Where agents are permitted, a requestor may access protected personal information through a chain of agents. For example, an employer (requestor) may use an employment agency (agent #1) to request records on its behalf. In turn, the employment agency may request the record through a recipient (agent #2).