The act requires each state or municipal board, commission, department, or officer, except town or regional boards of education, that maintains a collection of records containing personal data to: 1. keep a record of everyone who has obtained access to or to whom disclosure has been made of personal data and the reason for each disclosure or access for at least five years; 2. make this record avai