Rhode Island

Identity Theft Protection Act of 2015, notification of breach

Any municipal agency, state agency, or person that stores, owns, collects, processes, maintains, acquires, uses, or licenses data including personal information must notify affected Rhode Island residents of a breach that poses a significant risk of identity theft, within 30 days of confirmation for a state or municipal agency and within 45 days for any other person, with Attorney General and consumer-reporting-agency notice required once more than 500 residents are affected.

Reckless violations carry a penalty of up to $100 per record and knowing and willful violations up to $200 per record, brought by the Attorney General; no private right of action was found in the text read. Sections 11-49.3-4 and 11-49.3-5 both originate in P.L. 2015, ch. 138 and ch. 148; sec. 11-49.3-4's notice duty was last amended by P.L. 2023, ch. 375, sec. 1, effective June 27, 2023, while sec. 11-49.3-5's penalty provisions carry no amendment since 2015.

Neither section's own history note prints a same-page effective date for the original 2015 enactment, so no single effective_date is recorded for this citation's combined range.

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), general applicability

RIDTPPA applies only to for-profit entities conducting business in Rhode Island, or targeting products or services to Rhode Island residents, that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding payment-only data), or 10,000 customers while deriving more than 20 percent of gross revenue from personal-data sales.

Two companion 2024 bills, H 7787 and S 2500, produced two public laws for the same chapter (P.L. 2024, ch. 430 and ch. 453), both effective January 1, 2026.

Rhode Island Data Transparency and Privacy Protection Act, customer rights

RIDTPPA gives a Rhode Island customer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and significant-effect profiling. A controller must respond without undue delay and not later than 45 days after receipt, with one 45-day extension available, and must decide an appeal within 60 days, after which the customer may complain to the Attorney General.

Rhode Island Data Transparency and Privacy Protection Act, enforcement

A violation of RIDTPPA is a deceptive trade practice, and intentional disclosure of personal data to a shell company or otherwise in violation of the chapter carries a fine of $100 to $500 per disclosure. The Attorney General has sole enforcement authority, and unlike New Hampshire's and Kentucky's near-identical statutes, no mandatory or discretionary cure period appears in the enforcement section as read. The chapter creates no private right of action.

Rhode Island Data Transparency and Privacy Protection Act, sensitive data and biometric data definitions

RIDTPPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, health condition, sex life, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.

"Biometric data" is textually identical to New Hampshire's and Kentucky's definitions: it means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual, and excludes a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual.