How Retailers and E-Commerce Brands Can Comply with the Rhode Island Data Transparency and Privacy Protection Act
The Rhode Island Data Transparency and Privacy Protection Act requires qualifying businesses to provide privacy notices and allow residents to opt out of data sales. Violations are treated as deceptive trade practices carrying civil penalties up to $10,000, plus fines of $100 to $500 for unlawful data disclosures.
If you operate a retail store in Providence, Cranston, or Warwick, or sell products online to Rhode Island residents, your data collection practices are under strict legal scrutiny. The Rhode Island Data Transparency and Privacy Protection Act (RI DTPPA) mandates that businesses safeguard personal information and give consumers control over how their data is used. Navigating these requirements can be difficult for growing brands. If you need help updating your privacy policies or responding to consumer requests, you can easily find an experienced local lawyer in our US Attorneys directory to guide you.
Understanding the RI DTPPA Requirements
Under R.I. Gen. Laws § 6-48.1-4(a), the law applies to for-profit businesses that control or process the personal data of at least 35,000 Rhode Island residents. Alternatively, it applies if you process the data of at least 10,000 residents and derive more than 20% of your gross revenue from the sale of personal data. If your business meets these thresholds, you must provide a reasonably accessible, clear, and meaningful privacy notice. This notice must explain what data you collect, why you collect it, and whether you share it with third parties.
E-commerce and Online Trackers
For online retailers, compliance goes beyond simply posting a privacy policy. You must obtain affirmative, opt-in consent before processing any sensitive data, such as precise geolocation or biometric information. Furthermore, you must provide a clear mechanism for customers to opt out of targeted advertising and the sale of their personal data. E-commerce platforms must carefully audit their third-party cookies and tracking pixels to ensure they do not accidentally share customer data without consent.
Brick-and-Mortar POS Data Collection
Physical retail stores are not exempt from the law. If your store collects email addresses for digital receipts or phone numbers for loyalty programs, that data is protected. You must securely store this information and limit your collection to what is strictly necessary for the transaction. If you plan to sell this customer list to a marketing partner, you must clearly disclose this practice and offer an easy way for customers to opt out at the point of sale.
Timelines for Handling Customer Data Deletion Requests
When a Rhode Island resident submits a request to access, correct, or delete their personal data, you must act quickly. The law generally gives businesses 45 days to respond to these requests. If the request is highly complex, you can extend this deadline by another 45 days, provided you inform the customer of the delay within the initial timeframe. Rather than relying on a standardized state form, companies must develop internal operating procedures and dedicated intake channels for Data Subject Requests under R.I. Gen. Laws § 6-48.1-6 to ensure statutory response windows are strictly honored.
Exemptions for GLBA and HIPAA
Not every type of data falls under the RI DTPPA. The law includes broad exemptions for specific industries that are already heavily regulated by federal laws. If you operate a financial institution, any data covered by the 15 U.S.C. § 6801 et seq. is entirely exempt. Similarly, if your business handles protected health information, that data is governed by the 42 U.S.C. § 1320d et seq. and is exempt from the state privacy law. Nonprofits and higher education institutions are also completely excluded from these regulations.
Statutory Penalties for Non-Compliance
There is no private right of action under the RI DTPPA, meaning a customer cannot personally sue you in civil court for a violation. Instead, the Rhode Island Office of the Attorney General, Providence holds exclusive enforcement authority under R.I. Gen. Laws § 6-48.1-8(b). Under R.I. Gen. Laws § 6-48.1-8(a), a violation of the chapter constitutes a deceptive trade practice under R.I. Gen. Laws § 6-13.1-8, subjecting businesses to civil penalties of up to $10,000 per violation. In addition, statutory fines ranging from $100 to $500 apply separately to each intentional unlawful disclosure of personal data. If non-compliant practices affect thousands of consumers, these compound penalties can create devastating financial exposure.
Frequently Asked Questions (FAQ)
Does the law apply to employee data?
No. The RI DTPPA strictly protects consumers acting in an individual or household context. It does not apply to individuals acting in a commercial or employment context.
Do small businesses need to comply?
It depends on your reach. If your small business processes the data of fewer than 35,000 Rhode Island residents and does not sell data, you generally do not need to meet the full compliance obligations, though all commercial websites should maintain a basic privacy notice.
Can I charge a fee to process a data deletion request?
Generally, you must provide information in response to a customer request free of charge, up to once annually per customer. You may only charge a reasonable administrative fee if the requests become unfounded, excessive, or repetitive.
Is there a cure period before I get fined?
Unlike some other states, Rhode Island does not provide an automatic right to cure violations before the Attorney General initiates enforcement action, so proactive compliance is critical.
No reviews yet. Be the first to share your experience!