(b) Making an application programming interface or other technical capability does not require providers to do so in a manner that would increase the risk of cyberattacks or to disclose proprietary data. Providers bear the burden of minimizing these risks when making an application programming interface or other technical capability available for testing.
(2) Nothing in this section requires a state or local government agency to collect or provide data to a facial recognition service provider to satisfy the requirements in subsection (1) of this section.