On June 26, Rhode Island Governor Gina Raimondo (D) signed into
law Senate Bill 0134, the Rhode Island Identity Theft Protection
Act of 2015 (the Act), which clarifies data security measures,
expands protection to health data and information in paper form,
sets a 45-day notice deadline, requires notification to the state
attorney general for some breaches and raises penalties for willful
violations of the Act. When the Act becomes effective, Rhode Island
will have one of the shortest statutory deadlines for providing
notification. The Act repeals and replaces Rhode Island’s
2005 breach notification law (132 PRA, 7/12/05).
The law addresses "ambiguities in the existing law, for
instance clarifying that municipal agencies are subject to its
provisions," according to a statement by Sen. Louis
DiPalma’s office. The existing statute imposes notice
requirements for breaches of unencrypted computerized personal
information, while the amended law requires notice for breaches
