(1) The department must disclose marijuana registry information to authorized employees of the department as necessary to perform the official duties of the department.

(2) The department must disclose marijuana registry information to authorized employees of state or local government agencies, including state or local law enforcement agencies, only as necessary to verify that an individual is a lawful possessor of a registry identification card.

(3) The department must disclose marijuana registry information as otherwise required by law.