N.Y. State Technology Law § 206

§ 206. Exceptions. Notwithstanding section two hundred four of this\narticle, a state agency may collect or disclose personal information if\nthe collection or disclosure is:\n 1. necessary to perform the statutory duties of the state agency that\ncollected or is collecting the personal information, or necessary for\nthat agency to operate a program authorized by law, or authorized by\nstate or federal statute or regulation;\n 2. made pursuant to a court order or by law;\n 3. for the purpose of validating the identity of the user; or\n 4. if the information is used solely for statistical purposes and is\nin a form that cannot be used to identify any particular person.\n