A controller unable to authenticate a request need not act on it but must tell the customer so until they provide the information reasonably needed. Opt-out requests need not be authenticated; a controller may deny one only on a reasonable and documented belief of fraud, sending the requester a notice saying it believes the request is fraudulent, why, and that it will not comply. For data obtained from a source other than the customer, a deletion request is met by keeping a record of the request and the minimum data needed to keep the data deleted (used for nothing else), or by opting the customer out of all non-exempt processing of that data. Applies to for-profit entities doing business in Rhode Island or targeting products or services to its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding data processed solely to complete a payment) or of at least 10,000 customers while deriving more than 20 percent of gross revenue from selling personal data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.