The State appeals from a Superior Court (McGuire, J.) order denying its motion to dismiss Peter DeVere’s petition for disclosure of information under the Driver Privacy Act, RSA 260:14, V(a)(l), (4) (Supp. 2002). We affirm.
In 1997, Peter DeVere, principal organizer of the non-profit organization NH DWI Volunteers and an advocate of drunk-driving-related legislation, contacted a State senator and requested that she file legislation reforming the allocation of low digit license plates. DeVere suggested that legislation was needed because governors were granting low digit plates to reward people who made campaign contributions. He theorized that drivers with low digit plates were not subject to the same level of law enforcement as others. In August 1997, he submitted a request under the Right-to-Know Law, RSA ch. 91-A to the New Hampshire Department of Safety (department) for the names of individuals allocated license plates with fewer than four digits. The department denied DeVere’s request, stating that motor vehicle records were not covered by RSA chapter 91-A. The department also told DeVere that he was not an “authorized recipient” of the records under RSA 260:14.
In December 1997, DeVere filed a declaratory judgment petition in the superior court for release of the records under RSA 260:14, III, V(a)(l), V(a)(4) and VIII. The superior court granted his petition under section III. The State appealed and we reversed, remanding for a determination of whether the records were available to DeVere under section V. See DeVere v. Attorney General, 146 N.H. 762, 769 (2001).
On remand, the State argued that section V did not apply to DeVere because he did not represent a “legitimate business.” The superior court disagreed and ruled that “non-profit, Vatchdog’ organizations perhaps *676more often take a legitimate and responsible interest in motor vehicle and driver safety than for-profit businesses.” The court also found that the disclosure would not constitute an unwarranted invasion of privacy because DeVere would only have access to the drivers’ names and home towns and would be prohibited from publishing, redisclosing or contacting the drivers. The superior court concluded that DeVere was entitled to the requested records under subsections V(a)(l) and V(a)(4). The State appealed. During the pendency of this appeal, Peter DeVere died and his wife, Linda M. DeVere, was substituted as the plaintiff.
The State presents three arguments on appeal: (1) DeVere lacked standing; (2) the superior court erred in ruling that the department’s rules exceed the scope of RSA 260:14, V(a)(l) and (a)(4); and (3) the superior court erred in concluding that the department unsustainably exercised its discretion by denying DeVere’s request.
The State first argues that DeVere lacked standing because he failed to submit a formal application to the department under RSA 260:14 requesting the records. In essence, the State argues that DeVere failed to exhaust his administrative remedies. The plaintiff claims that all administrative remedies have been exhausted because the department treated the August 18th letter as an application under RSA 260:14 in rejecting the request for records. DeVere also states that it would have been futile to have filed a formal application with the department because the State has conceded that the department would have denied the request. The superior court found that the court and the parties “agreed that [they] would just proceed [] as if the Department [of Safety] had rejected [DeVere’s request].” The State disputes this finding and maintains it consistently challenged DeVere’s standing throughout this litigation.
The general rule is that “a challenge to a party’s standing on the ground that no actual controversy exists constitutes a challenge to the court’s subject matter jurisdiction, which may be raised at any point in the proceedings.” Asmussen v. Comm’r, N.H. Dep’t of Safety, 145 N.H. 578, 588 (2000). Although we have previously reached the merits of the plaintiffs claim with respect to RSA 260:14, III, DeVere, 146 N.H. 762, our remand did not preclude the State from pursuing its argument that the plaintiff lacked standing.
“We have recognized that the exhaustion of administrative remedies doctrine is flexible, and that exhaustion is not required under certain circumstances. Exhaustion is not required, for example, when further administrative action would be useless and result in delays that might make the claim moot.” Konefal v. Hollis/Brookline Coop. School Dist., 143 *677N.H. 256, 258-59 (1998); see Petition of Chapman, 128 N.H. 24, 26 (1986) (letter to agency sufficient for agency to consider its position and for court to reach the merits). Because this matter has been pending for more than five years without resolution and the State concedes that the department would have denied the plaintiffs request, we conclude that the plaintiff exhausted the administrative remedies and that the plaintiff may challenge the validity of the department’s decision. See Asmussen, 147 N.H. at 587.
Second, the State argues that the superior court erred in concluding that New Hampshire Administrative Rule, Saf-C 5601.08 (January 14, 2002) (Rule 5601.08), exceeded the scope of RSA 260:14, V(a)(l) and (a)(4). RSA 260:14, V(a) states:
Except for a person’s photograph, computerized image and social security number, motor vehicle records may be made available upon proof of the identity of the person requesting the records and representation by such person... that the use of the records will be strictly limited to one or more of the following described uses, which use shall be specified in the request:
(1) For use by a legitimate business in connection with matters of motor vehicle or driver safety and theft...
(4) For use by a legitimate business in research activities, and for use by a legitimate business in statistical reports, so long as any personal information is not published, redisclosed, or used to contact individuals.
At the time DeVere submitted his request, the statute did not define “legitimate business.” Subsequently, the department promulgated Rule 5601.08, which defined “legitimate business” as “a business which is registered to do business in New Hampshire and which receives compensation.”
In the superior court, the State argued that DeVere was not a “legitimate business” because his non-profit organization did not receive compensation. In response, DeVere argued and the superior court agreed that Rule 5601.08 was invalid because it “modifies the statute by excluding an entire class of otherwise legitimate businesses from access to records because these businesses do not receive compensation.”
The legislature may delegate authority to administrative agencies to promulgate rules necessary to implement a statute. Suburban Realty, Inc. v. Albin, 131 N.H. 689, 691 (1989). Nevertheless, “[i]t is well established that administrative officials do not possess the power to contravene a statute. Administrative rules may not add to, detract from, or modify the statute which they are intended to implement.” Appeal of Anderson, 147 N.H. 181, 183 (2001). Thus, rule-making authority is limited to “filling] in *678details to effectuate the purpose of the statute.” Suburban Realty, Inc., 131 N.H. at 692.
Here, the superior court concluded that the regulation modifies the statute by excluding an entire class of otherwise legitimate businesses. The court noted that while limiting “legitimate business” to those that receive compensation prevents disclosure to those whose interest is personal curiosity or hobby, “it is not a rational reason for excluding all non-profit businesses from access” because such “watchdog” organizations have a legitimate interest in driver safety. Assuming, as the superior court did, that the requirement that a business “receive compensation” excludes non-profit organizations, we agree with the superior court that such organizations may be connected to safety, theft, and market research or be involved in “research activities.” We also agree -with the superior court that the exclusion of such organizations, pursuant to Rule 5601.08, exceeds the scope of RSA 260:14, V(a)(l) and (a)(4) and thus is invalid.
We note that Rule 5601.08 has been recently amended to encompass RSA 260:14, 1(d), which also has recently been amended. Currently, RSA 260:14, 1(d) limits the definition of a “legitimate business” to one “which receives compensation in connection with matters of motor vehicle safety or driver safety____” RSA 260:14, 1(d) (Supp. 2002). Neither party has argued that this amendment applies to this case. Our holding is thus limited to the former version of the statute and regulation.
Having concluded that the regulation does not bar access to the information requested, the next issue is whether the plaintiff is entitled to disclosure under subsections (a)(1) or (a)(4). The superior court ruled that DeVere’s request fell within both (a)(1) and (a)(4). We agree that the plaintiff was engaged in “research activities” covered by (a)(4) and the State, in its brief, does not contend otherwise.
Finally, the State argues that the superior court erred in concluding that the department unsustainably exercised its discretion by denying the plaintiffs request. RSA 260:14, V, provides that “motor vehicle records may be made available.” By using the term “may,” the statute authorizes the department to exercise discretion in releasing records. RSA 260:14, V(a). To define this discretion, the department promulgated New Hampshire Administrative Rule, Saf-C 5605.17(a), which provides that “[t]he [commissioner] may refuse to release records which are requested pursuant to RSA 260:14 in any particular case if he determines that such a release may be contrary to the public interest or would constitute an unwarranted invasion of privacy.”
The superior court held that this rule did not support nondisclosure of the requested information. The court found that DeVere’s interest in *679promoting safety was not contrary to the public interest. The court found no invasion of privacy because the recipient of the information is prohibited from reusing it or contacting the license plate owners, and the owners were informed that they could opt out of disclosure.
We agree that the unique facts of this case support the superior court’s conclusion. Only the names and home towns of the license plate owners will be disclosed. The plaintiff cannot publish or disclose the information. Moreover, prior to this case being heard on remand, the department sent a letter to all persons with low digit license plates informing them of their right to opt out of disclosure under RSA 260:14, V(b). Thus, all persons whose motor vehicle records would be affected by disclosure have had the opportunity to protect their privacy. Based upon these narrow facts, we agree with the superior court that disclosure to the plaintiff is not contrary to the public interest or an unwarranted invasion of privacy, and that the department’s decision to the contrary constituted an unsustainable exercise of discretion.
Affirmed.
Groff, Fauver, Lynn and Abramson, JJ., superior court justices, specially assigned under RSA 490:3, concurred.