Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On June 25, the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) entered into force. The RIDTPPA furnishes Rhode Island residents with several data protection rights and requires covered businesses to comply with new data privacy and information security requirements. The RIDTPPA does not create a private right of action and delegates sole enforcement authority to the Rhode Island attorney general. The law becomes effective on January 1, 2026.

core/paragraph

core/heading

The RIDTPPA generally applies to for-profit organizations that conduct business in Rhode Island or produce products or services targeted to residents in the state and do any of the following during a calendar year:

core/list

The RIDTPPA includes several standard exemptions typically found in data privacy frameworks, such as exemptions for state and local governments, organizations governed by federal laws like HIPAA, GLBA, and FERPA, nonprofit organizations, and air carriers subject to the federal Airline Deregulation Act, among others.

The RIDTPPA primarily regulates how data “controllers” and “processors” collect and process a consumer’s personal data. A “consumer,” is defined as any Rhode Island resident acting in an “individual or household context.” The term generally excludes personal data concerning individuals acting in a commercial or employment capacity, HR data and personal data related to job applicants. The RIDTPPA also excludes “de-identified data” or “publicly available information,” each of which has its own definition under the law.

The RIDTPPA establishes additional requirements for processing “sensitive data,” defined as a subset of personal data including: (i) information revealing racial or ethnic origin, religious beliefs, mental or physical health conditions or diagnoses, sex life, sexual orientation, or citizenship or immigration status, (ii) processing biometric data or genetic information used to uniquely identify an individual, (iii) the personal data of a known child, or (iv) precise geolocation data.

As with other state privacy laws, the RIDTPPA grants consumers the right to:

The law mandates that customers can exercise their rights through secure and reliable means established by the controller and detailed in the controller's privacy notice. The RIDTPPA requires controllers to set up procedures for receiving, processing, and responding to data privacy requests, including authenticating consumer requests and adhering to specific response timelines. Additionally, controllers must create a framework for consumers to appeal decisions regarding their privacy requests. When informing a consumer of any action taken or not taken in response to an appeal, the controller must provide a written explanation of their decision. If a privacy request is denied, the law permits the consumer to file a complaint with the state’s attorney general, though it does not require controllers to provide this information.

Opt-Out Rights - Targeted Advertising and Sales

In addition to the rights previously mentioned, the RIDTPPA grants consumers the right to opt out of personal data processing for targeted advertising, sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the customer.

The term “targeted advertising” means “displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from the consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests.” However, as with the definition of “sale of personal data,” the definition of “targeted advertising” includes several exceptions within its meaning that are common across other U.S. state data protection laws.

Similarly, the RIDTPPA’s definition of the “sale of personal data” is like that found in other U.S. state data protection laws which means “the exchange of personal data for monetary or other valuable consideration by the controller to a third party.” However, several activities are excluded from its scope, such as:

A consumer may designate another person as the consumer's authorized agent to exercise the consumer's right to opt out of the processing of the consumer's personal data for purposes of targeted advertising and sale. In turn, a controller must honor an opt-out request from an authorized agent if the controller can verify the consumer’s identity and the agent's authority to act on the consumer's behalf.

A controller processing personal data must be reasonably necessary regarding the purposes for which such data processed as disclosed to the consumer, adequate, relevant, and limited to what is essential concerning a specific purpose. Further, a controller may not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of personal data concerning a known child, without obtaining consent from the child's parent or lawful guardian. A controller must “provide a mechanism for individuals to grant and revoke their consent, where consent is required.” If a consumer’s consent is revoked, then a controller must suspend its data processing as soon as practicable, but not later than 15 days after receiving the request.

Under the RIDTPPA, a controller that collects, stores, and sells customers' personally identifiable information must make certain disclosures. For instance, a controller must address in its customer agreement, addendum, or in another conspicuous location on its website or online service platform where similar notices are customarily posted the following:

Moreover, if a controller sells personal data to third parties or processes personal data for targeted advertising, the controller must clearly and conspicuously disclose such processing.

Information Security and Data Protection Assessments

The RIDTPPA requires a controller to “establish, implement, and maintain reasonable administrative, technical, and physical data security practices” to protect the confidentiality, integrity, and accessibility of personal data.

Additionally, under the RIDTPPA, a controller must conduct and document a protection assessment for each processing activity that presents a heightened risk of harm to a customer and more specifically:

Data privacy and protection assessments, or risk assessments conducted by a controller for compliance with other laws or regulations, may qualify under this section if they have a similar scope and effect. A single assessment can address multiple sets of comparable processing operations encompassing similar activities. The law permits the state’s attorney general to request these assessments and requires the controller to disclose them under certain conditions, provided the confidentiality of the assessment is preserved.

Processor Obligations and Data Processing Agreements

The RIDTPPA places affirmative obligations on processors, including “adhering to the instructions of the controller” and “assisting the controller to meet” its legal obligations. It requires controllers and processors to execute agreements (often called “data processing agreements”) that set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties. Per the terms of these contracts, a processor must: (i) ensure the confidentiality of its personnel concerning the data, (ii) engage subcontractors only with the controller’s approval and under the same data processing terms and conditions, (iii) agree to audits, compliance, and inspection provisions, and (iv) delete or return the controller’s personal data at the end of the service provision.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/07/Rhode-Island-Enacts-Consumer-Data-Privacy-Law.pdf

Rhode Island Enacts Consumer Data Privacy Law

Services