In the event of misuse or unauthorized disclosure of personal or identity information by either the recipient or its subrecipient the recipient must:

(1) Notify the department as outlined in its data sharing agreement with the department;

(2) Cooperate with all department requirements in responding to the event;

(3) Notify the department before notifying individuals or the public.

The subrecipient must notify the recipient of a misuse or unauthorized disclosure of personal or identity information.