(b) The personal privacy protection officer shall disclose records and personal information to third parties only if the disclosure is:

1. (1) pursuant to a written request by, or a voluntary written consent of, the data subject, provided that such request or consent by its terms limits and specifically describes:

   1. (i) the personal information to be disclosed;
   2. (ii) the person or entity to whom the personal information is to be disclosed; and
   3. (iii) the use which will be made of the personal information by such person or entity;
2. (2) to officers and employees of the division, or to contractors with the division, if the disclosure is necessary to the performance of their official duties pursuant to a purpose required to be accomplished by statute or executive order, or necessary to operate a program specifically authorized by law;
3. (3) authorized under Subpart 166-1 of this Part, unless the disclosure would constitute an unwarranted invasion of personal privacy;
4. (4) to officers or employees of another governmental unit if each category of information sought to be disclosed is necessary for the receiving governmental unit to operate a program specifically authorized by statute and if the use for which the information is requested is not relevant to the purpose for which it was collected;
5. (5) for a routine use;
6. (6) specifically authorized by statute or Federal rule or regulation;
7. (7) to a person who has provided the agency with advance written assurance that the record will be used solely for the purpose of statistical research or reporting, but only if it is to be transferred in a form that does not reveal the identity of any data subject;
8. (8) pursuant to a showing of compelling circumstances affecting the health or safety of a data subject, if upon such disclosure notification is transmitted to the data subject at his or her last known address;
9. (9) to a public archival facility as a record which has sufficient historical or other value to warrant its continued preservation by the State or for evaluation by the head of the archival facility or his or her designee to determine whether the record has such value;
10. (10) to any person pursuant to a court ordered subpoena or other compulsory legal process;
11. (11) for inclusion in a public safety record or to any governmental unit or component thereof which performs as one of its principal functions any activity pertaining to the enforcement of criminal laws, provided that, such record is reasonably described and is requested solely for a law enforcement function;
12. (12) to officers or employees of another agency if the record sought to be disclosed is necessary for the receiving agency to comply with the mandate of an executive order, but only if such records are to be used only for statistical research, evaluation or reporting and are not used in making any determination about a data subject; or
13. (13) as otherwise authorized by the Public Officers Law, section 96(1).

(c) Nothing in this section shall require disclosure of:

1. (1) personal information which is otherwise prohibited by law from being disclosed, including but not limited to youth records, the confidentiality of which is protected by section 372 of the Social Services Law and section 166-1.2 of this Part and section 168.7 of this Title;
2. (2) attorneys' work product or material prepared for litigation before judicial, quasi-judicial or administrative tribunals, as described in Civil Practice Law and Rules, section 3101(c) and (d), except pursuant to statute, subpoena issued in the course of a criminal action or proceeding, court-ordered or grand jury subpoena, search warrant or other court-ordered disclosure; or
3. (3) any other information exempt from disclosure pursuant to Public Officers Law, section 96(2).

(e) For disclosures pursuant to paragraphs (b)(4), (8) and (11) of this section, the personal privacy protection officer shall:

1. (1) keep an accurate accounting of the date, nature and purpose of each disclosure of a record or personal information, and the name and address of the person or governmental unit to whom the disclosure is made;
2. (2) retain the accounting made under paragraph (1) of this subdivision as part of the record for at least five years after the disclosure for which the accounting is made, or for the life of the record disclosed, whichever is longer;
3. (3) at the request of the data subject, inform any person or other governmental unit to which a disclosure has been or is made of any correction, amendment, or notation of dispute made by the agency, provided that an accounting of the prior disclosure was made or that the data subject to whom the record pertains provides the name of such person or governmental unit; and
4. (4) with respect to disclosures made for inclusion in a public safety agency record or to a governmental unit or component thereof whose primary function is the enforcement of civil or criminal statutes, comply with the provisions of the Public Officers Law, section 94(3)(d) and (e).