N.Y. Public Officers Law § 98
Any agreement purporting to waive a data subject's rights under this article is hereby declared to be void as against public policy.