§ 308. Personal privacy protection. 1. Any information reported to the electronic facilitator by a government entity in connection with the authorization of an electronic signature shall continue to be withheld from public disclosure if such information was withheld from public disclosure by such government entity. Electronic records shall be considered and treated as any other records for the purposes of the freedom of information law as set forth in Article 6 of the public officers law and the personal privacy protection law as set forth in Article 6-A of the public officers law.

2. A person or an entity that acts as an authenticator of electronic signatures shall not disclose to a third party any personal information reported to it by the electronic signatory other than the information necessary to authenticate the signature unless the disclosure is made pursuant to a court order or statute, or if the information or data is used solely for statistical purposes in aggregate form. For purposes of this section, "personal information" shall mean data that identifies a specific person, including but not limited to home and work addresses, telephone number, e-mail address, social security number, birthdate, gender, marital status, mother's maiden name, and health data.