Notwithstanding section two hundred four of this article, a state agency may collect or disclose personal information if the collection or disclosure is: 1. necessary to perform the statutory duties of the state agency that collected or is collecting the personal information, or necessary for that agency to operate a program authorized by law, or authorized by state or federal statute or regulation; 2. made pursuant to a court order or by law; 3. for the purpose of validating the identity of the user; or 4. if the information is used solely for statistical purposes and is in a form that cannot be used to identify any particular person.
New York Legal Code