(a) Prohibition on disclosure.--A transportation network company shall not disclose to a third party any personally identifiable or financial information of a transportation network company passenger unless one of the following applies:
(1) The customer knowingly consents. As used in this paragraph, the term "knowingly consents" means:
(i) The customer is not required to consent to the disclosure of personally identifiable or financial information to a third party in order to use a digital network or receive a prearranged ride.
(ii) The customer consents to disclosure of personally identifiable or financial information in a document that is separate from the transportation network company's terms of service agreement.
(2) The information is disclosed under subpoena, court order or other legal obligation.
(3) The disclosure is to the commission in the context of an investigation regarding a complaint filed with the commission against a transportation network company or a transportation network company driver and the commission treats the information as proprietary and confidential.
(4) The disclosure is required to protect or defend the terms of use of the service or to investigate violations of those terms. In addition to the foregoing, a transportation network company shall be permitted to share a passenger's name or telephone number with the transportation network company driver providing transportation network company
service to the passenger in order to:
(i) facilitate correct identification of the passenger by the transportation network company driver; or
(ii) facilitate communication between the passenger and the transportation network company driver.
(b) Prohibition on sales.--A transportation network company shall not sell the personally identifiable or financial information of a transportation network company passenger. The prohibition under this subsection shall not apply to the sale, merger or acquisition of a transportation network company by another entity.
(c) Definitions.--As used in this section, the term "third party" shall not include vendors of a transportation network company who must access a passenger's personally identifiable or financial information to carry out contracted work on behalf of a transportation network company.