Law / United States / 
Rhode Island
Rhode Island Data Transparency and Privacy Protection Act, customer rights
R.I. Gen. Laws secs. 6-48.1-5, 6-48.1-6
In force since .
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Give a Rhode Island customer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.NIST Privacy FrameworkCT.PO-P3
- Offer a Rhode Island customer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.NIST Privacy FrameworkCT.PO-P3
- Respond to a customer rights request without undue delay and not later than 45 days after receipt, with one 45-day extension available, and decide an appeal within 60 days of receipt.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the opt-out right in R.I. Gen. Laws § 6-48.1-5(e)(4) reach profiling whose output a person reviews before deciding, given that it covers 'solely automated decisions' while 'profiling' in § 6-48.1-2(21) means any form of automated processing?
What it makes you log
What the log must hold
Decision basis
Logging duty
A controller that denies an opt-out request on the ground that it is fraudulent must rest on a reasonable and documented belief and must tell the requester why, so the grounds of the denial exist as a record. The controller must also bear the burden of showing that a request is manifestly unfounded, excessive or repetitive (6-48.1-6(b)(3)), which allocates proof about a request and is not coded as a separate record. Retaining a record of a deletion request is one of two routes to treat deletion as done for data obtained from another source (6-48.1-6(b)(5)(i)); an option, not a duty. The section sets no period, no audit and no access right for any record. Outside the cited sections, 6-48.1-7(e) and (f) require a controller to conduct and document a data protection assessment for heightened-risk processing and to make it available to the Attorney General; that provision is outside this row's citation. The reach is the applicability clause that opens 6-48.1-5(a) and 6-48.1-6(a) (conducts business in the state, or products or services targeted to residents of the state) and the definition of customer as an individual residing in the state (6-48.1-2(10)), which is left out of the hook values because one pin cannot carry both clauses.
- Kind
- Implicit
- As of
- Provision
- R.I. Gen. Laws sec. 6-48.1-6(b)(4) (documented belief that an opt-out request is fraudulent)
- Trigger
- consent_or_optout
What this law does
RIDTPPA gives a Rhode Island customer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and significant-effect profiling. A controller must respond without undue delay and not later than 45 days after receipt, with one 45-day extension available, and must decide an appeal within 60 days, after which the customer may complain to the Attorney General.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .