Law note · Rhode Island
Rhode Island Data Transparency and Privacy Protection Act, sensitive data and biometric data definitions
RIDTPPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, health condition, sex life, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.
"Biometric data" is textually identical to New Hampshire's and Kentucky's definitions: it means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual, and excludes a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual.
What it asks of an app
- Obtain a Rhode Island customer's opt-in consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual.
- Treat a voiceprint or faceprint you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. Rhode Island's exclusion for recording-derived data does not reach data generated for that purpose.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Rhode Island statute text, R.I. General Laws chapter 6-48.1, Rhode Island General Assembly website