41(1)A public body that uses personal information about an individual to make a decision that directly affects the individual shall, subject to any other Act of the Legislature, establish and comply with a written policy concerning the retention of the personal information.