A controller holding de-identified data must take reasonable measures so the data cannot be associated with an individual, publicly commit to keeping and using it without attempting re-identification, and contractually oblige recipients to comply with the Act; a controller disclosing pseudonymous or de-identified data must exercise reasonable oversight of recipients' contractual commitments and address breaches. Customer rights do not apply to pseudonymous data where the controller shows the identifying information is kept separately under effective controls that prevent its access. Applies to for-profit entities doing business in Rhode Island or targeting products or services to its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding data processed solely to complete a payment) or of at least 10,000 customers while deriving more than 20 percent of gross revenue from selling personal data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.