N.Y. Gen. Bus. Law § 521-c

§ 521-c. Limitation on release of subscriber names. No credit card\nregistration service shall rent, sell, exchange or otherwise make\navailable the names, addresses and account numbers of cardholders or\nowners of access devices entrusted to it by a credit card or access\ndevice issuer or other financial institution to any other person for use\nin direct mail marketing or solicitation without prior written approval\nof the cardholder or access device owner. Notwithstanding the foregoing,\nnothing in this section shall be construed to restrict a card issuer's\nuse of its own cardholder list.\n