R.I. Gen. Laws § 44-18.1-22 — Confidentiality and privacy protections under Model 1

(A) The purpose of this section is to set forth the member states’ policy for the protection
of the confidentiality rights of all participants in the system and of the privacy
interests of consumers who deal with Model 1 sellers.
(B) As used in this section, the term “confidential taxpayer information” means all information
that is protected under a member state’s laws, regulations, and privileges; the term
“personally identifiable information” means information that identifies a person;
and the term “anonymous data” means information that does not identify a person.
(C) The member states agree that a fundamental precept in Model 1 is to preserve the privacy
of consumers by protecting their anonymity. With very limited exceptions, a CSP shall
perform its tax calculation, remittance, and reporting functions without retaining
the personally identifiable information of consumers.
(D) The governing board may certify a CSP only if that CSP certifies that:
(1) Its system has been designed and tested to ensure that the fundamental precept of
anonymity is respected;
(2) That personally identifiable information is only used and retained to the extent necessary
for the administration of Model 1 with respect to exempt purchasers;
(3) It provides consumers clear and conspicuous notice of its information practices, including
what information it collects, how it collects the information, how it uses the information,
how long, if at all, it retains the information and whether it discloses the information
to member states. Such notice shall be satisfied by a written privacy policy statement
accessible by the public on the official web site of the CSP;
(4) Its collection, use and retention of personally identifiable information will be limited
to that required by the member states to ensure the validity of exemptions from taxation
that are claimed by reason of a consumer’s status or the intended use of the goods
or services purchased; and
(5) It provides adequate technical, physical, and administrative safeguards so as to protect
personally identifiable information from unauthorized access and disclosure.
(E) Each member state shall provide public notification to consumers, including their
exempt purchasers, of the state’s practices relating to the collection, use and retention
of personally identifiable information.
(F) When any personally identifiable information that has been collected and retained
is no longer required for the purposes set forth in subsection (D)(4), such information
shall no longer be retained by the member states.
(G) When personally identifiable information regarding an individual is retained by or
on behalf of a member state, such state shall provide reasonable access by such individual
to his or her own information in the state’s possession and a right to correct any
inaccurately recorded information.
(H) If anyone other than a member state, or a person authorized by that state’s law or
the Agreement, seeks to discover personally identifiable information, the state from
whom the information is sought should make a reasonable and timely effort to notify
the individual of such request.
(I) This privacy policy is subject to enforcement by member states’ attorneys general
or other appropriate state government authority.
(J) Each member states’ laws and regulations regarding the collection, use, and maintenance
of confidential taxpayer information remain fully applicable and binding. Without
limitation, the Agreement does not enlarge or limit the member states’ authority to:
(1) Conduct audits or other review as provided under the Agreement and state law.
(2) Provide records pursuant to a member state’s Freedom of Information Act, disclosure
laws with governmental agencies, or other regulations.
(3) Prevent, consistent with state law, disclosures of confidential taxpayer information.
(4) Prevent, consistent with federal law, disclosures or misuse of federal return information
obtained under a disclosure agreement with the Internal Revenue Service.
(5) Collect, disclose, disseminate, or otherwise use anonymous data for governmental purposes.
(K) This privacy policy does not preclude the governing board from certifying a CSP whose
privacy policy is more protective of confidential taxpayer information or personally
identifiable information than is required by the Agreement.