Original Section(s)

11 VAC 5-80-100 Compliance with Privacy and Data Security Requirements

GLI Recommendations

11 VAC 5-80-100.A

1. A permit holder shall comply with all applicable state and federal requirements for data security.

11 VAC 5-70-240.S

2. A permit holder shall respect user privacy and comply with all applicable legal privacy requirements, including those governing consent.

GLI recommends 11 VAC 5-70-240.S be added after 11 VAC 5-80-100.A

11 VAC 5-80-100.B

3. A permit holder shall not share information that could be used to personally identify a sports bettor with any third party other than the Department, law enforcement with a warrant or subpoena or a credit-reporting agency. Information that could be used to personally identify a sports bettor includes gaming habits.

4. A permit holder shall protect the material non-public or confidential information of sports bettors using its platform. No employee or agent of the permit holder shall divulge any material non-public or confidential information related to the placing of any wager or any material non-public or confidential information related to the operation of the sports betting platform and its players except:

1. 1. To the player as required by these rules;
   2. To the Department;
   3. To the permit holder and its affiliates;
   4. To third parties when the information is made publicly available; and
   5. As otherwise required by state or federal law.

GLI recommends addition after 11 VAC 5-80-100.A based on what has been seen in other markets.