A transportation network company shall not disclose to a third party any personally identifiable information of a transportation network company passenger unless one of the following applies:
(1) The customer knowingly consents.
(2) Pursuant to a legal obligation.
(3) The disclosure is to the commission in order to investigate a complaint filed with the commission against a transportation network company or a participating driver and the commission treats the information under confidentiality protections.