Law / United States / 
Rhode Island
Safe destruction of documents containing personal information
R.I. Gen. Laws secs. 6-52-1 to 6-52-4
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Retention
As of .
What it requires
- This binds a business: any sole proprietorship, partnership, corporation, association, limited liability company or other group, however organized and whether or not organized to operate at a profit, including the state, a state agency or a political subdivision that destroys records. It does not bind a financial institution subject to the Gramm Leach Bliley Act and a listed federal regulator or the Department of Business Regulation, a health insurer, non-profit hospital, medical service corporation or health care facility subject to the privacy and security standards of the Health Insurance Portability and Accountability Act of 1996, a consumer report agency in compliance with the Federal Credit Reporting Act, or a business that contracts with another business to destroy the information and has physical evidence of that contract.
- Take reasonable steps to destroy, or arrange for the destruction of, a customer's personal information within your custody and control that you no longer retain, by shredding, erasing, or otherwise destroying or modifying it to make it unreadable or indecipherable through any means.
- Destroy the information to ensure the security and confidentiality of customer personal information, to protect against any reasonably foreseeable threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Penalty structure
Rhode Island's attorney general may recover a civil penalty of five hundred dollars for each violation, not to exceed fifty thousand dollars, together with the aggrieved customer's actual damages; each record unreasonably disposed of is an individual violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 500
Who enforces it
Enforcement body
The Rhode Island attorney general may bring an action in the name of the state against a business in violation where the attorney general has reason to believe that a violation has occurred and that proceedings would be in the public interest; an aggrieved customer who incurs actual damages may also bring a civil action in superior court.
What this law does
A business must take reasonable steps to destroy, or arrange for the destruction of, a customer's personal information within its custody and control that is no longer to be retained by the business, by shredding, erasing, or otherwise destroying or modifying the personal information to make it unreadable or indecipherable through any means.
The destruction must serve to ensure the security and confidentiality of customer personal information, to protect against any reasonably foreseeable threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
A business is a sole proprietorship, partnership, corporation, association, limited liability company, or other group, however organized and whether or not organized to operate at a profit. The term includes any entity that destroys records, including the state, a state agency, or any political subdivision of the state.
A customer is an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business, or whose personal information has been provided to another business from that business.
Personal information is information that identifies, relates to, describes, or is capable of being associated with a particular individual, including his or her signature, social security number, physical characteristics or description, passport number, driver's license or state identification card number, insurance policy number, bank account number, credit card number, debit card number, any other financial information and confidential health care information.
A business that does not take the reasonable steps required is in violation of the chapter, and each record unreasonably disposed of constitutes an individual violation. A customer who incurs actual damages due to a violation may bring a civil action in superior court.
Where the attorney general has reason to believe that a violation has occurred and that proceedings would be in the public interest, the attorney general may sue the business in the name of the state, and the business may be liable for the aggrieved customer's actual damages and a civil penalty of $500 for each violation, not to exceed $50,000.
The chapter does not apply to a bank, credit union or financial institution, as defined under the federal Gramm Leach Bliley Law, that is subject to the regulation of a listed federal regulator or the Department of Business Regulation and to the privacy and security provisions of the Gramm Leach Bliley Act.
It also does not apply to a health insurer, non-profit hospital, or medical service corporation, or to a health care facility, that is subject to the privacy and security standards of the Health Insurance Portability and Accountability Act of 1996. It does not apply to a consumer report agency that is subject to, and in compliance with, the Federal Credit Reporting Act.
It does not apply to a business that enters into a contractual agreement with another business to complete the destruction of a customer's personal information and has physical evidence of that contractual agreement. Chapter 247 of the Public Laws of 2009 provides in section 2 that the act takes effect on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.