A transportation network company or delivery network company may not disclose any personally identifiable information of a transportation network company passenger or delivery network company customer, except pursuant to the publicly disclosed terms of the transportation network company’s or delivery network company’s privacy policy. For any other disclosure not governed by the privacy policy, the transportation network company or delivery network company must obtain the passenger’s consent before the company may disclose the passenger’s or customer’s personally identifiable information.