After receiving a written request under Section 92.002 or 92.003, a person, including a data broker, shall:
(1) not later than the 10th business day after the date the request is received:
(A) remove from the Internet website the covered information identified in the request;
(B) ensure the information is not made available on any other publicly accessible Internet website or subsidiary website the person controls; and
(C) identify any other instances of the information that should be removed; and
(2) assist the requestor in locating the covered information posted on any publicly accessible Internet website or subsidiary website controlled by the person.