On June 13, 2024, House Bill 7787 for the Rhode Island Data Transparency and Privacy Protection Act was passed by the Rhode Island State Senate. This follows its passage, on June 10, 2024, by the Rhode Island House of Representatives.

What is the scope of the bill?

In particular, the bill outlines its application to for-profit entities that conduct business in Rhode Island or for-profit entities that produce products or services that are targeted to residents of Rhode Island, and that during the preceding calendar year:

• controlled or processed the personal data of not less than 35,000 customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
• controlled or processed the personal data of not less than 10,000 customers and derived more than 20% of their gross revenue from the sale of personal data.

The bill clarifies that it does not apply to information and data including, among others:

• protected health information under HIPAA;
• identifiable private information collected as part of human research pursuant to the good clinical practice guidelines;
• the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a customer's creditworthiness, standing, capacity, or character to the extent such activity is regulated under the Fair Credit Reporting Act;
• personal data collected, processed, sold, or disclosed in accordance with the Driver's Privacy Protection Act and the Family Educational Rights and Privacy Act; and
• data processed or maintained in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role.

The bill further provides that it does not apply to any state body, non-profit organization, or financial institution, or data subject to the GLBA.

The bill now provides for its entrance into effect on January 1, 2026.

The bill is a companion to Senate Bill 2500 for the Rhode Island Data Transparency and Privacy Protection Act.

You can read the bill here and track its progress here.