N.Y. Comp. Codes R. & Regs. tit. 11, § 420.12
(3) to a participant in an affinity or similar program where the participants in the program are identified to the customer when the customer enters into the program.
(c) Examples.
(a) General prohibition on disclosure of policy numbers.
A licensee shall not, directly or through an affiliate, disclose, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer's policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.
(b) Exceptions.
Subdivision (a) of this section does not apply if the licensee discloses a policy number or similar form of access number or access code: