§ 38-12. Data sharing requirements.

(a) In general.

As a condition to holding a permit, a provider must submit data and reports as required by the Director in a format determined by the Director.

(b) Confidentiality.

(1) Except as otherwise required by law, the data and reports provided to the Department under this section must be kept confidential.

(2) If disclosure of the data and reports is required by law, the Department must provide the provider with reasonable prior notice of the disclosure.

(c) User privacy protections.

(1) A provider must establish a privacy policy approved by the Department that safeguards user information.

(2) The data and reports provided to the Department under this section may not include information that can reasonably be used to contact or distinguish a person, including IP addresses or device identifiers.

(d) Departmental reports.

(1) The Department must report the data provided under this section on the Department's website.

(2) The content and timing of the data reported under this subsection must be:

(i) determined by the Director; and

(ii) compliant with all applicable laws.