vexatious, or made in bad faith [21 NYCRR 701.5(a)]. Additionally, businesses are not required to comply with a request for deletion if the personal information is necessary for the business to maintain the consumer’s account or to complete a transaction requested by the consumer, among other exceptions [11 NYCRR 242.8(b)].

Appeal Process

If a business denies a consumer’s request for access to or deletion of their personal information, the consumer may appeal the denial. The appeal process varies depending on the specific regulation governing the request. For example, a denial of a request for access to records may be appealed to the Deputy General Counsel of the New York State Department of Financial Services [11 NYCRR 242.8(c)], while a denial of a request for deletion of personal information may be appealed to the Executive Director of the New York State Council on the Arts [9 NYCRR 6402.8(a)(2)].

Conclusion

Businesses in New York must comply with consumer requests for access to and deletion of their personal information, subject to certain exceptions. If a business denies a consumer’s request, the consumer may appeal the denial to the appropriate authority.

Jurisdiction

New York

• Privacy