(b) Such minimum standards shall include internal controls for:

1. (1) As specified under this part, administrative, accounting, and audit procedures for the purpose of determining the licensee’s liability for taxes and fees under The Arkansas Casino Gaming Amendment of 2018, Arkansas Constitution, Amendment 100, and for the purpose of exercising effective control over the licensee’s internal affairs;
2. (2) Maintenance of all aspects of security of the interactive gaming system;
3. (3) Registering authorized players to engage in interactive gaming;

4. (4)

   1. (A) Identification and verification of authorized players to prevent those who are not authorized players from engaging in interactive gaming.
   2. (B) The procedures and controls must incorporate robust and redundant identification methods and measures in order to manage and mitigate the risks of non-face-to-face transactions inherent in interactive gaming;
5. (5) Protecting and ensuring confidentiality of authorized players’ interactive gaming accounts;
6. (6) Reasonably ensuring that interactive gaming is engaged in between human individuals only;
7. (7) Reasonably ensuring that interactive gaming is conducted fairly and honestly, including the prevention of collusion between authorized players;
8. (8) Testing the integrity of the interactive gaming system on an ongoing basis;

9. (9)

   1. (A) Promoting responsible interactive gaming and preventing individuals who have self-excluded from engaging in interactive gaming.
   2. (B) Such internal controls shall include provisions for substantial compliance with this part; and

10. (10) Protecting an authorized player’s personally identifiable information, including, but not limited to:

    1. (A) The designation and identification of one (1) or more senior company officials having primary responsibility for the design, implementation, and ongoing evaluation of such procedures and controls;
    2. (B) The procedures to be used to determine the nature and scope of all personally identifiable information collected, the locations in which such information is stored, and the devices or media on which such information may be recorded for purposes of storage or transfer;
    3. (C) The policies to be utilized to protect personally identifiable information from unauthorized access by employees, business partners, and persons unaffiliated with the company;
    4. (D) Notification to authorized players of privacy policies;
    5. (E) Procedures to be used in the event the operator determines that a breach of data security has occurred, including required notification to the on-site Department of Finance and Administration representatives; and
    6. (F) Provision for compliance with all local, state, and federal laws concerning privacy and security of personally identifiable information.

(c) “Personally identifiable information” means any information about an individual maintained by an operator including:

1. (1) Any information that can be used to distinguish or trace an individual’s identity, such as:

   1. (A) Name;
   2. (B) Social Security number;
   3. (C) Date and place of birth;
   4. (D) Mother’s maiden name; or
   5. (E) Biometric records; and
2. (2) Any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

(d)

1. (1) The commission may determine additional areas that require internal controls having minimum standards.
2. (2) The commission shall adopt and publish any such additional internal controls and the minimum standards pursuant to the provisions of the Arkansas Administrative Procedure Act, Arkansas Code § 25-15-201 et seq., and this part.