N.Y. State Technology Law § 206: Exceptions

§ 206. Exceptions. Notwithstanding section two hundred four of this

article, a state agency may collect or disclose personal information if

the collection or disclosure is:

1. necessary to perform the statutory duties of the state agency that

collected or is collecting the personal information, or necessary for

that agency to operate a program authorized by law, or authorized by

state or federal statute or regulation;

2. made pursuant to a court order or by law;

3. for the purpose of validating the identity of the user; or

4. if the information is used solely for statistical purposes and is

in a form that cannot be used to identify any particular person.