Section 96. Disclosure of records

(1) No agency may disclose any record or
  personal information unless such disclosure is:
    (a) pursuant to a written request by or the voluntary written  consent
  of  the data subject, provided that such request or consent by its terms
  limits and specifically describes:
    (i) the personal information which is requested to be disclosed;
    (ii) the person  or  entity  to  whom  such  personal  information  is
  requested to be disclosed; and
    (iii)  the uses which will be made of such personal information by the
  person or entity receiving it; or
    (b) to those officers and employees of,  and  to  those  who  contract
  with,  the  agency  that  maintains  the  record  if  such disclosure is
  necessary to the performance of their  official  duties  pursuant  to  a
  purpose  of  the  agency  required  to  be  accomplished  by  statute or
  executive  order  or  necessary  to  operate  a   program   specifically
  authorized by law; or
    (c)  subject  to  disclosure under article six of this chapter, unless
  disclosure of such information would constitute an unwarranted  invasion
  of  personal  privacy  as defined in paragraph (a) of subdivision two of
  section eighty-nine of this chapter; or
    (d) to officers or employees of  another  governmental  unit  if  each
  category  of  information  sought  to  be disclosed is necessary for the
  receiving governmental unit to operate a program specifically authorized
  by statute and if the use for which the information is requested is  not
  relevant to the purpose for which it was collected; or
    (e)  for  a  routine  use,  as  defined  in subdivision ten of section
  ninety-two of this article; or
    (f) specifically authorized by statute or federal rule or  regulation;
  or
    (g)  to  the bureau of the census for purposes of planning or carrying
  out a census or survey or related activity pursuant to the provisions of
  Title XIII of the United States Code; or
    (h) to a person who has  provided  the  agency  with  advance  written
  assurance  that  the  record  will  be  used  solely  for the purpose of
  statistical research or reporting, but only if it is to  be  transferred
  in a form that does not reveal the identity of any data subject; or
    (i)  pursuant  to  a showing of compelling circumstances affecting the
  health or safety of a data subject, if upon such disclosure notification
  is transmitted to the data subject at his or her last known address; or
    (j) to the state archives as a record which has sufficient  historical
  or other value to warrant its continued preservation by the state or for
  evaluation  by  the  state archivist or his or her designee to determine
  whether the record has such value; or
    (k) to any person pursuant  to  a  court  ordered  subpoena  or  other
  compulsory legal process; or
    (l)  for  inclusion  in  a  public  safety  agency  record  or  to any
  governmental unit or component thereof which  performs  as  one  of  its
  principal  functions  any  activity  pertaining  to  the  enforcement of
  criminal laws, provided that, such record is reasonably described and is
  requested solely for a law enforcement function; or
    (m) pursuant to a search warrant; or
    (n) to officers or employees of another agency if the record sought to
  be disclosed is necessary for the receiving agency to  comply  with  the
  mandate  of  an executive order, but only if such records are to be used
  only for statistical research, evaluation or reporting and are not  used
  in making any determination about a data subject.
    (2) Nothing in this section shall require disclosure of:

    (a)  personal  information  which  is otherwise prohibited by law from
  being disclosed;
    (b)  patient  records  concerning mental disability or medical records
  where such disclosure is not otherwise required by law;
    (c) personal information pertaining to the incarceration of an  inmate
  at a state correctional facility which is evaluative in nature or which,
  if  disclosed,  could  endanger the life or safety of any person, unless
  such disclosure is otherwise permitted by law;
    (d) attorney's work product or material prepared for litigation before
  judicial, quasi-judicial or administrative tribunals,  as  described  in
  subdivisions  (c)  and  (d) of section three thousand one hundred one of
  the civil practice law and rules, except pursuant to  statute,  subpoena
  issued  in  the course of a criminal action or proceeding, court ordered
  or  grand  jury  subpoena,  search  warrant  or  other   court   ordered
  disclosure.