Law / United States / 
Rhode Island
Identity Theft Protection Act of 2015, risk-based information security program
R.I. Gen. Laws secs. 11-49.3-2, 11-49.3-5
In force.
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds a municipal agency, a state agency, or a person, defined broadly to include an individual, sole proprietorship, partnership, association, corporation, joint venture, business, legal entity, trust, estate, cooperative, or other commercial entity, that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident.
- Implement and maintain a risk-based information security program with reasonable security procedures and practices appropriate to your size and scope, the nature of the information, and the purpose for which it was collected, to protect the information from unauthorized access, use, modification, destruction, or disclosure and to preserve its confidentiality, integrity, and availability.NIST CSF 2.0GV.PO-01NIST CSF 2.0PR.DS-01
- Do not retain personal information longer than reasonably required to provide the requested services, meet the purpose for which it was collected, or comply with a written retention policy or a legal requirement; destroy it securely, for example by shredding, pulverization, incineration, or erasure, regardless of the medium it is stored in.NIST CSF 2.0ID.AM-08
- If you disclose personal information about a Rhode Island resident to a nonaffiliated third party, require by written contract that the third party implement and maintain reasonable security procedures and practices of the same kind, appropriate to its own size and scope, the nature of the information, and the purpose for which it was collected.NIST CSF 2.0GV.SC-05
- A reckless violation of this duty is a civil violation of up to $100 per record; a knowing and willful violation is up to $200 per record. Only the Attorney General may bring an action.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Penalty structure
R.I. Gen. Laws sec. 11-49.3-5 sets two tiers per record (mapped here to a person's compromised record): $100 for a reckless violation of the chapter (subsection (a)) and $200 for a knowing and willful violation (subsection (b)), the figure recorded here. The chapter states no aggregate cap.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Person
- Per violation amount
- 200
Who enforces it
Enforcement body
The Attorney General may bring an action in the name of the state against a business or person believed to have violated this chapter, where proceedings would be in the public interest (R.I. Gen. Laws sec. 11-49.3-5(c)).
What this law does
A municipal agency, a state agency, or a person who or that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident must implement and maintain a risk-based information security program with reasonable security procedures and practices appropriate to the size and scope of the organization, the nature of the information, and the purpose for which it was collected, to protect the personal information from unauthorized access, use, modification, destruction, or disclosure and to preserve its confidentiality, integrity, and availability.
Personal information may not be retained longer than reasonably required to provide the requested services, meet the purpose for which it was collected, or comply with a written retention policy or legal requirement. It must be destroyed securely, including by shredding, pulverization, incineration, or erasure, regardless of the medium.
A municipal agency, state agency, or person that discloses personal information about a Rhode Island resident to a nonaffiliated third party must require by written contract that the third party implement and maintain the same kind of reasonable security procedures and practices. Sec. 11-49.3-5 makes each reckless violation of the chapter a civil violation of up to $100 per record.
Each knowing and willful violation is a civil violation of up to $200 per record, brought solely by the Attorney General; no private right of action was found in the text read. Both sections originate in P.L. 2015, ch. 138 and P.L. 2015, ch. 148. Public Law 2015, chapter 138, enacted , provides that it takes effect one year following the date of passage. No source stating the resulting day has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .