Law / United States / 
Rhode Island
Licensed nonbank financial institutions, notification of a security event
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- Applies to a licensee under chapter 19-14 of the Rhode Island General Laws, which you declare by stating that you provide financial services: a person licensed to make or fund loans, broker loans, provide currency transmission, cash checks, provide debt-management services, perform the duties of a mortgage-loan originator or service a loan as a third-party loan servicer. A regulated institution as defined in section 19-1-1, its subsidiary, and a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations are outside the section.
- Notify the director or the director's designee as promptly as possible, and in no event later than three business days from a determination that a security event has occurred, when you must give notice of the event to a governmental body, self-regulatory agency or other supervisory body under state or federal law, or the event has a reasonable likelihood of materially harming any consumer residing in Rhode Island or any material part of your normal operations.
- Give the notice in electronic form as the director directs, and keep updating and supplementing it with later notifications about the security event.
- Include in the notice your name and contact information, the types of information involved, the date or date range of the event if it is possible to determine, the total number of Rhode Island consumers affected or potentially affected (a best estimate in the initial report, updated with each later report), a general description of how the information was exposed, lost, stolen or breached and the roles of any third-party service providers, the efforts under way to remediate the situation, whether a law enforcement official has given you a written determination that notifying the public would impede a criminal investigation or damage national security, and a contact person familiar with the event.
- Comply with chapter 49.3 of title 11 as applicable, and give the director a copy of the notice sent to consumers when you are required to notify the director.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 19-14-26(b) lets the department assess a civil penalty of not more than $1,000 for each violation, or imprisonment not exceeding one year, or both, for a material violation of the title, and provides that the attorney general prosecutes all criminal activities under the chapter.
Penalty structure
Section 19-14-26(b) sets a civil penalty of not more than $1,000 for each violation, or in the case of identifiable measured transactions per transaction, and provides that each violation constitutes a separate offense.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 1,000
Who enforces it
Enforcement body
The department, which on proof of a material violation by a licensee may suspend or revoke its license, order a person to cease and desist from activity for which a license is required, ask a court to appoint a receiver or to issue injunctive relief, recover on the licensee's bond or impose conditions on its business (section 19-14-26(d)).
What this law does
A licensee must notify the director or the director's designee as promptly as possible, and in no event later than three business days from a determination that a security event has occurred, when the event must be reported to a governmental or supervisory body under state or federal law or has a reasonable likelihood of materially harming a Rhode Island consumer or a material part of the licensee's normal operations. A licensee is any person licensed under the chapter.
A security event is an event resulting in unauthorized access to, or disruption or misuse of, an information system or information stored on such an information system, or customer information held in physical form. The licensee must provide the information in electronic form as the director directs, and has a continuing obligation to update and supplement its initial and subsequent notifications.
The notice must give the licensee's name and contact information, the types of information involved, the date or date range of the event where it can be determined, the total number of Rhode Island consumers affected or potentially affected, a general description of how the information was exposed, and the efforts under way to remediate the situation.
A licensee must comply with the Identity Theft Protection Act of 2015 as applicable and give the director a copy of the notice sent to consumers when it is required to notify the director. The section does not apply to a regulated institution as defined in section 19-1-1, its subsidiary, or a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations.
If a licensee materially violates an applicable provision of the title or a regulation under it, the department may assess a civil penalty of not more than $1,000 for each violation, or imprisonment not exceeding one year, or both. Section 19-14-36 was added by Public Law 2025, chapters 424 and 425, effective .
When LexLint raises it
When your app profile says your app provides financial services.