Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

Data Breach Requirements: R.I. Gen. Laws § 11-49.3-1 et seq.

core/heading

The numbering and internal citations herein are derived from the applicable state statute.

core/paragraph

The term “personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements, when the name and the data elements are not encrypted or are in hard copy, paper format: (i) Social Security number; (ii) Driver’s license number, Rhode Island identification card number, or tribal identification number; (iii) Account number, credit, or debit card number, in combination with any required security code, access code, password, or personal identification number, that would permit access to an individual’s financial account; (iv) Medical or health insurance information; or (v) Email address with any required security code, access code, or password that would permit access to an individual’s personal, medical, insurance, or financial account.

core/separator

The term “breach of the security of the system” means unauthorized access or acquisition of unencrypted, computerized data information that compromises the security, confidentiality, or integrity of personal information maintained by the person.

The good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system; provided that the personal information is not used or subject to further unauthorized disclosure.

A covered entity shall provide notification of any disclosure of personal information, or any breach of the security of the system, that poses a significant risk of identity theft to any resident of Rhode Island whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person or entity.

The breach notification shall be made in the most expedient time possible, but no later than 45 calendar days after confirmation of the breach and the ability to ascertain the information required to fulfill the notice requirements, and shall be consistent with the legitimate needs of law enforcement.

The breach notification may be delayed if a federal, state, or local law enforcement agency determines that the notification will impede a criminal investigation. The federal, state, or local law enforcement agency must notify the person of the request to delay notification without unreasonable delay. If notice is delayed due to such determination, then, as soon as the federal, state, or local law enforcement agency determines and informs the person that notification no longer poses a risk of impeding an investigation, notice shall be provided as soon as practicable. The person shall cooperate with federal, state, or local law enforcement in its investigation of any breach of security or unauthorized acquisition or use, which shall include the sharing of information relevant to the incident; provided however, that such disclosure shall not require the disclosure of confidential business information or trade secrets.

(d) The notification to individuals must include the following information to the extent known: (1) A general and brief description of the incident, including how the security breach occurred and the number of affected individuals; (2) The type of information that was subject to the breach; (3) Date of breach, estimated date of breach, or the date range within which the breach occurred; (4) Date that the breach was discovered; (5) A clear and concise description of any remediation services offered to affected individuals including toll free numbers and websites to contact: (i) The credit reporting agencies; (ii) Remediation service providers; (iii) The attorney general; and (6) A clear and concise description of the consumer’s ability to file or obtain a police report; how a consumer requests a security freeze and the necessary information to be provided when requesting the security freeze; and that fees may be required to be paid to the consumer reporting agencies.

A breach notice may be provided by one of the following methods: (i) Written notice; (ii) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act); or (iii) Substitute notice, if the person demonstrates that the cost of providing notice would exceed $25,000, or that the affected class of subject persons to be notified exceeds 50,000, or the person does not have sufficient contact information.

Substitute notice shall consist of all of the following: (A) Email notice when the person has an email address for the subject persons; (B) Conspicuous posting of the notice on the municipal agency, state agency, or person’s website page, if the person maintains one; and (C) Notification to major statewide media.

In the event that more than 500 Rhode Island residents are to be notified, the covered entity shall notify the attorney general as to the timing, content, and distribution of the notices and the approximate number of affected individuals. Notification to the attorney general shall be made without delaying notice to affected Rhode Island residents. (See timeline above: the most expedient time possible 45 days.)

In the event that more than 500 Rhode Island residents are to be notified, the covered entity shall notify the major credit reporting agencies as to the timing, content, and distribution of the notices and the approximate number of affected individuals. Notification to the major credit reporting agencies shall be made without delaying notice to affected Rhode Island residents. (See timeline above: the most expedient time possible 45 days.)

A covered entity shall be deemed to be in compliance with the security breach notification requirements of § 11-49.3-4 if the person maintains a security breach procedure pursuant to the rules, regulations, procedures, or guidelines established by the primary or functional regulator, as defined in 15 U.S.C. § 6809(2), and notifies subject persons in accordance with the policies or the rules, regulations, procedures, or guidelines established by the primary or functional regulator in the event of a breach of security of the system.

A financial institution, trust company, credit union, or its affiliates that is subject to and examined for, and found in compliance with, the Federal Interagency Guidelines on Response Programs for Unauthorized Access to Customer Information and Customer Notice shall be deemed in compliance with this chapter.

A provider of health care, health care service plan, health insurer, or a covered entity governed by the medical privacy and security rules issued pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) shall be deemed in compliance with this chapter.

N/A (See State Specific Information Security Requirements and third-party contracting obligations)

A “remediation service provider” means any person who, in the usual course of business, provides services pertaining to a consumer credit report including, but not limited to, credit report monitoring and alerts, that are intended to mitigate the potential for identity theft.

Notification to the attorney general and the major credit reporting agencies by a covered entity shall be made without delaying notice to affected Rhode Island residents.

Data Disposal and Security: R.I. Gen. Laws §§ 11-49.3-2 and 11-49.3-3.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

The term “personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements, when the name and the data elements are not encrypted or are in hard copy, paper format: (i) Social Security number; (ii) Driver’s license number, Rhode Island identification card number, or tribal identification number; (iii) Account, credit, or debit card number, in combination with any required security code, access code, password, or personal identification number, that would permit access to an individual’s financial account; (iv) Medical or health insurance information; or (v) Email address with any required security code, access code, or password that would permit access to an individual’s personal, medical, insurance, or financial account.

A person who or that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident shall implement and maintain a risk-based information security program that contains reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected in order to protect the personal information from unauthorized access, use, modification, destruction, or disclosure and to preserve the confidentiality, integrity, and availability of such information.

A person shall not retain personal information for a period longer than is reasonably required to provide the services requested; to meet the purpose for which it was collected; or in accordance with a written retention policy or as may be required by law.

A person who discloses personal information about a Rhode Island resident to a nonaffiliated third party shall require by written contract that the third party implement and maintain reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected in order to protect the personal information from unauthorized access, use, modification, destruction, or disclosure.

See Security Requirements (written retention policy).

A person shall destroy all personal information, regardless of the medium that such information is in, in a secure manner, including, but not limited to, shredding, pulverization, incineration, or erasure.