(1) Personal information collected by any public body or under the custody or control of such body shall be protected by such body.
(2) For the purpose of sub-section (1), the public body shall make appropriate arrangements for protection against unauthorized access to personal information or the unauthorized use, manipulation, disclosure, publication or transmission of such information.
(3) Notwithstanding anything contained elsewhere in this section, a public body may disclose or cause to be disclosed any personal information in accordance with prevailing laws.