Rhode Island Legislature Passes Consumer Data Privacy Act

The Rhode Island legislature passed the Rhode Island Data Transparency and Privacy Protection Act on June 13, 2024, and Governor Daniel McKee will now review the legislation. The act will apply to for-profit entities in Rhode Island that conduct business in Rhode Island or produce products or services that are targeted to state residents and that, during the prior calendar year, either (1) controlled or processed the personal data of at least 35,000 state residents or (2) controlled or processed the personal data of at least 10,000 state residents and derived more than 20% of their gross revenue from the sale of personal data. The act only applies to consumer personal data and excludes employee or business-to-business data. Exemptions exist for GLBA-regulated entities, HIPAA-covered entities, non-profit organizations, institutions of higher education, and FERPA-regulated personal data. Processing personal data for compliance with state or federal law and law enforcement investigations is also covered.