(a) An authorized recipient of personal information may resell or redisclose the information for any use permitted under section seven.
(b) Any authorized recipient who resells or rediscloses personal information shall: (1) Maintain for a period of not less than five years, records as to the person or entity receiving information, and the permitted use for which it was obtained; (2) make the records available for inspection by the division, upon request; and (3) only be disseminated in accordance with express consent obtained pursuant to section four of this article.