A sports wagering licensee shall have security mechanisms that ensure the confidentiality of personally identifiable information except as otherwise required by law or authorized by this subtitle.