Privacy Law Library

Safe Destruction of Documents Containing Personal Information

RI Document Destruction Law

Data security · Health · Financial

Requires businesses to take reasonable steps to destroy customers' personal information they no longer keep, by shredding, erasing or otherwise making it unreadable. Personal information is defined broadly to include signatures, Social Security, passport, license, insurance and financial account numbers, physical descriptions, and confidential health care information.

Where

Rhode Island

Citation

R.I. Gen. Laws §§ 6-52-1 to 6-52-4

Status

In force

Enforced by

Rhode Island Attorney General; injured customers

People can sue

Yes

Penalties

A customer with actual damages may sue in superior court. The Attorney General may recover the customer's actual damages plus a civil penalty of $500 per improperly disposed record, capped at $50,000 (§ 6-52-3).

Applies to

• Any business (for-profit or not, including financial institutions and entities that destroy records, including the state, state agencies and political subdivisions) holding customers' personal information
• Exempts GLBA-regulated banks, credit unions and financial institutions; HIPAA-covered health insurers, nonprofit hospital and medical service corporations and health care facilities; FCRA-compliant consumer reporting agencies; and businesses with documented contracts for outsourced destruction