§ 11-49.2-3 Notification of breach. [Repealed effective July 2, 2016.]. (a) Any state agency or person that owns, maintains or licenses computerized data that includes personal information, shall disclose any breach of the security of the system which poses a significant risk of identity theft following discovery or notification of the breach in the security of the data to any resident of Rhode Island whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person or a person without authority, to acquire said information. The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b) Any state agency or person that maintains computerized unencripted data that includes personal information that the state agency or person does not own shall notify the owner or licensee of the information of any breach of the security of the data which poses a significant risk of identity theft immediately, following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(c) The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(d) The notification must be prompt and reasonable following
the determination of the breach unless otherwise provided in this section. Any
state agency or person required to make notification under this section and who
fails to do so promptly following the determination of a breach or receipt of
notice from law enforcement as provided for is subsection (c) is liable for a
fine as set forth in § 11-49.2-6.
(P.L. 2005, ch. 225, § 1.)