N.Y. Comp. Codes R. & Regs. tit. 1, § 365.8 – Exemptions.

(a) Pursuant to paragraph (a) of subdivision 5 of section 95 of the Public Officers Law, unless access by a data subject is otherwise authorized or required by law, personal information compiled for law enforcement purposes is exempt from the operation of said section and from the operation of this Part, which is promulgated to implement said section, if such information would, if disclosed:
1. (1) interfere with law enforcement investigations or judicial proceedings;
2. (2) deprive a person of a right to a fair trial or impartial adjudication;
3. (3) identify a confidential source or disclose confidential information relating to a criminal investigation; or
4. (4) reveal criminal investigative techniques or procedures except routine techniques and procedures.
(b) Pursuant to paragraph (b) of subdivision 5 of section 95 of the Public Officers Law, when providing a data subject with access to personal information that is maintained by a licensing or franchise-approving agency or component thereof for the purpose of determining whether administrative or criminal action should be taken to restrain or prosecute purported violations of law, or to grant, deny, suspend, or revoke a professional, vocational or occupational license, certification or registration, or to deny or approve a franchise, information described in paragraph (b) of subdivision 7 of section 94 of said law, the department may withhold the identity of a source who furnished said information under an express promise that his or her identity would be held in confidence. Nothing in this subdivision shall, however, require the department to provide access to any record or personal information that it is not otherwise required by law to divulge.
(c) Pursuant to subdivision 6 of section 95 of the Public Officers Law, nothing in said section or in this Part, which is promulgated to implement said section, shall require the department to provide a data subject with access to:
1. (1) personal information to which he or she is specifically prohibited by statute from gaining access;
2. (2) patient records concerning mental disability or medical records where such access is not otherwise required by law;
3. (3) personal information pertaining to the incarceration of an inmate at a State correctional facility which is evaluative in nature or which, if such access was provided, could endanger the life or safety of any person, unless such access is otherwise permitted by law or by court order; or
4. (4) attorney's work product or material prepared for litigation before judicial, quasi-judicial or administrative tribunals, as described in subdivisions (c) and (d) of section 3101 of the Civil Practice Law and Rules, except pursuant to statute, subpoena issued in the course of criminal action or proceeding, court ordered or grand jury subpoena, search warrant or other court ordered disclosure.
(d) Pursuant to subdivision 7 of section 95 of the Public Officers Law, neither said section, nor this Part, which is promulgated to implement said section, shall apply to public safety agency records.
(e) Pursuant to subdivision 8 of section 95 of the Public Officers Law, nothing in said section, or in this Part, which is promulgated to implement said section, shall limit, restrict, abrogate or deny any right a person may otherwise have, including rights granted pursuant to the State or Federal Constitution, law or court order.