; and (2) the head of the Federal entity described in paragraph (1) shall promptly conduct the review. (f) Role of non-Federal entities The Department may share information about election cybersecurity incidents, threats, and vulnerabilities through a non-Federal entity. (g) Protection of personal and confidential information (1) In general If a Federal entity shares information relating to an election cybersecurity incident, threat, or vulnerability, the Federal entity shall, within Federal information systems (as defined in section 3502 of title 44, United States Code) of the entity— (A) minimize the acquisition, use, and disclosure of personal information of voters, except as necessary to identify, protect against, detect, respond to, or recover from election cybersecurity incidents, threats, and vulnerabilities; (B) notwithstanding any other provision of law, prohibit the retention of personal information of voters, such as— (i) voter registration information, including physical address, email address, and telephone number; (ii) political party affiliation or registration information; and (iii) voter history, including registration status or election participation; and (C) protect confidential Federal and State information from unauthorized disclosure. (2) Exemption from disclosure Information relating to an election cybersecurity incident, threat, or vulnerability, such as personally identifiable information of reporting persons or individuals affected by such incident, threat, or vulnerability, shared by or with the Federal Government shall be— (A) deemed voluntarily shared information and exempt from disclosure under section 552 of title 5, United States Code, and any State, tribal, or local provision of law requiring disclosure of information or records