(1) A requester who receives personal information or highly restricted personal information pursuant to 61-11-507, 61-11-508, 61-11-509, or 61-11-510 may not sell or disclose the information, except for a use that is specifically permitted in 61-11-507, 61-11-508, or 61-11-509.
(2) A requester who sells or discloses personal information or highly restricted personal information to a third party under this section shall create and maintain records for a period of not less than 5 years from the date of the sale or disclosure. The records must show the name, address, telephone number, and any other identifying information required by the department of the third party who bought or received the information and must document the permitted use for which the information was obtained. The records must be produced or made available for inspection at the request of the department.