§ 96. Disclosure of records. (1) No agency may disclose any record or
personal information unless such disclosure is:

(a) pursuant to a written request by or the voluntary written consent
of the data subject, provided that such request or consent by its terms
limits and specifically describes:

(i) the personal information which is requested to be disclosed;

(ii) the person or entity to whom such personal information is
requested to be disclosed; and

(iii) the uses which will be made of such personal information by the
person or entity receiving it; or

(b) to those officers and employees of, and to those who contract
with, the agency that maintains the record if such disclosure is
necessary to the performance of their official duties pursuant to a
purpose of the agency required to be accomplished by statute or
executive order or necessary to operate a program specifically
authorized by law; or

(c) subject to disclosure under article six of this chapter, unless
disclosure of such information would constitute an unwarranted invasion
of personal privacy as defined in paragraph (a) of subdivision two of
section eighty-nine of this chapter; or

(d) to officers or employees of another governmental unit if each
category of information sought to be disclosed is necessary for the
receiving governmental unit to operate a program specifically authorized
by statute and if the use for which the information is requested is not
relevant to the purpose for which it was collected; or

(e) for a routine use, as defined in subdivision ten of section
ninety-two of this article; or

(f) specifically authorized by statute or federal rule or regulation;
or

(g) to the bureau of the census for purposes of planning or carrying
out a census or survey or related activity pursuant to the provisions of
Title XIII of the United States Code; or

(h) to a person who has provided the agency with advance written
assurance that the record will be used solely for the purpose of
statistical research or reporting, but only if it is to be transferred
in a form that does not reveal the identity of any data subject; or

(i) pursuant to a showing of compelling circumstances affecting the
health or safety of a data subject, if upon such disclosure notification
is transmitted to the data subject at his or her last known address; or

(j) to the state archives as a record which has sufficient historical
or other value to warrant its continued preservation by the state or for
evaluation by the state archivist or his or her designee to determine
whether the record has such value; or

(k) to any person pursuant to a court ordered subpoena or other
compulsory legal process; or

(l) for inclusion in a public safety agency record or to any
governmental unit or component thereof which performs as one of its
principal functions any activity pertaining to the enforcement of
criminal laws, provided that, such record is reasonably described and is
requested solely for a law enforcement function; or

(m) pursuant to a search warrant; or

(n) to officers or employees of another agency if the record sought to
be disclosed is necessary for the receiving agency to comply with the
mandate of an executive order, but only if such records are to be used
only for statistical research, evaluation or reporting and are not used
in making any determination about a data subject; or

(o) to officers or employees of a public retirement system of the city
of New York if the information sought to be disclosed is necessary for
the receiving public retirement system to process benefits under the
retirement and social security law, the administrative code of the city
of New York, or the education law or any other applicable provision of
law. A written request or consent from the data subject pursuant to
paragraph (a) of this subdivision shall not be required for the
disclosure of records pursuant to this paragraph; or

(p) to officers or employees of the United States department of
education for such department to process credit for qualifying
employment and loan forgiveness under the public service loan
forgiveness program. A written request or consent from the data subject
pursuant to paragraph (a) of this subdivision shall not be required for
the disclosure of records pursuant to this paragraph.

(2) Nothing in this section shall require disclosure of:

(a) personal information which is otherwise prohibited by law from
being disclosed;

(b) patient records concerning mental disability or medical records
where such disclosure is not otherwise required by law;

(c) personal information pertaining to the incarceration of an
incarcerated individual at a state correctional facility which is
evaluative in nature or which, if disclosed, could endanger the life or
safety of any person, unless such disclosure is otherwise permitted by
law;

(d) attorney's work product or material prepared for litigation before
judicial, quasi-judicial or administrative tribunals, as described in
subdivisions (c) and (d) of section three thousand one hundred one of
the civil practice law and rules, except pursuant to statute, subpoena
issued in the course of a criminal action or proceeding, court ordered
or grand jury subpoena, search warrant or other court ordered
disclosure.