(a) An authorized recipient of personal information may not redisclose the personal information in the identical or a substantially identical format the personal information was disclosed to the recipient by the applicable agency.
(b) An authorized recipient of personal information may redisclose the information, including redisclosure for compensation, only for a use permitted under § 730.007.

(c) An authorized recipient who rediscloses personal information obtained from an agency shall be required by that agency to:
(1) maintain for a period of not less than five years records as to any person or entity receiving that information and the permitted use for which it was obtained; and
(2) provide copies of those records to the agency on request.
(c-1) A person who receives personal information under Subsection (b) may not redisclose the personal information, including redisclosure for compensation, to a person who is not an authorized recipient.
(c-2) An authorized recipient shall notify each person who receives personal information from the authorized recipient that the person may not redisclose the personal information to a person who is not an authorized recipient.
(d) A person commits an offense if the person violates this section. An offense under this subsection is a misdemeanor punishable by a fine not to exceed $100,000.