Rhode Island Becomes 19th State for Data Privacy Legislation
The Rhode Island Data Transparency and Privacy Protection Act (“the Act” or “the Rhode Island Data Privacy Act”) was signed into law on June 28, 2024, and has become the nineteenth state to enact comprehensive consumer data privacy legislation, while many other bills introduced in states such as Maine and Louisiana have gone inactive in recent months. Like other state laws, the Rhode Island Data Privacy Act does not directly address VPD, but it is implied.
VPD Provisions
It does not specifically define “vehicle information” or include any provisions specific to VPD. The Act defines “personal data” as “any information that is linked or reasonably linkable to an identified or identifiable individual and does not include de-identified data or publicly available information.” S. 2500, Gen. Assemb., Jan. Sess § 6-48.1-2.(18) (RI 2024).
“Sensitive data” is defined as personal data that does include data that reveals racial or ethnic origin, religious beliefs, mental or physical health conditions, sex life, sexual orientation, or immigration status, or data that uniquely identifies an individual or precise geolocation. S. 2500, Gen. Assemb., Jan. Sess. § 6-48.1-2.(26) (RI 2024).
Controllers are required to obtain customer consent before processing any sensitive data concerning a customer and shall not process the sensitive data of a known child unless consent is obtained in accordance with COPPA. S. 2500, Gen. Assemb., Jan. Sess. § 6-48.1-4.(c) (RI 2024).
The Act defines “biometric data” as data that is “generated by automatic measurements of an individual’s biological characteristics, such as a fingerprint, a voiceprint,” eye retina or iris pattern, or other characteristics that are used to identify a specific individual. It does not include photographs, video or audio recordings, unless that data is generated with the purpose to identify a specific individual. S. 2500, Gen. Assemb., Jan. Sess § 6-48.1-2.(3) (RI 2024).
Specifically exempt from the Act is personal data that is collected, processed, sold, or disclosed in compliance with the Driver’s Privacy Protection Act of 1994, U.S.C. § 2721 et seq., as amended from time to time. S. 2500, Gen. Assemb., Jan. Sess. § 6-48.1-3.(e)(12) (RI 2024).
Privacy Law
Rhode Island Data Transparency and Privacy Protection Act, effective January 1, 2026.
Despite the surge of inactive bills, we are keeping our eyes on Pennsylvania to become the 20th state to enact comprehensive consumer data privacy legislation.
Copyright Nelson Law LLC
The opinions expressed in this blog are those of the author(s) and do not necessarily reflect the views of the Firm, its clients, or any of its or their respective affiliates. This blog post is for general information purposes and is not intended to be and should not be taken as legal advice.