(a) ORR must ensure that data collected pursuant to §§411.101 and 411.102 is securely retained in accordance with Federal and State laws and ORR record retention policies and procedures.

(b) ORR must make all aggregated sexual abuse and sexual harassment data from ORR care provider facilities with which it provides a grant to or contracts with, excluding secure care providers and traditional foster care providers, available to the public at least annually on its Web site consistent with existing ORR information disclosure policies and procedures.

(c) Before making any aggregated sexual abuse and sexual harassment data publicly available, ORR must remove all personally identifiable information.

(d) ORR must maintain sexual abuse and sexual harassment data for at least 10 years after the date of its initial collection unless Federal, State, or local law requires for the disposal of official information in less than 10 years.