What does Rhode Island's data breach law ask a business to do?

Who does this law apply to?

The law applies to any person, state agency or municipal agency that stores, owns, collects, processes, maintains, uses or licenses data with personal information. Notice is due when a disclosure or breach poses a significant risk of identity theft to a Rhode Island resident.

Any municipal agency, state agency, or person who or that stores, owns, collects, processes, maintains, acquires, uses, or licenses data that includes personal information shall provide notification as set forth in this section of any disclosure of personal information, or any breach of the security of the system, that poses a significant risk of identity theft to any resident of Rhode Island whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person or entity.

What counts as personal information?

Personal information is a first name or first initial and last name together with another listed item, when the name and the item are not encrypted or are on paper. The list in the text includes a social security number, a driver's licence, state or tribal ID number, a financial account or card number with the code that opens it, and medical or health insurance information.

An email address together with the code or password that opens a personal, medical, insurance or financial account also counts.

"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when the name and the data elements are not encrypted or are in hard copy, paper format:

E-mail address with any required security code, access code, or password that would permit access to an individual's personal, medical, insurance, or financial account.

How fast must people be told?

A person that is not an agency must notify in the most expedient time possible and no later than 45 calendar days after confirming the breach and being able to gather the facts the notice must contain. State and municipal agencies have no later than 30 calendar days.

For persons subject to subsection (a)(1), which is not a state or municipal agency, no later than forty-five (45) calendar days after confirmation of the breach and the ability to ascertain the information required to fulfill the notice requirements contained in subsection (d), and shall be consistent with the legitimate needs of law enforcement as provided in subsection (b).

For state and municipal agencies, no later than thirty (30) calendar days after confirmation of the breach and the ability to ascertain the information required to fulfill the notice requirements contained in subsection (d), and shall be consistent with the legitimate needs of law enforcement as provided in subsection (b).

Who else must be told?

When more than five hundred Rhode Island residents are to be notified, the attorney general and the major credit reporting agencies must be told the timing, content and distribution of the notices and the approximate number of people affected.

In the event that more than five hundred (500) Rhode Island residents are to be notified, the person shall notify the attorney general and the major credit reporting agencies as to the timing, content, and distribution of the notices and the approximate number of affected individuals.

Is encrypted information treated differently?

Yes. Personal information counts only when it is not encrypted or is on paper. The text defines encryption as a 128 bit or stronger algorithmic process, and data acquired together with the key, code or password that opens it is not treated as encrypted.

"Encrypted" means the transformation of data through the use of a one hundred twenty-eight (128) bit or higher algorithmic process into a form in which there is a low probability of assigning meaning without use of a confidential process or key. Data shall not be considered to be encrypted if it is acquired in combination with any key, security code, or password that would permit access to the encrypted data.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.