"Written authorization by the employee is required for disclosure of any personal information to anyone other than the employee, except as required by law." . . . .