(a) The corporation may not disclose any record or personal information unless such disclosure is:

1. (1) pursuant to a written request by or the voluntary written consent of the data subject, provided that such request or consent by its terms limits and specifically describes:

   1. (i) the personal information which is requested to be disclosed;
   2. (ii) the person or entity to whom such personal information is requested to be disclosed; and
   3. (iii) the uses which will be made of such personal information by the person or entity receiving it; or
2. (2) to those officers and employees of, and to those who contract with, the corporation if such disclosure is necessary to the performance of their official duties pursuant to a purpose of the corporation required to be accomplished by statute or executive order or necessary to operate a program specifically authorized by law; or
3. (3) subject to disclosure under the Freedom of Information Law (article 6 of the Public Officers Law) unless disclosure of such information would constitute an unwarranted invasion of personal privacy as defined in section 89(2)(a) of the Public Officers Law^*; or
4. (4) to officers or employees of another governmental unit if each category of information sought to be disclosed is necessary for the receiving governmental unit to operate a program specifically authorized by statute and if the use for which the information is requested is not relevant to the purpose for which it was collected; or
5. (5) for a routine use, as defined in section 2053.2 of this Part; or
6. (6) specifically authorized by statute or Federal rule or regulation; or
7. (7) to the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title XIII of the United States Code; or
8. (8) to a person who has provided the corporation with advance written assurance that the record will be used solely for the purpose of statistical research or reporting, but only if it is to be transferred in a form that does not reveal the identity of any data subject; or
9. (9) pursuant to a showing of compelling circumstances affecting the health or safety of a data subject, if upon such disclosure notification is transmitted to the data subject at his or her last known address; or
10. (10) to a public archival facility as a record which has sufficient historical or other value to warrant its continued preservation by the state or for evaluation by the head of the archival facility or his or her designee to determine whether the record has such value; or
11. (11) to any person pursuant to a court ordered subpoena or other compulsory legal process; or
12. (12) for inclusion in a public safety agency record or to any governmental unit or component thereof which performs as one of its principal functions any activity pertaining to the enforcement of criminal laws, provided that such record is reasonably described and is requested solely for a law enforcement function; or
13. (13) pursuant to a search warrant; or
14. (14) to officers or employees of another agency if the record sought to be disclosed is necessary for the receiving agency to comply with the mandate of an executive order, but only if such records are to be used only for statistical research, evaluation or reporting and are not used in making any determination about a data subject.

(b) Nothing in this section shall require disclosure of:

1. (1) personal information which is otherwise prohibited by law from being disclosed;
2. (2) patient records concerning mental disability or medical records where such disclosure is not otherwise required by law;
3. (3) personal information pertaining to the incarceration of an inmate at a State correctional facility which is evaluative in nature or which, if disclosed, could endanger the life or safety of any person, unless such disclosure is otherwise permitted by law; or
4. (4) attorney's work product or material prepared for litigation before judicial, quasi-judicial or administrative tribunals, as described in section 3101(c) and (d) of the Civil Practice Law and Rules, except pursuant to statute, subpoena issued in the course of a criminal action or proceeding, court-ordered or grand jury subpoena, search warrant or other court-ordered disclosure.