Patron Access

(1) Patrons shall be provided with a method to make the requests in 205 CMR 257.04(1)(a) through (e). The request must be clearlyand conspicuouslyavailable to the patron online through the Sports Wagering Operator's Sports Wagering Platform. A patron shall not be required to confirm their request more than once, and no intervening pages (other than those needed to confirm withdrawal of consent) or offers will be presented to the patron before such confirmation is presented to the patron. (a) A description as to how their Confidential Information or Personally Identifiable Information is being used, including confirmation that such Confidential Information or Personally Identifiable Information is being used in accordance with 205 CMR 257.00; (b) Access to a copyof their Confidential Information or PersonallyIdentifiable Information maintained by the Operator or a Vendor, Subcontractor, or Registrant of the Operator; (c) Updates to their Confidential Information or Personally Identifiable Information; (d) The imposition of additional restriction on the use of their Confidential Information or Personally Identifiable Information for particular uses; and (e) That their Confidential Information or Personally Identifiable Information be erased or anonymized so it is no longer traceable to the patron when it is no longer required to be retained by applicable law or Court order. The Sports Wagering Operator may choose to offer either erasure, anonymization, or both as an option pursuant to 205 CMR 257.04. (2) A Sports Wagering Operator shall provide a written response to a request submitted pursuant to 205 CMR 257.04(1) that either grants or denies the request. (a) If the Sports Wagering Operator grants the patron's request to access a copy of their Personally Identifiable Information, the Sports Wagering Operator shall provide the patron their Confidential Information or Personally Identifiable Information in a structured, commonly used and machine readable format. (b) If the Sports Wagering Operator denies the request, the Sports Wagering Operator shall provide in its written response specific reason(s) supporting the denial and directions on how the patron may file a complaint regarding the denial with the Commission. (3) A Sports Wagering Operator shall grant the patron's request to impose a restriction or erase or anonymize their Confidential Information or Personally Identifiable Information if it is no longer necessary to retain the patron's Confidential Information or Personally Identifiable Information (or to retain the patron's Confidential Information or Personally Identifiable Information without the requested restriction) to operate a Sports Wagering Area, Sports Wagering Facility or Sports Wagering Platform, or for any other purpose authorized pursuant to 205 CMR 257.01; and (a) The patron withdraws their consent to the Sports Wagering Operator's retention of their Confidential Information or Personally Identifiable Information; (b) There is no overriding legal interest to retaining the patron's Confidential Information or Personally Identifiable Information; (c) The patron's Confidential Information or Personally Identifiable Information was used in violation of 205 CMR 257.00; or (d) Restriction, anonymization or erasure is necessary to comply with an order from the Commission or a court. (4) If the Sports Wagering Operator grants the patron's request to erase or anonymize their Confidential Information or Personally Identifiable Information, the Sports Wagering Operator shall erase or anonymize the patron's Personally Identifiable Information or Confidential from all storage media it is currently using to operate a Sports Wagering Area, Sports Wagering Facilityor Sports Wagering Platform, including HDD, SDD, flash, mobile, cloud, virtual, RAID, LUN, hard disks, solid state memory, and other devices. The Sports Wagering Operator shall also request commercially reasonable confirmation of deletion or anonymization from any Vendor, Registrant, or Subcontractor who received the patron's Confidential Information or Personally Identifiable Information from the Sports Wagering Operator. Notwithstanding, the foregoing, the Sports Wagering Operator shall not erase or anonymize a patron's Confidential Information or Personally Identifiable Information on backup or storage media used to ensure the integrityof the Sports Wagering Area, Sports Wagering Facilityor Sports Wagering Platform from technology failure or to comply with its data retention schedule or to comply with M.G.L. c. 23N, 205 CMR, or any other applicable law, regulation, court order, subpoena or civil investigative demand of a governmental entity. (5) An Operator, or a Vendor, Registrant or Subcontractor of an Operator shall not require a Patron to enter into an agreement waiving any of the Patron's rights under 205 CMR 257.04.