1.  Records maintenance.  An operator shall maintain for 3 years after a sports event occurs at least the following records of all wagers placed with respect to that sports event:  

2.  Anonymized information.  An operator shall use commercially reasonable efforts to maintain, in real time and at the account level, anonymized information regarding a person who places a wager and the amount and type of the wager, the time the wager was placed, the location of the wager, including the Internet protocol address if applicable, the outcome of the wager and records of abnormal wagering activity. The director may request that information in the form and manner required by rule. Nothing in this subsection requires an operator to provide any information that is prohibited by federal or state law, including without limitation laws and rules relating to privacy and personally identifiable information.  

3.  Records monitoring.  If a sports governing body has notified the director that access to the information described in subsection 2 for wagers placed on sports events of that sports governing body is necessary to monitor the integrity of that sports governing body's sports events, and the sports governing body represents to the director that it specifically uses that data for the purpose of monitoring the integrity of sports events of that sports governing body, then an operator shall share, in a commercially reasonable frequency, form and manner, with the sports governing body or its designee the same information the operator is required to maintain under subsection 2 with respect to sports wagers on sports events of that sports governing body. A sports governing body and its designee may use information received under this subsection only for integrity-monitoring purposes and may not use information received under this subsection for any commercial or other purpose. Nothing in this subsection requires an operator to provide any information if prohibited by federal or state law, including without limitation laws and rules relating to privacy and personally identifiable information.  

4.  Security.  An operator shall use commercially reasonable methods to maintain the security of wagering data, customer data and other confidential information from unauthorized access and dissemination. Nothing in this chapter precludes the use of Internet-based or so-called cloud-based hosting of that data and information or disclosure as required by law.