Makes high-risk automated decisions, in Rhode Island

R.I. Gen. Laws secs. 6-52-1 to 6-52-4 · Read the law's page

• Take reasonable steps to destroy, or arrange for the destruction of, a customer's personal information within your custody and control that you no longer retain, by shredding, erasing, or otherwise destroying or modifying it to make it unreadable or indecipherable through any means.
• Destroy the information to ensure the security and confidentiality of customer personal information, to protect against any reasonably foreseeable threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
• This binds a business: any sole proprietorship, partnership, corporation, association, limited liability company or other group, however organized and whether or not organized to operate at a profit, including the state, a state agency or a political subdivision that destroys records. It does not bind a financial institution subject to the Gramm Leach Bliley Act and a listed federal regulator or the Department of Business Regulation, a health insurer, non-profit hospital, medical service corporation or health care facility subject to the privacy and security standards of the Health Insurance Portability and Accountability Act of 1996, a consumer report agency in compliance with the Federal Credit Reporting Act, or a business that contracts with another business to destroy the information and has physical evidence of that contract.

R.I. Gen. Laws sec. 6-48.1-7(a), (e) to (i) · Read the law's page

• Conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to a Rhode Island customer, including targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, and the processing of sensitive data (R.I. Gen. Laws sec. 6-48.1-7(e)).
• Make a data protection assessment available to the attorney general when the attorney general requires its disclosure for an investigation (R.I. Gen. Laws sec. 6-48.1-7(f)).

R.I. Gen. Laws secs. 6-48.1-5, 6-48.1-6 · Read the law's page

• Give a Rhode Island customer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Rhode Island customer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.
• Respond to a customer rights request without undue delay and not later than 45 days after receipt, with one 45-day extension available, and decide an appeal within 60 days of receipt.

R.I. Gen. Laws §§ 40.1-5.5-1 to 40.1-5.5-6 (H 7349, Substitute A, 2026 Regular Session) · Read the law's page

• Do not offer therapy or psychotherapy services to the public in Rhode Island, including through internet-based AI, unless a state-licensed professional or provider conducts them.
• If you are a licensed provider, use AI only for administrative or supplementary support with reasonable clinical oversight; never let it make independent therapeutic decisions, conduct therapeutic communication directly with a client absent an established provider relationship, or determine treatment plans.
• Where an AI companion or emotional-support tool assists with a recorded or transcribed therapy session, tell the patient (or their representative) in writing what the tool is for and obtain their consent before using it.

R.I. Gen. Laws sec. 5-37.3-5 · Read the law's page

• After you take an action or make a decision that adversely affects a patient and is based in whole or in part on the patient's confidential healthcare information (for example, denying an insurance application, issuing a policy with other than standard and uniform restrictions, rejecting a claim, or denying or terminating employment for health reasons), transfer copies of all of that patient's confidential healthcare information in your possession to the physician the patient designates in a written request; you may require payment of your actual cost of retrieval, duplication and forwarding (section 5-37.3-5(a)).
• When a patient asks you to amend or expunge any part of the information or to add recent relevant information, notify the healthcare provider who initially forwarded the information and, where that provider concurs, return the information to the provider for modification; do not modify it yourself except on court order (section 5-37.3-5(c)).
• Keep the patient's statement of reasonable length about the correctness or relevance of the information with the part of the information in contention at all times (section 5-37.3-5(c)).

R.I. Gen. Laws secs. 11-49.3-2, 11-49.3-5 · Read the law's page

• Implement and maintain a risk-based information security program with reasonable security procedures and practices appropriate to your size and scope, the nature of the information, and the purpose for which it was collected, to protect the information from unauthorized access, use, modification, destruction, or disclosure and to preserve its confidentiality, integrity, and availability.
• Do not retain personal information longer than reasonably required to provide the requested services, meet the purpose for which it was collected, or comply with a written retention policy or a legal requirement; destroy it securely, for example by shredding, pulverization, incineration, or erasure, regardless of the medium it is stored in.
• If you disclose personal information about a Rhode Island resident to a nonaffiliated third party, require by written contract that the third party implement and maintain reasonable security procedures and practices of the same kind, appropriate to its own size and scope, the nature of the information, and the purpose for which it was collected.
• This binds a municipal agency, a state agency, or a person, defined broadly to include an individual, sole proprietorship, partnership, association, corporation, joint venture, business, legal entity, trust, estate, cooperative, or other commercial entity, that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident.
• A reckless violation of this duty is a civil violation of up to $100 per record; a knowing and willful violation is up to $200 per record. Only the Attorney General may bring an action.

R.I. Gen. Laws secs. 28-6.7-1 to 28-6.7-5 · Read the law's page

• As an employer, employment agency or licensing agency, do not directly or indirectly request, require or administer a genetic test to an employee, licensee or applicant for employment or licensure (section 28-6.7-1(a)(1)).
• Do not affect the terms, conditions or privileges of employment or licensure, or terminate employment or licensure, of a person who obtains a genetic test (section 28-6.7-1(a)(2)).
• Do not deny employment or an occupational license, suspend, revoke or refuse to renew a license, or take other action affecting the terms, conditions or privileges of employment against an employee or license holder based directly or indirectly on a refusal to submit to a genetic test, to submit a family health history, or to reveal whether the person submitted to a genetic test or its results (section 28-6.7-1(a)(3)).
• Do not otherwise use genetic information to adversely affect the employment, licensure or application of any individual, and do not reveal genetic information about employees, licensees or applicants (section 28-6.7-1(a)(4) and (5)).
• If you are any person, do not sell to or interpret for an employer, employment agency or licensing agency a genetic test of a current or prospective employee or licensee (section 28-6.7-1(b)).

R.I. Gen. Laws § 6-13.1 et seq. (Advance Notice of Proposed Rulemaking, Docket 110-40-00-5)

• This measure is proposed and binds nobody yet; what follows is what it would require if it is enacted in this form.
• If you develop or deploy an AI decision-making system used in health care, housing, employment or education, disclose that use of AI to affected consumers.
• If you develop or deploy an AI decision-making system used in health care, housing, employment or education, put de-biasing policies in place.
• If you develop or deploy an AI decision-making system used in health care, housing, employment or education, validate the efficacy claims you make for it.
• If you develop or deploy an AI decision-making system used in health care, housing, employment or education, limit its purposes to the uses consumers have consented to.
• If you develop or deploy an AI decision-making system used in health care, housing, employment or education, give consumers a way to appeal an adverse algorithmic outcome.