To my way of thinking, what the drafters really meant instead of “may” was “is permitted to”, because this is a description of when organizations are permitted to release information without consent. Rather than the word “may”, I think what was meant was “is permitted to disclose personal information”, etc., whereas “may” could give the impression that there's some discretion.
Thank you.
Mr. Wallace.