An autonomous vehicle network company shall not disclose to any person the personally identifiable information of a passenger who received services from the company unless:
1. The disclosure is otherwise required by law;
2. The company determines that disclosure is required to protect or defend the terms of use of the services or to investigate violations of those terms of use; or
3. The passenger consents to the disclosure.