On June 29, 2024, Rhode Island enacted the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA” or “Act”) after Governor Daniel McKee transmitted the Act back to the legislature without signature. The RIDTPPA will take effect on January 1, 2026.

Applicability

The RIDTPPA applies to:

• Any commercial website or internet service provider conducting business in Rhode Island or with customers in Rhode Island or otherwise subject to Rhode Island jurisdiction. These entities are required to designate a controller. The terms “commercial website” or “internet service provider” are not further defined.
• For-profit entities that conduct business in Rhode Island or produce products or services that are targeted to Rhode Island residents and satisfy one or more of the following thresholds during the preceding calendar year: (1) controlled or processed the data of not less than 35,000 customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) controlled or possessed the personal data of not less than 10,000 customers and derived more than 20 percent of their gross revenue from the sale of personal data.

The RIDTPPA contains numerous familiar exemptions, including exemptions for financial institutions, nonprofit organizations, data subject to the Gramm-Leach-Bliley Act; PHI under HIPAA, and certain air carriers.

Controller Obligations

With some notable differences, the RIDTPPA contains obligations for controllers that largely follow provisions in other comprehensive state privacy laws, such as obligations relating to data protection impact assessments (called “data protection assessments”), obtaining consent to process sensitive data, executing contracts with processors and providing a privacy notice with certain specified content.

Notably, the RIDTPPA requires that a controller identify all third parties to whom the controller has sold or may sell customers’ personally identifiable information.

Consumer Rights

Under the RIDTPPA, consumers will have the right to:

• Confirm whether or not a controller is processing the customer’s personal data and access such personal data, unless such confirmation or access would require the controller to reveal a trade secret.
• Correct inaccuracies in the customer’s personal data and delete personal data provided by, or obtained about, the customer, taking into account the nature of the personal data and the purposes of the processing of the customer’s personal data.
• Obtain a copy of the customer’s personal data processed by the controller, in a portable readily usable format that allows the customer to transmit the data to another controller.
• Opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the customer.

Controllers have 45 days to respond to consumer rights requests, with a potential 45-day extension when reasonably necessary.

Enforcement

The RIDTPPA does not contain a private right of action and will be enforced exclusively by the Rhode Island Attorney General. Violations are subject to a fine of at least $100 and no more than $500 per violation.

Effective Date

The RIDTPPA will take effect on January 1, 2026.

While the RIDTPPA resembles the existing comprehensive state privacy laws in many ways, the Act contains some notable drafting ambiguities, such as the use of multiple terms to refer to covered data, particularly with respect to certain exemptions (e.g., “personal data” is defined, but “personally identifiable information” is not). The drafting ambiguities bring a new layer of complexity to interpreting the law as the list of comprehensive state privacy laws continues to grow.