(a) The agency shall ensure that data collected pursuant to §115.387 are securely retained.

(b) The agency shall make all aggregated sexual abuse data, from facilities under its direct control and private facilities with which it contracts, readily available to the public at least annually through its Web site or, if it does not have one, through other means.

(c) Before making aggregated sexual abuse data publicly available, the agency shall remove all personal identifiers.

(d) The agency shall maintain sexual abuse data collected pursuant to §115.387 for at least 10 years after the date of its initial collection unless Federal, State, or local law requires otherwise.