(2) The department may adopt rules specifying conditions that must be met by a person or government agency requesting personal information under ORS 802.179. Such conditions may include but need not be limited to:
(a) Providing reasonable assurance of the identity of the requester;
(b) Providing reasonable assurance of the uses to which the personal information will be put, if applicable;
(c) Showing that the individual whose personal information is to be disclosed has given permission for the disclosure, if permission is required; and
(d) Submitting a written request for the personal information in a form prescribed by the department. [1997 c.678 §6; 2007 c.467 §3]