(a) The agency shall ensure that data collected pursuant to § 115.187 are securely retained.

(b) The agency shall make all aggregated sexual abuse data, from lockups under its direct control and any private agencies with which it contracts, readily available to the public at least annually through its Web site or, if it does not have one, through other means.

(c) Before making aggregated sexual abuse data publicly available, the agency shall remove all personal identifiers.

(d) The agency shall maintain sexual abuse data collected pursuant to § 115.187 for at least 10 years after the date of the initial collection unless Federal, State, or local law requires otherwise.