Personal information as defined in section three of this article shall be disclosed upon request if the person making the request demonstrates in such form and manner as the department prescribes that he or she has obtained the written consent of the person who is the subject of the information.