Law / United States / 
Rhode Island
Rhode Island Data Transparency and Privacy Protection Act, sensitive data and biometric data definitions
R.I. Gen. Laws sec. 6-48.1-2(26), (3)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain a Rhode Island customer's opt-in consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual.
- Treat a voiceprint or faceprint you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. Rhode Island's exclusion for recording-derived data does not reach data generated for that purpose.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Is data generated by automatic measurement of a biological characteristic 'biometric data' under R.I. Gen. Laws ยง 6-48.1-2(3) when it could identify an individual but the controller does not use it to identify a specific individual?
What it makes you log
Logging duty
The cited definitions of sensitive data (section 6-48.1-2(26)) and biometric data (section 6-48.1-2(3)) define terms and set no duty, so they require no log or record. The chapter's applicability clauses (sections 6-48.1-5(a) and 6-48.1-6(a), conducts business in the state or targets residents) and the definition of a customer as an individual residing in this state (section 6-48.1-2(10)) are not cited by this row, so no hook is coded. The consent rule for processing sensitive data is not in the cited definitions.
- Kind
- None
- As of
What this law does
RIDTPPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, health condition, sex life, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.
"Biometric data" is textually identical to New Hampshire's and Kentucky's definitions: it means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual, and excludes a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .