Liisa M. Thomas writes:
The Rhode Island updates to its breach law that we previously reported on are now effective. As a reminder, under the amended law, notice is now required 45 days after “confirmation of the breach,” and the Rhode Island attorney general is to be notified if 500 Rhode Island residents are impacted. Also modified under the law, Rhode Island joins the growing list of states that include email addresses and passwords as “triggering information.” In other words, information that, if breached, would give rise to a duty to notify. The law also contains a requirement for maintaining a risk-based information security program, and on a going-forward basis, must contractually require third parties to whom they disclose information to protect that information.
Read more on Winston & Strawn.