Press "Enter" to skip to content

Rhode Island Enacts Haphazard Customer Data Privacy Law

Rhode Island Data Transparency and Privacy Protection ActRhode Island Senate Bill 2500, the “Rhode Island Data Transparency and Privacy Protection Act,” was enacted on June 28 without Gov. Dan McKee’s signature. The Act will go into effect Jan. 1, 2026.

This makes Rhode Island the 19th state to enact a comprehensive consumer data privacy law following CaliforniaVirginiaColoradoUtahConnecticut, Iowa, Indiana, TennesseeMontanaTexasOregon, Delaware, New JerseyNew Hampshire, Kentucky, Nebraska, Maryland, and Minnesota.

INFORMATION SHARING PRACTICES

The Act begins with a section titled “Information Sharing Practices,” which broadly applies to any commercial website (undefined) or internet service provider conducting business in Rhode Island or with customers in the state. Despite the title, this section has little to do with “sharing.”  If such an entity collects, stores and sells customers’ “personally identifiable information” (undefined), its controller must, in its customer agreement or on its website, “identify all third parties to whom the controller has sold or may sell customers’ personally identifiable information,” among other things.

This poses several problems. First, it would be almost impossible for a controller to predict every specific third party to whom it may sell personally identifiable information at any time in the future.

Second, and moreover, the term “personally identifiable information,” is undefined yet referred to 10 times in the Act, plus one reference to undefined “personally identifiable data.”  While “personal data” is defined, it is not clear that these are all one in the same.

Curiously, this section contains a lengthy list of entities and information that are exempt from the Act that differs from the shorter list provided in a separate section titled “Construction” summarized below, though there is some overlap.

APPLICABILITY

Apart from the “Information Sharing Practices” section, the Act applies to for-profit entities that conduct business in Rhode Island or that produce products or services that are targeted to residents of Rhode Island and that during the preceding calendar year did any of the following:

  1. Controlled or processed the personal data of not less than 35,000 customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.
  2. Controlled or processed the personal data of not less than 10,000 customers and derived more than 20% of their gross revenue from the sale of personal data.

Oddly, these same thresholds are repeated in the sections titled “Customer Rights,” “Exercising Customer Rights,” and “Controller and Processor Responsibilities.”

EXEMPTIONS

In addition to the list of exemptions contained in the “Information Sharing Practices” section, the “Construction” section provides the Act does not apply to:

  1. A financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act and its implementing regulations;
  2. Information or data subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA);
  3. Personally identifiable information or any other information collected, used, processed, or disclosed by or for a customer reporting agency as defined by 15 U.S.C. § 1681a(f);
  4. Any entity recognized as a tax exempt organization under the Internal Revenue Code;
  5. A contractor, subcontractor, or agent of a state agency or local unit of government when working for that state agency or local unit of government.

Additionally, the definition of “customer” excludes “an individual acting in a commercial or employment context or as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit or government agency whose communications or  transactions with the controller occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit or government agency.”

CUSTOMER RIGHTS

The Act provides a customer with the right to:

  1. Confirm whether their personal data is being processed;
  2. Correct inaccuracies;
  3. Delete personal data provided by, or obtained about, the consumer;
  4. Obtain a portable copy of the personal data processed;
  5. Opt out of the processing of their personal data if for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the customer.
SENSITIVE DATA

A controller is prohibited from processing sensitive data without a customer’s consent.

“Sensitive data” is defined as “personal data that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status, the processing of genetic or biometric data for the purpose of uniquely identifying an individual, personal data collected from a known child, or precise  geolocation data.”

CONTRACT REQUIREMENTS

A contract between a controller and a processor must clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties. It must also require that the processor:

  1. Ensure that each person processing personal data is subject to a duty of confidentiality;
  2. At the controller’s direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law;
  3. Upon the reasonable request of the controller, make available to the controller all information in its possession necessary to demonstrate the processor’s compliance with the obligations of the Act;
  4. After providing the controller an opportunity to object, engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the obligations of the processor with respect to the personal data;
  5. Allow, and cooperate with, reasonable assessments by the controller or the controller’s designated assessor, or the processor may arrange for a qualified and independent assessor to assess the processor’s policies and technical and organizational measures in support of the obligations of the Act.
DATA PROTECTION ASSESSMENTS

A controller must conduct and document a data protection assessment for processing activities that present a heightened risk of harm to a customer, including:

  1. The processing of personal data for purposes of targeted advertising;
  2. The sale of personal data;
  3. The processing of personal data for purposes of profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, customers, financial, physical or reputational injury to customers, a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of customers, where such intrusion would be offensive to a reasonable person, or other substantial injury to customers;
  4. The processing of sensitive data.
ENFORCEMENT

A violation constitutes a deceptive trade practice, and an intentional disclosure of personal data in violation of the Act may result in a fine of not less than $100 and no more than $500 for each such disclosure. The Attorney General has sole authority to enforce the Act, which contains no cure provision.

IMPRESSION

While similar in many respects to some of the post-California comprehensive data privacy laws, this legislation appears to have been cobbled together in a hasty and haphazard fashion, which may create compliance issues for those trying to align its compliance requirements with those of other states. Like California, it is anticipated that this act will undergo numerous corrective amendments in the next legislative session. For a chart comparing the state comprehensive data privacy acts, and more information and insight from Maurice Wutscher on data privacy and security laws and legislation, click here.

Photo: K.L. Kohn/stock.adobe.com

Print Friendly, PDF & Email

Eric Rosenkoetter is a principal at Maurice Wutscher LLP, where he provides counsel to businesses and consumer financial services firms nationwide. For many years, he has focused his practice on various aspects of financial services law. As a litigation attorney, he has conducted every aspect of the litigation process, including countless depositions, motion proceedings, bench and jury trials, and appeals in various courts. In addition, he has significant experience as a compliance and transactional attorney, providing strategic, business growth, legislative, compliance and regulatory advice to national corporations and trade associations. For example, he has drafted consumer contracts and disclosures designed to state-specific statutory requirements, and developed “Best Practices” guides and state-by-state compliance grids, for national financial services companies. He also conducted research and crafted a metrics report for a national trade association with analysis designed to counter the claims of advocacy groups. Eric’s experience also includes working for a national corporation as Executive Counsel, Chief Compliance and Ethics Officer, and Director of Legislative Affairs, and as a federal lobbyist and Director of Government and Public Affairs for a national financial services trade association. In the government sector, Eric presided over approximately 6,000 state administrative hearings, served as a staff attorney for the Missouri Senate, and handled litigation in 33 counties as a regional managing attorney. Eric frequently speaks to audiences on topics relevant to the financial services industry including regulatory compliance, data privacy law and related advocacy initiatives. For more information, see https://mauricewutscher.com/attorneys/eric-rosenkoetter/

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.