2014 -- S 2640

========

LC004480

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2014

____________

A N   A C T

RELATING TO CRIMINAL OFFENSES - IDENTITY THEFT PROTECTION

     Introduced By: Senator Michael J.McCaffrey

     Date Introduced: March 04, 2014

     Referred To: Senate Judiciary

     (Attorney General)

It is enacted by the General Assembly as follows:

     SECTION 1. Sections 11-49.2-3 and 11-49.2-5 of the General Laws in Chapter 11-49.2

entitled "Identity Theft Protection" are hereby amended to read as follows:

     11-49.2-3. Notification of breach. -- (a) Any state agency or person that owns, maintains

or licenses computerized data that includes personal information, shall disclose any breach of the

security of the system which poses a significant risk of identity theft following discovery or

notification of the breach in the security of the data to any resident of Rhode Island whose

unencrypted personal information was, or is reasonably believed to have been, acquired by an

unauthorized person or a person without authority, to acquire said information. The disclosure

shall be made in the most expedient time possible and without unreasonable delay, consistent

with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures

necessary to determine the scope of the breach and restore the reasonable integrity of the data

system. The disclosure shall include, but not be limited to:

     (1) The toll-free numbers and addresses for the consumer reporting agencies;

     (2) The toll-free number, address, and website for the Federal Trade Commission;

     (3) A statement that an individual can obtain information from these sources regarding

fraud alerts and security freezes; and

     (4) A statement that warns against possible imposters who attempt to fraudulently notify

individuals of security breaches in an attempt to obtain personal identity information.

      (b) Any state agency or person that maintains computerized unencripted data that

includes personal information that the state agency or person does not own shall notify the owner

or licensee of the information of any breach of the security of the data which poses a significant

risk of identity theft immediately, following discovery, if the personal information was, or is

reasonably believed to have been, acquired by an unauthorized person.

      (c) The notification required by this section may be delayed if a law enforcement agency

determines that the notification will impede a criminal investigation. The notification required by

this section shall be made after the law enforcement agency determines that it will not

compromise the investigation.

      (d) The notification must be prompt and reasonable following the determination of the

breach unless otherwise provided in this section. Any state agency or person required to make

notification under this section and who fails to do so promptly following the determination of a

breach or receipt of notice from law enforcement as provided for is subsection (c) is liable for a

fine as set forth in section 11-49.2-6.

     (e) Any state agency or person required to disclose a breach as provided in subsection (a)

of this section shall provide one year of credit monitoring to any resident of Rhode Island, at no

cost to the resident, whose personal information was, or is reasonably believed to have been,

acquired by an unauthorized person, or a person without authority to acquire said information.

     11-49.2-5. Definitions. -- The following definitions apply to this section:

      (a) "Person" shall include any individual, partnership association, corporation or joint

venture.

      (b) For purposes for this section, "breach of the security of the system" means

unauthorized acquisition of unencrypted computerized data that compromises the security,

confidentiality, or integrity of personal information maintained by the state agency or person.

Good faith acquisition of personal information by an employee or agent of the agency for the

purposes of the agency is not a breach of the security of the system; provided, that the personal

information is not used or subject to further unauthorized disclosure.

      (c) For purposes of this section, "personal information" means an individual's first name

or first initial and last name in combination with any one or more of the following data elements,

when either the name or the data elements are not encrypted:

      (1) Social security number;

      (2) Driver's license number or Rhode Island Identification Card number;

      (3) Account number, credit or debit card number, in combination with or without any

required security code, access code, or password, or personal identification number that would

permit access to an individual's financial account.

LC004480 - Page 2 of 3

      (d) For purposes of this section, "notice" may be provided by one of the following

methods:

      (1) Written notice;

      (2) Electronic notice, if the notice provided is consistent with the provisions regarding

electronic records and signatures set for the in Section 7001 of Title 15 of the United States Code;

      (3) Substitute notice, if the state agency or person demonstrates that the cost of providing

notice would exceed twenty-five thousand dollars ($25,000), or that the affected class of subject

persons to be notified exceeds fifty thousand (50,000), or the state agency or person does not have

sufficient contact information. Substitute notice shall consist of all of the following:

      (A) E-mail notice when the state agency or person has an e-mail address for the subject

persons;

      (B) Conspicuous posting of the notice on the state agency's or person's website page, if

the state agency or person maintains one;

      (C) Notification to major statewide media.

     SECTION 2. This act shall take effect upon passage.

========

LC004480

========

LC004480 - Page 3 of 3

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO CRIMINAL OFFENSES - IDENTITY THEFT PROTECTION

***

     This act would impose additional requirements upon a notice of breach and disclosure to

affected Rhode Island residents of the contact information for consumer reporting agencies and

the Federal Trade Commission; a statement that an individual can obtain information from these

sources regarding fraud alerts and security freezes; and a statement that warns against possible

imposters who attempt to fraudulently notify individuals of security breaches in an attempt to

obtain personal identity information. The act would also provide that the breached entity provide

the affected resident with one year of credit monitoring services at no cost to the resident.

     This act would take effect upon passage.

========

LC004480

========

LC004480 - Page 4 of 3