An agency by rule shall require a requestor to delete from the requestor’s records personal information received from the agency under this chapter if the requestor becomes aware that the requestor is not an authorized recipient of that information.