Rhode Island
Privacy Laws
Overview
BREACH NOTIFICATION – Mandated Timeframe
Within 45 days
FINES & PENALTIES – Violations
Up to $200 per record
Regulation Levels
-
Breach Reporting
-
Consumer Notification
-
Vendor Management
-
Vendor Contract Required
PRIVACY AND SECURITY LAWS
Laws related to personal information and privacy and security.
Breach Reporting
Required
Vendor Obligations
Required
Consumer Notification
Required
Vendor Contracts
Required
Vendor Notification
Not Required
Privacy Program
Required
QUICK FACTS
Rhode Island Privacy Law Information
Organizations must contract with Vendors to whom the Organization discloses personal information. Organizations and Vendors are required to have in place security procedures and practices to protect personal information. Organizations and Vendors in the business of destroying records must have measures in place for the destruction of records containing personal information so the records are unreadable or undecipherable. Vendors must ensure the protection of personal information during disposal.
Breach reporting to the Attorney General and the major credit reporting agencies is required if more than 500 Rhode Island residents are to be notified of a breach. Specific notification details are required.
If a breach affects residents of other jurisdictions, those individuals must be notified based on the breach notification laws of the jurisdiction where they reside.
If a Vendor is breached, they should notify the Organization. The Organization will be responsible to complete the reporting and consumer notification.
In addition to penalties of up to $200 per record for violations involving breach notification and reporting, the Attorney General may bring an action in the name of the state, against the business or person in violation. Violations of the Safe Destruction of Documents Containing Personal Information law could have civil penalties of $500 per violation, up to $50,000.
Rhode Island Statutes and Laws
Safe destruction of documents containing personal information
Identity theft protection act
DISCLAIMER
The information provided is not legal guidance or recommendations and are for informational purposes only.