N.Y. Comp. Codes R. & Regs. tit. 9, § 330-2.3 – Proof of identity.

(a) When a request is made in person, or when records are made available in person following a request made by mail, the agency may require appropriate identification, such as a driver's license, an identifier assigned to the data subject by the agency, a photograph or similar information that confirms that the record sought pertains to the data subject. The agency may also require the requester to set forth on a form or plain piece of paper the following information:
1. (1) the name of the employee;
2. (2) the name of the person the employee authorizes disclosure to, if appropriate. If the information is to go to an organization or other entity, the employee must provide the name of the organization, its address, telephone number, the title and name of recipient; what portion or portions of this or her file he or she wants the person to have access to and the purpose for disclosing the information, as appropriate;
3. (3) the date of the request.
(b) When a request is made by mail, the agency may require verification of a signature or inclusion of an identifier generally known only by a data subject, or similar appropriate identification.
(c) Proof of identity shall not be required regarding a request for a record accessible to the public pursuant to article 6 of the Public Officers Law.