(1) The department may disclose protected personal information for research purposes to governmental entities and bona fide research organizations only when:

(a) The research cannot reasonably be conducted without the protected personal information, the recipient provides adequate information for the department to reasonably determine that the disclosure of protected personal information will not harm individuals, the benefits to be derived from the disclosure are clearly in the public interest, and the results are not of a commercial interest; or

(b) The research purpose has been approved in writing by an authorized official in the department, legislature, or governor's office.

(2) The department may disclose pseudonymized data for research purposes on the condition the recipient will make no attempt to re-identify individuals.