On Nov. 13, 2009, Rhode Island enacted
House Bill 5902 (companion
Senate Bill 589), which places new restrictions on the destruction of documents containing personal information. The bill was enacted without the governor’s signature and is effective Jan. 1, 2010.
The bill defines personal information as
information that identifies, relates to, describes, or is capable of being associated with a particular individual: his or her signature, Social Security number, physical characteristics or description, passport number, driver’s license or state identification card number, insurance policy number, bank account number, credit card number, debit card number, any other financial information or confidential health care information including all information relating to a patient’s health care history, diagnosis condition, treatment, or evaluation obtained from a health care provider who has treated the patient which explicitly or by implication identifies a particular patient.
The bill states businesses must take reasonable steps to destroy or arrange for the destructions of a consumer’s personal information by shredding, erasing, destroying or modifying their records. The goal of the legislation is to ensure the security and confidentiality of consumers’ personal information, protect against any reasonably foreseeable threats or hazards of security and protect against unauthorized access to or use of a consumer’s personal information that could result in harm to the consumer.
Businesses that do not comply with the bill could be faced with a civil action in a superior court to recover actual damages. Additionally, if the violation is of public interest, the attorney general may bring a suit against a business for actual damages of $500 for each violation, not exceeding $50,000.
The bill does not apply to debt purchasers and other financial institutions subject to the Gramm-Leach-Bliley Act and certain hospitals.