An authority shall do all of the following:
(1) Develop rules of conduct for its employees who are involved in collecting, maintaining, using, providing access to, sharing or archiving personally identifiable information.
(2) Ensure that the persons identified in sub.
(1) know their duties and responsibilities relating to protecting personal privacy, including applicable state and federal laws.