Rhode Island Data Transparency and Privacy Protection Act (P.L. 2024, ch. 430 and ch. 453; R.I. Gen. Laws 6-48.1): profiling opt-out and data protection assessments

Summary

Rhode Island's comprehensive consumer privacy law, enacted in identical bills in June 2024 (S 2500 Sub A, P.L. 2024, ch. 430; H 7787 Sub A, P.L. 2024, ch. 453) and in force since January 1, 2026. Its consumer-rights and controller duties apply to for-profit entities doing business in Rhode Island or targeting its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding payment-only data), or of at least 10,000 customers while deriving more than 20 percent of gross revenue from selling personal data. Financial institutions, their affiliates and data subject to Title V of the Gramm-Leach-Bliley Act are excluded. Customers may opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, defined to include decisions on financial or lending services, housing, insurance, education, criminal justice, employment, health care and essential goods or services. Controllers must conduct and document a data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury, and the Attorney General may require its disclosure. Violations are deceptive trade practices enforced solely by the Attorney General, with a fine of $100 to $500 per intentional unlawful disclosure; there is no private right of action and no cure period.

Key dates

1. June 28, 2024Enacted
2. January 1, 2026Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. This chapter shall be known and may be cited as the “Rhode Island Data Transparency and Privacy Protection Act”.

   Supports: Name

   R.I. Gen. Laws 6-48.1-1, Short title State of Rhode Island General Assembly Primary source

2. Chapter 430 2024 — S 2500 SUBSTITUTE A AS AMENDED Enacted 06/28/2024

   Supports: Public law, bill number and enactment date

   SECTION 3. This act shall take effect on January 1, 2026.

   Supports: Effective date

   P.L. 2024, ch. 430 (S 2500 Substitute A as amended) State of Rhode Island General Assembly Primary source

3. Chapter 453 2024 — H 7787 SUBSTITUTE A AS AMENDED Enacted 06/29/2024

   Supports: Companion public law and enactment date

   P.L. 2024, ch. 453 (H 7787 Substitute A as amended) State of Rhode Island General Assembly Primary source

4. Rhode Island Governor Daniel McKee allowed the Rhode Island Data Transparency and Privacy Protection Act (“ RIDTPPA ”) to pass on June 25, 2024 when he transmitted the bill back to the legislature without signature

   Supports: Enacted without the Governor's signature

   Rhode Island Enacts Comprehensive Privacy Law Mintz Reporting or analysis

5. Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.

   Supports: Applicability threshold

   Opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the customer.

   Supports: Profiling opt-out

   R.I. Gen. Laws 6-48.1-5, Customer rights State of Rhode Island General Assembly Primary source

6. means decisions made by the controller that result in the provision or denial by the controller of: financial or lending services; housing; insurance; education enrollment or opportunity; criminal justice; employment opportunities; healthcare services; or access to essential goods or services.

   Supports: Decisions with legal or similarly significant effects include financial or lending services

   R.I. Gen. Laws 6-48.1-2, Definitions State of Rhode Island General Assembly Primary source

7. The processing of personal data for the purposes of profiling, where such profiling presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, customers, financial, physical or reputational injury to customers

   Supports: Assessment duty for risky profiling

   R.I. Gen. Laws 6-48.1-7, Controller and processor responsibilities State of Rhode Island General Assembly Primary source

8. Nothing in this chapter shall be deemed to apply in any manner to a financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act

   Supports: GLBA exclusion

   R.I. Gen. Laws 6-48.1-10, Construction State of Rhode Island General Assembly Primary source

9. shall pay a fine of not less than one hundred dollars ($100) and no more than five hundred dollars ($500) for each such disclosure

   Supports: Fine

   The attorney general shall have sole enforcement authority of the provisions of this chapter

   Supports: Attorney General enforcement

   Nothing in this section shall be construed to authorize any private right of action to enforce any provision of this chapter

   Supports: No private right of action

   R.I. Gen. Laws 6-48.1-8, Violations State of Rhode Island General Assembly Primary source