§ 308. Personal privacy protection. 1. Any information reported to the
electronic facilitator by a government entity in connection with the
authorization of an electronic signature shall continue to be withheld
from public disclosure if such information was withheld from public
disclosure by such government entity. Electronic records shall be
considered and treated as any other records for the purposes of the
freedom of information law as set forth in article six of the public
officers law and the personal privacy protection law as set forth in
article six-A of the public officers law.

2. A person or an entity that acts as an authenticator of electronic
signatures shall not disclose to a third party any personal information
reported to it by the electronic signatory other than the information
necessary to authenticate the signature unless the disclosure is made
pursuant to a court order or statute, or if the information or data is
used solely for statistical purposes in aggregate form. For purposes of
this section, "personal information" shall mean data that identifies a
specific person, including but not limited to home and work addresses,
telephone number, e-mail address, social security number, birthdate,
gender, marital status, mother's maiden name, and health data.