(1) The Authority shall in addition to the provisions of this Part issue guidelines on the access, use, retention and disclosure of personal information by user agencies.

(2) Guidelines issued under subsection (1) shall be under the signature of the Executive Secretary and shall provide sanctions for breach of the guidelines.