(a) Each participating agency must protect the confidentiality of personally identifiable information at collection, storage, disclosure, and destruction stages.