(a) For purposes of the Freedom of Information Law, as set forth in article six of the Public Officers Law, and the Personal Privacy Protection Law, as set forth in article six-a of the Public Officers Law, electronic records shall be considered and treated in the same manner as any other record.

(b) Except to the extent disclosure of personal information is required by a court order or a statute, or if the information is used solely for statistical purposes in aggregate form, no person acting as a certification authority shall disclose to a third party any personal information reported to the certification authority by the electronic signatory other than the information necessary to issue or authenticate the certificate. Information reported to a certification authority for purposes other than issuing a certificate shall not be subject to this subdivision. For purposes of this subdivision, the phrase personal information shall mean, but not be limited to, the following types of information which could identify a specific person: home and work address, telephone number, e-mail address, social security number, birth date, gender, marital status, mother's maiden name, and health data.