Personal data processed under the section's purposes may be processed only as reasonably necessary and proportionate to the purposes disclosed to the consumer and as adequate, relevant and limited to what is necessary for those specific purposes, considering the nature and purposes of collection, use and retention, and must be protected by reasonable administrative, technical and physical measures that reduce reasonably foreseeable risks of harm. A controller relying on an exemption bears the burden of showing the processing qualifies. Applies to for-profit entities doing business in Rhode Island or targeting products or services to its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding data processed solely to complete a payment) or of at least 10,000 customers while deriving more than 20 percent of gross revenue from selling personal data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.