(1) An authorized recipient of personal information disclosed under section 208c may resell or redisclose the information only for a use permitted under section 208c.

    (2) An authorized recipient of personal information disclosed under section 208c who resells or rediscloses the information shall do both of the following:

    (a) Make and keep for a period of not less than 5 years records identifying each person who received personal information from the authorized recipient and the permitted use for which it was obtained.

    (b) Allow a representative of the secretary of state, upon request, to inspect and copy records identifying each person who received personal information from the authorized recipient and the permitted use for which it was obtained.