N.Y. State Technology Law § 204: Collection and disclosure of personal information

§ 204. Collection and disclosure of personal information. No state

agency shall collect personal information concerning a user through a

state agency website, or disclose personal information concerning a user

to any person, firm, partnership, corporation, limited liability company

or other entity, including internal staff who do not need the

information in the performance of their official duties pursuant to a

state agency purpose meeting the requirements of subdivision one of

section two hundred six of this article, unless such user has consented

to the collection or disclosure of such personal information. For the

purposes of this section, the voluntary disclosure of personal

information to a state agency by a user through a state agency website,

whether solicited or unsolicited, shall constitute consent to the

collection or disclosure of the information by the state agency for the

purposes for which the user disclosed it to the state agency, as

reasonably ascertainable from the nature and terms of the disclosure.