2022 -- H 7565

========

LC004754

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2022

____________

A N   A C T

RELATING TO CRIMINAL OFFENSES -- IDENTITY THEFT PROTECTION ACT OF 2015

     Introduced By: Representatives Phillips, McEntee, Ajello, Serpa, Corvese, Edwards,
McGaw, Batista, Alzate, and Casimiro

     Date Introduced: February 18, 2022

     Referred To: House Judiciary

     It is enacted by the General Assembly as follows:

     SECTION 1. Section 11-49.3-4 of the General Laws in Chapter 11-49.3 entitled "Identity

Theft Protection Act of 2015" is hereby amended to read as follows:

     11-49.3-4. Notification of breach.

     (a)(1) Any municipal agency, state agency, or any other person or entity that stores, owns,

collects, processes, maintains, acquires, uses, or licenses data, or any agency, entity, or person that

maintains or stores, but does not own or license, data that includes personal information shall

provide notification as set forth in this section of any disclosure of personal information, or any

breach of the security of the system, that poses a significant risk of identity theft to any resident of

Rhode Island whose personal information was, or is reasonably believed to have been, acquired by

an unauthorized person or entity. In addition to providing notice as required in this section, the

municipal agency, state agency, or any other person or entity shall cooperate with the owner or

licensor of such information. Such cooperation shall include, but not be limited to, informing the

owner or licensor of the breach of security, the date and approximate time of the breach, and any

steps taken related to minimizing the breach upon discovery. Cooperation shall not include the

requirement that any agency, public or private entity or other person disclose confidential business

information or trade secrets.

     (2) The notification shall be made in the most expedient time possible and without

unreasonable delay, but no later than forty-five (45) calendar days after the municipal agency, state

agency or other person or entity knows or has reason to know of the breach, knows or has reason

to know that any personal information has been acquired or used by an unauthorized person or

entity, and/or upon confirmation of the breach and the ability to ascertain the information required

to fulfill the notice requirements contained in subsection (d) of this section, and shall be consistent

with the legitimate needs of law enforcement as provided in subsection (c) of this section. In the

event that more than five hundred (500) Rhode Island residents are to be notified, the The municipal

agency, state agency, or person shall notify the attorney general, the department of business

regulation, and the major credit reporting agencies as to the timing, content, and distribution of the

notices and the approximate number of affected individuals. Notification to the attorney general,

the department of business regulation, and the major credit reporting agencies shall be made

without delaying notice to affected Rhode Island residents. Notice to the attorney general, the

department of business regulation, and major credit reporting agencies shall include the nature of

the breach of security or unauthorized acquisition, the number of people affected by the incident,

the name and address of the agency, person or entity that experienced the breach of security, the

name and address of the agency, person or entity reporting the breach of security, the person

responsible for committing the breach, if known and the type of personal information compromised,

including, but not limited to, social security numbers, bank account numbers, credit/debit card

numbers or any other information that may have the potential to impact any person’s privacy or

financial security.

     (b) The notification required by this section may be delayed if a federal, state, or local law

enforcement agency determines that the notification will impede a criminal investigation. The

federal, state, or local law enforcement agency must notify the municipal agency, state agency, or

person of the request to delay notification without unreasonable delay. If notice is delayed due to

such determination, then, as soon as the federal, state, or municipal law enforcement agency

determines and informs the municipal agency, state agency, or person that notification no longer

poses a risk of impeding an investigation, notice shall be provided as soon as practicable pursuant

to subsection (a)(2). The municipal agency, state agency, or person shall cooperate with federal,

state, or municipal law enforcement in its investigation of any breach of security or unauthorized

acquisition or use, which shall include the sharing of information relevant to the incident; provided

however, that such disclosure shall not require the disclosure of confidential business information

or trade secrets.

     (c) Any municipal agency, state agency, or person required to make notification under this

section and fails to do so is liable for a violation as set forth in § 11-49.3-5.

     (d) The notification to individuals must include the following information to the extent

known:

LC004754 - Page 2 of 4

     (1) A general and brief description of the incident, including how the security breach

occurred and the number of affected individuals;

     (2) The type of information that was subject to the breach;

     (3) Date of breach, estimated date of breach, or the date range within which the breach

occurred;

     (4) Date that the breach was discovered;

     (5) A clear and concise description of any remediation services offered to affected

individuals including toll free numbers and websites to contact: (i) The credit reporting agencies;

(ii) Remediation service providers; (iii) The attorney general; and

     (6) A clear and concise description of the consumer's ability to file or obtain a police report;

how a consumer requests a security freeze and the necessary information to be provided when

requesting the security freeze; and that no fees may be required to be paid to the consumer reporting

agencies when any person requesting a security freeze does so as a result of any breach.

     SECTION 2. This act shall take effect upon passage.

========

LC004754

========

LC004754 - Page 3 of 4

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO CRIMINAL OFFENSES -- IDENTITY THEFT PROTECTION ACT OF 2015

***

     This act would expand the responsibilities of those municipal or state agencies or any other

person or entity that stores, owns, collects, processes, maintains, acquires, uses, or licenses data,

who experiences a security breach. The responsibilities would include providing additional

information to persons affected and providing additional cooperation and information to law

enforcement and the department of business regulation.

     This act would take effect upon passage.

========

LC004754

========

LC004754 - Page 4 of 4