Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I sell personal information without obtaining consent in Rhode Island? What are the requirements?

Based on the documents provided, you cannot sell personal information without obtaining consent in Rhode Island. The Rhode Island regulation 230 RICR 20-60-7.17 outlines exceptions to opt-out requirements for disclosure of nonpublic personal financial information. The requirements for initial notice to consumers, opt-out, and service providers and joint marketing do not apply when a licensee discloses nonpublic personal financial information with the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction [1.1].

However, if you are selling real estate in Rhode Island, you are required to provide a written disclosure to the buyer that states all deficient conditions of which the seller has actual knowledge. The written disclosure shall comply with the requirements set forth in subsection (b) of RIGL 5-20.8-2. The disclosure form shall include information such as seller occupancy, year built, basement, sump pump, roof, fireplaces, chimney, woodburning stove, structural conditions, insulation, termites or other pests, radon, electrical service, heating system, air conditioning, plumbing, sewage system, water system, domestic hot water, property tax, easements and encroachments, deed, zoning, restrictions, building permits, minimum housing, flood plain, wetlands, multi-family or other rental property, pools and equipment, lead paint, fire, hazardous waste, miscellaneous, farms, mold, ventilation system modifications, and moisture penetration and damage [2.1].

If you are disclosing nonpublic personal financial information, the Rhode Island regulation 230 RICR 20-60-7.13 limits the disclosure and use of that information. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution under an exception in §§ 7.16 or 7.17 of this Part, the licensee’s disclosure and use of that information is limited. The licensee may disclose the information to the affiliates of the financial institution from which the licensee received the information; the licensee may disclose the information to its affiliates, but the licensee’s affiliates may, in turn, disclose and use the information only to the extent that the licensee may disclose and use the information; and the licensee may disclose and use the information pursuant to an exception in §§ 7.16 or 7.17 of this Part, in the ordinary course of business to carry out the activity covered by the exception under which the licensee received the information. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution other than under an exception in §§ 7.16 or 7.17 of this Part, the licensee may disclose the information only to the affiliates of the financial institution from which the licensee received the information; to its affiliates, but its affiliates may, in turn, disclose the information only to the extent that the licensee may disclose the information; and to any other person, if the disclosure would be lawful if made directly to that person by the financial institution from which the licensee received the information [1.2].

Exceptions to Notice and Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information for Processing and Servicing Transactions are outlined in Rhode Island regulation 230 RICR 20-60-7.16. The requirements for initial notice, opt-out, and service providers and joint marketing do not apply if the licensee discloses nonpublic personal financial information as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes, or in connection with servicing or processing an insurance product or service that a consumer requests or authorizes; maintaining or servicing the consumer’s account with a licensee, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity; a proposed or actual securitization, secondary market sale (including sales of servicing rights) or similar transaction related to a transaction of the consumer; or reinsurance or stop loss or excess loss insurance [1.3].

Rhode Island regulation 230 RICR 20-60-7.18 outlines when authorization is required for disclosure of nonpublic personal health information. A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed. However, nothing in this Part shall prohibit, restrict or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; claims adjustment and management; detection, investigation or reporting of actual or potential fraud, misrepresentation or criminal activity; underwriting; policy placement or issuance; loss control; ratemaking and guaranty fund functions; reinsurance and excess loss insurance; risk management; case management; disease management; quality assurance; quality improvement; performance evaluation; provider credentialing verification; utilization review; peer review activities; actuarial, scientific, medical or public policy research; grievance procedures; internal administration of compliance, managerial, and information systems; policyholder service functions; auditing; reporting; database security; administration of consumer disputes and inquiries; external accreditation standards; the replacement of a group benefit plan or workers compensation policy or program; activities in connection with a sale, merger, transfer or exchange of all or part of a business or operating unit; any activity that permits disclosure without authorization pursuant to the federal Health Insurance Portability and Accountability Act privacy rules promulgated by the U.S. Department of Health and Human Services, 45 C.F.R. Part 160 and [1.4].

Source(s):
Jurisdiction

Rhode Island