Nothing herein shall be read to authorize the disclosure of personal data to entities or individuals that

do not meet the definition of “agency” set forth in 101 CMR 16.03, without the written consent of the client or his legally authorized representative, except as otherwise required or permitted by federal and state law.