Here’s to you, New York
I’ve mentioned before that other than New York, only New Jersey requires that security breaches involving personal identifying information be reported centrally.
I hazarded a guess at the time that, unlike NY, NJ would not respond favorably to a freedom of information request for such records, because the mandated reporting is to the state police, whereas in NY it is to (among others) the Consumer Protection Bureau.
Well, New Jersey has indeed responded to my request for such records under their Open Public Records Act — Denied. The records I sought “are considered criminal investigatory records and are exempt from disclosure”, according to Sgt. Jeanne Hengemuhle, Government Records Custodian for the NJ State Police. Just as I suspected.
I had previously received hundreds of pages of material from NY after making an identical request. This was done promptly, and at no cost to me. I think they even answered the phone on the first ring when I called to ask to whom my request should be addressed :^).