1.  Records maintenance.  An operator shall maintain for 3 years after an Internet gaming event occurs at least the following records of all wagers placed with respect to that Internet gaming event:  

2.  Anonymized information.  An operator shall use commercially reasonable efforts to maintain, in real time and at the account level, anonymized information regarding a person who places a wager; the amount and type of the wager; the time the wager was placed; the location of the wager, including the Internet protocol address if applicable; the outcome of the wager; and records of abnormal wagering activity. The director may request that information in the form and manner required by rule. Nothing in this subsection requires an operator to provide any information that is prohibited by federal or state law, including without limitation laws and rules relating to privacy and personally identifiable information.   

3.  Records monitoring.  If an entity involved in the Internet gaming event has notified the director that access to the information described in subsection 2 for wagers placed on Internet gaming events of that entity is necessary to monitor the integrity of that Internet gaming event, and the entity represents to the director that it specifically uses that data for the purpose of monitoring the integrity of the Internet gaming event, an operator shall share, in a commercially reasonable frequency, form and manner, with the entity or its designee the same information the operator is required to maintain under subsection 2 with respect to the Internet gaming event. An entity and its designee may use information received under this subsection only for integrity-monitoring purposes and may not use information received under this subsection for any commercial or other purpose. Nothing in this subsection requires an operator to provide any information if prohibited by federal or state law, including without limitation laws and rules relating to privacy and personally identifiable information.  

4.  Security.  An operator shall use commercially reasonable methods to maintain the security of wagering data, customer data and other confidential information from unauthorized access and dissemination. Nothing in this chapter precludes the use of Internet-based or so-called cloud-based hosting of that data and information or disclosure as required by law.