(a) Except as provided by Subsection (b) and Section 92.002(b), after receiving a written request under Section 92.003, a person, including a data broker, may not transfer the covered information to any other person through any medium.
(b) Subsection (a) does not apply to:
(1) the transfer of the covered information as part of a news story, commentary, editorial, or other speech on a matter of public concern to which the information is relevant;
(2) covered information voluntarily posted on the Internet by the at-risk individual or the immediate family member of the individual to whom the information refers; or
(3) a transfer of the covered information:
(A) at the request of the individual or family member; or
(B) as necessary to produce a request to the person from the individual or family member.