Law / United States / 
Rhode Island
Rhode Island Data Transparency and Privacy Protection Act, de-identified data
R.I. Gen. Laws secs. 6-48.1-2(13), 6-48.1-7(j), (n)
In force since .
A de-identification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- If you hold de-identified data, take reasonable measures to ensure that it cannot be associated with an individual (R.I. Gen. Laws sec. 6-48.1-7(j)(1)).
- Publicly commit to maintaining and using de-identified data without attempting to re-identify it (R.I. Gen. Laws sec. 6-48.1-7(j)(2)).
- Contractually obligate every recipient of de-identified data to comply with all provisions of the chapter, monitor their compliance with those commitments and take appropriate steps to address any breach of them (R.I. Gen. Laws sec. 6-48.1-7(j)(3) and (n)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 6-48.1-7(j) and (n) state the conditions a controller must meet to hold and pass on de-identified data. They state no log or record duty.
- Kind
- None
- As of
What this law does
Section 6-48.1-2(13) defines de-identified data as data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual. Section 6-48.1-7(j)(1) requires a controller in possession of de-identified data to take reasonable measures to ensure that the data cannot be associated with an individual.
Section 6-48.1-7(j)(2) requires a controller in possession of de-identified data to publicly commit to maintaining and using the data without attempting to re-identify it. Section 6-48.1-7(j)(3) requires a controller in possession of de-identified data to contractually obligate any recipients of the data to comply with all provisions of the chapter.
Section 6-48.1-7(n) requires a controller that discloses pseudonymous data or de-identified data to exercise reasonable oversight to monitor compliance with any contractual commitments to which the data is subject and to take appropriate steps to address any breaches of those commitments. Section 6-48.1-7(k)(1) provides that the chapter does not require a controller or processor to re-identify de-identified data or pseudonymous data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .