Law / United States / 
Rhode Island
Identity Theft Protection Act of 2015, notification of breach
R.I. Gen. Laws secs. 11-49.3-4, 11-49.3-5
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Notify affected Rhode Island residents of a breach posing a significant risk of identity theft within 45 days of confirming the breach, or within 30 days if you are a state or municipal agency.
- Notify the Attorney General and consumer reporting agencies once more than 500 Rhode Island residents are affected, without delaying notice to residents.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What makes a breach one that 'poses a significant risk of identity theft' under R.I. Gen. Laws ยง 11-49.3-4(a)(1) when unencrypted personal information was acquired and no misuse has been seen?
What it makes you log
Logging duty
Section 11-49.3-4 requires notice to affected Rhode Island residents within 45 calendar days (30 for state and municipal agencies) of confirming a breach, a notice to the attorney general and the credit reporting agencies on timing, content, distribution and the approximate number affected where more than 500 residents are notified, and a set list of content for the individual notice. These are notifications, not a record the entity keeps, and the section names no record of breaches or of a decision not to notify, no period and no regulator access. The penalty section (11-49.3-5) is cited by the row but sits on a different page than the row's address and was not part of the read. The hook is the resident of Rhode Island whose personal information was acquired.
- Kind
- None
- As of
What this law does
Any municipal agency, state agency, or person that stores, owns, collects, processes, maintains, acquires, uses, or licenses data including personal information must notify affected Rhode Island residents of a breach that poses a significant risk of identity theft, within 30 days of confirmation for a state or municipal agency and within 45 days for any other person, with Attorney General and consumer-reporting-agency notice required once more than 500 residents are affected.
Reckless violations carry a penalty of up to $100 per record and knowing and willful violations up to $200 per record, brought by the Attorney General; no private right of action was found in the text read. Sections 11-49.3-4 and 11-49.3-5 both originate in P.L. 2015, ch. 138 and ch. 148; sec. 11-49.3-4's notice duty was last amended by P.L. 2023, ch. 375, sec. 1, effective , while sec. 11-49.3-5's penalty provisions carry no amendment since 2015. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .