Section 206. Exceptions

Notwithstanding section two hundred four of this
  article, a state agency may collect or disclose personal information  if
  the collection or disclosure is:
    1.  necessary to perform the statutory duties of the state agency that
  collected or is collecting the personal information,  or  necessary  for
  that  agency  to  operate  a program authorized by law, or authorized by
  state or federal statute or regulation;
    2. made pursuant to a court order or by law;
    3. for the purpose of validating the identity of the user; or
    4. if the information is used solely for statistical purposes  and  is
  in a form that cannot be used to identify any particular person.