m. The ERT service provider shall hold and protect all personal information as required by Iowa Code section 321.11 and the federal Driver's Privacy Protection Act, 18 U.S.C. §2721 et seq. (the DPPA), shall only use or release such personal information for purposes necessary to perform services as an ERT service provider, and shall release such personal information for no other purposes or use except as required to comply with legal or administrative matters as permitted under the DPPA. The ERT service provider shall immediately advise the department of any suspected or actual unauthorized release of personal information or highly restricted personal information and shall notify the entity and individual whose personal information or highly restricted personal information was released in an unauthorized manner. This rule is intended to implement Iowa Code sections 321.1, 321.8, 321.20, 321.23 to 321.26, 321.31, 321.34, 321.46, 321.105A, 321.109, 321.122, 321.515, 321.519, 322.19A and 423.26.