Sec. 23. Except as otherwise required or permitted by law or regulation, a financial services provider may not disclose a financial record that:
(1) is related to a payment card transaction; and
(2) includes protected financial information, including a firearms code that was used, collected, or assigned in violation of this chapter.