(a) The agency shall ensure that data collected pursuant to §115.187 are securely retained in accordance with agency record retention policies and the agency protocol regarding investigation of allegations.

(b) The agency shall make all aggregated sexual abuse data from holding facilities under its direct control and from any private agencies with which it contracts available to the public at least annually on its Web site consistent with agency information disclosure policies and processes.

(c) Before making aggregated sexual abuse data publicly available, the agency shall remove all personal identifiers.

(d) The agency shall maintain sexual abuse data collected pursuant to §115.187 for at least 10 years after the date of the initial collection unless Federal, State, or local law requires otherwise.