2022 -- H 7917

========

LC003582

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2022

____________

A N   A C T

RELATING TO STATE AFFAIRS AND GOVERNMENT – RHODE ISLAND

INFORMATION PRIVACY ACT

     Introduced By: Representative Joseph M. McNamara

     Date Introduced: March 07, 2022

     Referred To: House Finance

     It is enacted by the General Assembly as follows:

     SECTION 1. Title 42 of the General Laws entitled "STATE AFFAIRS AND

GOVERNMENT" is hereby amended by adding thereto the following chapter:

CHAPTER 162

RHODE ISLAND INFORMATION PRIVACY ACT

     42-162-1. Short title.

     This chapter shall be known and may be cited as the "Rhode Island Information Privacy

Act".

     42-162-2. Definitions.

     As used in this chapter, the following words shall, unless the context clearly requires

otherwise, have the following meanings:

     (1) "Advertisement" means the process by which a person, the "advertiser," proposes a

commercial transaction or disseminates a public or private communication or message to solicit

business or a commercial opportunity.

     (2) "Algorithm" means a specific procedure, set of rules, or order of operations designed

to solve a problem or make a calculation, classification, or recommendation.

     (3) "Artificial intelligence" means computerized methods and tools including, but not

limited to, machine learning and natural language processing, that act in a way that resembles

human cognitive abilities when it comes to solving problems or performing certain tasks.

     (4) "Automated decision system" means any computer program, method, statistical model,

or process that aims to aid or replace human decision-making using algorithms or artificial

intelligence. These systems can include analyzing complex datasets about human populations to

generate scores, predictions, classifications, or recommendations used to make decisions.

     (5) "Biometric information" means information that pertains to measurable biological or

behavioral characteristics of an individual that can be used singularly or in combination with each

other or with other information for automated recognition or identification of a known or unknown

individual. Examples include, but are not limited to, fingerprints, retina and iris patterns,

voiceprints, DNA sequence, facial characteristics, gait, handwriting, keystroke dynamics, and

mouse movements. Biometric information does not include writing samples, written signatures,

photographs, human biological samples used for valid scientific testing or screening, demographic

data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color.

Biometric information does not include donated organs, tissues, or parts, or blood, or serum stored

on behalf of recipients or potential recipients of living, or cadaveric transplants obtained or stored

by a federally designated organ procurement agency. Biometric information does not include

information captured from a patient in a health care setting or information collected, used, or stored

for health care treatment, payment, or operations under the federal Health Insurance Portability and

Accountability Act of 1996. Biometric information does not include an X-ray, roentgen process,

computed tomography, MRI, PET scan, mammography, or other image or film of the human

anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further

validate scientific testing or screening.

     (6) "Browser personal information" means Internet protocol addresses, system

configuration information, uniform resource locators of referring pages, local and language

preferences, keystrokes, and other similar digital sources associated with an individual.

     (7) "Collect" means to collect, buy, rent, gather, obtain, receive, trade for, or access any

personal information pertaining to an individual by any means, online or offline, including, but not

limited to, receiving information from the individual or a third party, actively or passively, or

obtaining information by observing the individual's behavior.

     (8) "Commission" means the Rhode Island information privacy commission.

     (9) "Conduct business in the State of Rhode Island" or "conducting business in Rhode

Island" means to produce, solicit, or offer for use or sale any information, product, or service in a

manner that intentionally targets or may reasonably be expected to contact individuals.

     (10) "Consent" means freely given, specific, informed, unambiguous, opt-in consent by

individuals.

LC003582 - Page 2 of 35

      (11) "Covered entity" means an entity that conducts business in the State of Rhode Island,

processes personal information by itself or by contracting with a data processor:

     (i) Has earned or received ten million dollars ($10,000,000) of annual revenue through

three hundred (300) or more transactions; or

     (ii) Processes or maintains the personal information of ten thousand (10,000) or more

unique individuals during the course of a calendar year.

     (12) "Covered interaction" means an interaction between an individual or its household and

a covered entity when such covered entity makes available information, products, or services to the

individual and collects or otherwise processes personal information pertaining to that individual.

Covered interactions include, but are not limited to, posting information, offering a product or

service, the placement of targeted advertisements, setting up an account, or offering membership

or other ongoing relationship with a covered entity.

     (13) "Data processor" means a person or entity that processes personal information on

behalf of a covered entity.

     (14) "De-identified" means information that cannot reasonably identify, relate to, describe,

be capable of being associated with, or be directly linked to a particular individual or household.

     (15) "Device" means a tool that is capable of sending, routing, or receiving

communications to or from another device and intended for use by a single individual or single

household or, if used outside of a home, for use by the general public.

     (16) "Disclose" means any action, set of actions, or omission in which a covered entity,

data processor, or a third party makes personal information available to another person,

intentionally or unintentionally, including, but not limited to, sharing, publishing, releasing,

transferring, disseminating, making available, selling, leasing, providing access to, failing to

restrict access to, or otherwise communicating orally, in writing, electronically, or by any other

means.

     (17) "Harm" means potential or realized adverse consequences for an individual or society,

including, but not limited to:

     (i) Direct or indirect financial harm;

     (ii) Physical harm or threats to individuals or property, including, but not limited to, bias-

related crimes and threats, harassment, and sexual harassment;

     (iii) Discrimination in products, services, or economic opportunities such as housing,

employment, credit, insurance, education, or health care on the basis of an individual or class of

individuals belonging to, or being perceived as belonging to, one of the protected classes under

chapter 5.1 of title 28, except as specifically authorized by law;

LC003582 - Page 3 of 35

     (iv) Interference with or surveillance of First Amendment-protected activities by state

actors, except as specifically authorized by law;

     (v) Interference with the right to vote or with free and fair elections;

     (vi) Violation of individuals’ rights to due process or equal protection under the law;

     (vii) Loss of individual control over personal information via non-consensual sharing of

sensitive personal information, data breach, or other actions that violate this chapter;

     (viii) The non-consensual capture of information or communications within an individual's

home or where an individual is entitled to have a reasonable expectation of privacy or access

control;

     (ix) Other effects on an individual that may not be reasonably foreseeable to, contemplated

by or expected by the individual to whom the personal information relates, which are nevertheless

reasonably foreseeable to, contemplated by, or expected by the covered entity, that alter or limit

that individual's choices or predetermine results.

     (18) "Individual" means a natural person who is a resident of the State of Rhode Island.

The location of a natural person in the State of Rhode Island shall create a presumption that the

natural person is a State of Rhode Island resident.

     (19) "Legal request" means any request for personal information issued by a court of

competent jurisdiction pursuant to state or federal laws such as subpoenas, court orders, search

warrants, pen register and trap and trace orders, or wiretap orders.

     (20) "Location information" means information pertaining to where an individual has

physically been or directly or indirectly reveals an individual's physical location or the location of

a device associated with that individual. Location information includes, but is not limited to:

     (i) IP addresses;

     (ii) GPS coordinates;

     (iii) Cell-site location information;

     (iv) Time-stamped video or other surveillance information that identifies an individual as

being in a certain place;

     (v) Information derived from transportation cards;

     (vi) Information related to an individual's visit to certain locations.

     (21) "Rhode Island governmental entity" means any agency, executive office, department,

board, commission, bureau, division or authority of the state, or of any political subdivision thereof,

or of any authority established by the general court to serve a public purpose.

     (22) "Monetize" or "monetization" means to sell, rent, release, disclose, disseminate, trade,

make available, transfer, or otherwise communicate orally, in writing, or by electronic or other

LC003582 - Page 4 of 35

means, an individual's personal information by a covered entity, a third party, or a data processor

in exchange for monetary or other consideration, as well as to leverage or use an individual's

personal information to place a targeted advertisement or to otherwise profit, regardless of whether

the individual's personal information changes hands.

     (23) "Person" means any natural or legal person.

     (24) "Personal information" means information about an individual directly or indirectly

captured in a covered interaction. Personal information includes any information so captured that

directly or indirectly identifies, relates to, describes, is capable of being associated with, or could

reasonably be linked to a particular individual, household, or device. Information is reasonably

linkable to an individual, household, or device if used on its own or in combination with other

reasonably available information to identify an individual, household, or device, regardless of

whether the covered entity holds such additional information. This definition includes, but is not

limited to, the following information:

     (i) First names, middle names, last names, aliases, and social media and website-used

usernames;

     (ii) Government-issued ID and vehicle license plate numbers;

     (iii) Telephone numbers, including cellphone numbers, and physical and digital addresses

such as IP addresses and email addresses;

     (iv) Date of birth, age, gender, race, ethnicity, national origin, and sexual orientation;

     (v) Information revealing political opinions, religious, or philosophical beliefs held by

identified individuals;

     (vi) Technical identifiers such as a service ID number that can be tied back to an individual;

     (vii) Biometric information;

     (viii) Location information;

     (ix) Medical and health information including an individual's medical history and search

queries related to medical conditions;

     (x) Financial data, including social security number, details of financial and commercial

transactions, and credit scores related to the financial capacity of an individual;

     (xi) Professional data, including resume, job history, and other similar records related to

an individual;

     (xii) Information pertaining to an individual's behavior online, such as a record of the

websites they visit or the files they download;

     (xiii) Browser personal information;

     (xiv) Information pertaining to an individual's sex life; and

LC003582 - Page 5 of 35

     (xv) Electronic communications such as messaging, email, and voice conversations;

     (25) "Processing" or "process" means any action or set of actions performed on or with

personal information, including, but not limited to, collecting, accessing, using, storing, retaining,

sharing, monetizing, analyzing, creating, generating, aggregating, altering, correlating, operating

on, decision-making, recording, modifying, organizing, structuring, disclosing, transmitting,

selling, licensing, disposing of, destroying, de-identifying, or another handling of personal

information. This term includes using personal information in automated decision systems.

     (26) "Reasonably understandable" means of length and complexity such that an individual

with an eighth-grade reading level, as established by the department of education, can read and

comprehend.

     (27) "Sensitive personal information" means the following personal information related to

an identified individual:

     (i) Race, ethnicity, national origin, and sexual orientation;

     (ii) Date of birth;

     (iii) Cellphone number;

     (iv) Information revealing political opinions, religious or philosophical beliefs held by

identified individuals;

     (v) Biometric information;

     (vi) Location information;

     (vii) Medical and health information including an individual's medical history and search

queries related to medical conditions;

     (viii) Information pertaining to an individual's sex life;

     (ix) Social security number; and

     (x) Credit scores related to the financial capacity of an individual.

     (28) "Targeted advertisement" means an advertisement directed to an individual or a group

of individuals where the advertisement is selected by an automated decision system based on

processed personal information obtained or inferred over time from the individual or the groups of

individual's devices activities, communications, or associations across websites, applications,

services, or covered entities. It does not include advertisements directed to an individual solely

based upon the individual's current visit to a website, application, service, covered entity, or a direct

response to the individual's request for information or feedback.

     (29) "Third party" means, with respect to an individual's personal information, any person

or governmental entity that is not the covered entity or a data processor.

     (30) "Use model" means a discrete purpose for which collected personal information is to

LC003582 - Page 6 of 35

be processed, including, but not limited to, first-party marketing, third-party marketing, first-party

research and development, third-party research and development, and product improvement and

development.

     42-162-3. General principles and duties.

     (a) The provisions of this chapter and the regulations enacted thereof shall be interpreted

and administered in accordance with the following general principles:

     (1) Covered entities and data processors must process personal information and use

automated decision systems discreetly and honestly, and only to the extent necessary for carrying

out their purpose; and

     (2) Covered entities and data processors must be protective of personal information, loyal

to the individuals whose personal information is processed, and honest about the risk of processing

practices, including the use of automated decision systems.

     (b) Duty of care. Covered entities and data processors shall;

     (1) Reasonably secure individual personal information from unauthorized access; and

     (2) Promptly comply with § 11-49.3-4 in case of a breach of security, as defined therein.

     (c) Duty of loyalty. Covered entities and data processors shall not use personal information,

or information derived from personal information, in any way that:

     (1) Benefits themselves to the detriment of an individual;

     (2) Results in reasonably foreseeable and material physical or financial harm to an

individual; or

     (3) Would be unexpected and highly offensive to a reasonable individual that provided

consent in accordance with this chapter.

     (d) Duty of confidentiality. Covered entities and data processors:

     (1) Shall not disclose or sell personal information to, or share personal information with,

any other person except as consistent with the provisions set forth in this chapter and regulations

enacted to implement them;

     (2) Shall not disclose or sell personal information to, or share personal information with,

any third party unless that third party enters into a contract with the covered entity that imposes on

the third party the same duties of care, loyalty, and confidentiality toward the applicable individual

as are imposed on the covered entity under this chapter; and

     (3) Shall take reasonable steps to ensure that the practices of any third party to whom the

covered entity discloses or sells, or with whom the covered entity shares personal information fulfill

the duties of care, loyalty, and confidentiality assumed by the third party under the contract

described in the previous subsection.

LC003582 - Page 7 of 35

     (i) Covered entities shall regularly audit the data security and data information practices of

any such third party, making such audit publicly available.

     42-162-4. Rights of access, correction, data portability, and deletion.

     (a) Access to and portability of personal information.

     (1) Individuals shall have the right to:

     (i) Access all their personal information that was processed by the covered entity or a data

processor;

     (ii) Access all the information pertaining to the collection and processing of their personal

information, including, but not limited to:

     (A) Where or from whom the covered entity obtained personal information, i.e., from the

individual or a third party, whether online or offline;

     (B) The types of third parties to which the covered entity has disclosed or will disclose

captured personal information;

     (C) The purposes of the processing;

     (D) The categories of personal information concerned;

     (E) The names of third parties to which the covered entity had disclosed the personal

information and a log showing when such disclosure happened; and

     (F) The period of retention of the personal information;

     (iii) Obtain their personal information processed by a covered entity in a structured, readily

usable, portable, and machine-readable format;

     (iv) Transmit or cause the covered entity to transmit the personal information to another

covered entity, where technically feasible;

     (v) Request a covered entity to stop collecting and processing their personal information.

     (b) Correction and deletion of personal information.

     (1) Individuals shall have the right to:

     (i) Correct inaccurate personal information stored by covered entities; and

     (ii) Delete all their personal information stored by covered entities; provided that, a covered

entity that has collected personal information from an individual is not required to delete

information to the extent it is exempt under this chapter from the requirement of consent.

     (2) A covered entity that maintains an individual's personal information in a non-public

profile or account must correct or delete such personal information, and any information derived

therefrom pertaining to the individual upon the individual's request.

     (c) Exercise of rights.

     (1) A covered entity must provide individuals with a reasonable means to exercise their

LC003582 - Page 8 of 35

rights mentioned in subsections (a) and (b) of this section in a request-form that is:

     (i) Clear and conspicuous;

     (ii) Made available at no additional cost and with no transactional penalty to the individual

to whom the information pertains; and

     (iii) In English and any other language in which the covered entity communicates with the

individual to whom the information pertains.

     (2) A covered entity must comply with a request to exercise the rights mentioned in

subsections (a) and (b) of this section no later than thirty (30) days after receiving a verifiable

request from the individual.

     (i) Where the covered entity has reasonable doubts or cannot verify the identity of the

individual making a request, the covered entity may request additional personal information

necessary for the specific purpose of confirming the identity of the individual.

     (ii) A covered entity may not de-identify an individual's personal information during the

sixty (60) day period beginning on the date on which the covered entity receives a request for

correction or deletion from the individual.

     42-162-5. Right to know.

     (a) Individuals shall have the right to know what personal information a covered entity or

a data processor will collect and process about the individual, including the categories and specific

pieces of personal information the covered entity processes, before giving consent for the collection

and processing of their personal information.

     (b) Meaningful notice. A covered entity must make both a long-form privacy policy and a

short-form privacy policy available to all individuals in accordance with the following.

     (1) The privacy policies shall be available and readily accessible on the covered entity's

website or mobile application.

     (i) In the case of in-person or non-Internet electronic engagement, the privacy policies shall

be readily accessible at the primary physical place of business and any offline equivalent

maintained by the covered entity.

     (2) The privacy policies shall be persistently and conspicuously available at or prior to the

point of sale of a product or service, subscription to a service, sign up, or creation of an account

with the covered entity.

     (3) Covered entities that process personal information shall ensure that individuals are

presented with the short-form privacy policy only once upon the individual's first electronic covered

interaction that may or will result in the processing of personal information, whether that is through

the covered entity's website or use of the covered entity's mobile application.

LC003582 - Page 9 of 35

     (i) In the case of in-person or non-Internet electronic engagement, the short-form privacy

policy should be read to or otherwise presented to the individual before the covered entity first

collects the individual's personal information.

     (4) The short-form privacy notice required under this section shall:

     (i) Be clear, concise, well-organized, and complete;

     (ii) Be clear and prominent in appearance;

     (iii) Use clear and plain language;

     (iv) Use visualizations where appropriate to make complex information understandable by

the ordinary user;

     (v) Be reasonably understandable;

     (vi) Be distinguishable from other matters;

     (vii) Not contain any unrelated, confusing, or contradictory information;

     (viii) Be no more than six hundred (600) words, excluding the list of third parties with

which the covered entity discloses personal information; and

     (ix) Be provided free of charge.

     (5) The short-form privacy notice required must include:

     (i) The sensitive personal information being processed;

     (ii) The use model and a brief explanation of the relationship between the individual and

the covered entity;

     (iii) Whether the covered entity by itself or a data processor on its behalf processes the

information;

     (iv) Whether the covered entity uses automated decision systems;

     (v) Whether personal information is going to be processed for purposes of targeted

advertisement or monetization;

     (vi) One example of harm that may arise from a misuse of the personal information;

     (vii) The period of retention of the personal information expressed in exact dates;

     (viii) To what types of third parties the covered entity discloses personal information and

for what purposes, including governmental entities; and

     (ix) Whether the covered entity collects personal information through offline practices

when the individual does not interact directly with the covered entity.

     (6) A list of the third parties referenced in subsection (b)(5)(viii) of this section must be

provided either in the short-form privacy notice or in an easily accessible online form. If the policy

is delivered verbally, the person communicating the policy must offer to read the list of third parties.

If provided in the short-form privacy notice, such list must be offset by at least two (2) line breaks

LC003582 - Page 10 of 35

from the rest of the short-form privacy notice.

     (7) The long-form privacy policy shall contain a detailed description of the processing of

the personal information, including, but not limited to, all the elements of the short-form privacy

policy, and an explanation of how the covered entities and their affiliate data processors comply

with the provisions of this chapter, including the following:

     (i) A brief explanation of the technology that mediates the relationship between the

individual and the covered entity, including automated decision systems; and

     (ii) A brief explanation of the risks of harm that arises from the possible misuse of personal

information processing.

     (8) The commission shall:

     (i) Establish a standardized short-form privacy notice that complies with this section;

     (ii) Determine whether a more concise presentation of a short-form privacy notice is

appropriate where the policy is being communicated verbally, and if so, shall establish a

standardized short-form verbal privacy notice;

     (iii) Develop a recognizable and uniform logo or button to promote individual awareness

of the short-form privacy notice; and

     (iv) Promulgate regulations specifying additional requirements for the format and

substance of short-form privacy notices.

     42-162-6. Right to consent.

     (a) Individuals shall have the right to consent in accordance with this section before their

personal information is collected and processed.

     (b) Consent given by an individual authorizes a covered entity to collect, cause to collect,

process, or cause to process personal information from such individual in accordance with the

following:

     (1) A covered entity must obtain consent:

     (i) Before collecting or causing to collect personal information for purposes of processing

an individual's personal information for the first time; and

     (ii) After the acceptance of the short-form privacy policy described in § 42-162-5.

     (2) For continuing covered interactions, the consent required by this section must be

renewed annually, and if not so renewed, shall be deemed to have been withdrawn.

     (3) A covered entity must provide new meaningful notice and obtain consent from an

individual two (2) weeks before changing the nature of the processing of personal information to

which the individual previously consented.

     (i) The two (2) week period in the previous subsection shall not apply if the change in

LC003582 - Page 11 of 35

processing is necessary to enable a new functionality requested by the individual; provided that,

such individual was given notice and provided consent when making such request.

     (4) A covered entity requesting consent shall:

     (i) Ensure that the option to refuse consent is presented as clearly and prominently as the

option to provide consent;

     (ii) Provide a mechanism for an individual to withdraw previously given consent at any

time; and

     (iii) Once a year, provide a notice explaining how the personal information was used,

including two (2) examples of such use.

     (5) A covered entity requesting consent shall not coerce consent through the use of

interfaces that:

     (i) Threaten or mandate an individual's compliance;

     (ii) Ask questions or provide information in a way individuals cannot reasonably

understand;

     (iii) Attract the individual's attention away from their current task by exploiting perception,

particularly pre-attentive processing;

     (iv) Take advantage of individuals’ errors to facilitate the interface designer’s goals;

     (v) Deliberately increase work for the individual;

     (vi) Interrupt the individual's task flow;

     (vii) Use information architectures and navigation mechanisms that guide the individual

toward not having a real option to consent;

     (viii) Hide desired content or interface elements;

     (ix) Limit or omit controls that would facilitate task accomplishment by the individual;

     (x) Present disturbing content to the individual; or

     (xi) Generally mislead or deceive the individual.

     (6) Once an individual refuses to provide consent in accordance with this section, and if

the individual keeps interacting with the covered entity in any way, the covered entity shall not try

to obtain consent unless a period of at least six (6) months has passed.

     (7) Under no circumstances shall the mere covered interaction of an individual with a

covered entity's product or service be deemed as consent.

     (8) A covered entity may collect browser personal information; provided that, the covered

entity:

     (i) Processes only the personal information necessary to request consent;

     (ii) Processes such information solely to request consent; and

LC003582 - Page 12 of 35

     (iii) Immediately deletes all the personal information if consent is refused.

     (9) A covered entity shall not:

     (i) Refuse to serve an individual who does not approve the processing of the individual's

personal information under this section unless the processing is necessary for the primary purpose

of the transaction that the individual has requested;

     (ii) Offer a program that relates the price or quality of a product or service to the degree of

acceptance of personal information processing. This includes the provision of discounts or other

incentives in exchange for the consent;

     (A) Notwithstanding the above, a covered entity may, with the individual's consent given

in compliance with this section, operate a program in which information, products, or services sold

to the individual are discounted based on that individual's prior purchases from the covered entity;

provided that, the personal information shall be processed solely to operate such program.

     (iii) State or imply that the quality of a product or service will be diminished and shall not

actually diminish the quality of a product or service if the individual declines to give consent.

     42-162-7. Right to control disclosure of personal information.

     (a) Individuals shall have the right to know the names of third parties to which the covered

entities or data processors will disclose their personal information, and refuse consent for such

disclosure.

     (b) Disclosure of personal information and relationships with third parties.

     (1) No covered entity or data processor in possession of personal information may disclose,

cause to disclose, or otherwise disseminate to third parties, including government agencies,

personal information unless such disclosure is included in the meaningful notice pursuant to this

chapter, and consent from the individual is obtained in the manners and ways prescribed in this

chapter.

     (2) Covered entity shall not process or cause to process an individual's personal information

acquired from a third party, unless it has first obtained the individual's consent.

     (i) Notwithstanding § 42-162-7(b)(2)(i), if the processing is necessary to obtain consent,

the covered entity shall:

     (A) Process only the personal information required to request consent;

     (B) Process the personal information solely to request consent; and

     (C) Immediately delete the personal information if consent is not given.

     (3) A covered entity shall not disclose personal information to a data processor or another

third party without a contractual agreement that:

     (i) Requires the data processor or third party to meet the same privacy and security

LC003582 - Page 13 of 35

obligations as the covered entity;

     (ii) Prohibits the data processor or third party from processing the personal information for

any purpose other than the purposes for which the individual provided consent; and

     (iii) Prohibits the data processor or third party from further disclosing or processing the

personal information except as explicitly authorized by the contract and consistent with this

chapter.

     (4) If a covered entity learns that a data processor or third party to whom it has provided

access to personal information is using such personal information in violation of this chapter, the

covered entity shall immediately;

     (i) Limit the violator’s access to personal information;

     (ii) Seek proof of destruction of personal information previously accessed by the violating

data processor or third party; and

     (iii) Notify the commission about the violation.

     42-162-8. Prohibition of surreptitious surveillance.

     A covered entity shall not activate the microphone, camera, or any other sensor on a device

in the lawful possession of an individual that is capable of collecting or transmitting audio, video,

or image data or data that can be used to measure biological or biometric information, human

movement, location, chemicals, light, radiation, air pressure, speed, weight or mass, positional or

physical orientation, magnetic fields, temperature, or sound without providing notice and obtaining

consent pursuant to this chapter for the specific type of measurement to be activated; provided that,

such consent shall be effective for not more than one hundred eighty (180) days, after which it shall

expire unless renewed.

     42-162-9. Age of responsibility.

     (a) For the purposes of this chapter, individuals age thirteen (13) and older are deemed

competent to exercise all rights granted to individuals under this chapter.

     (b) Rights and obligations relating to individuals under the age of thirteen (13) shall be

governed by the children's online privacy protection act (15 U.S.C. Sec. 6501 et seq.) and its

regulations.

     42-162-10. Protection of biometric and location information.

     (a) In addition to all provisions of this chapter generally applicable to personal information,

the following provisions shall apply to the processing and collection of biometric and location

information, regardless of how such biometric and location information is processed or collected:

     (1) Processing. No covered entity or data processor may collect or process an individual's

biometric or location information unless it first:

LC003582 - Page 14 of 35

     (i) Informs the individual in writing that biometric or location information is being

processed and the specific purpose or purposes and length of time for which the information is

being processed; and

     (ii) Obtains consent from the individual for the specific purpose of collecting and

processing biometric or location information before any such information is collected or processed:

     (A) For biometric information, the consent shall be handwritten and executed by the

individual, explicitly authorize such processing, and be sent to the covered entity by postal mail,

facsimile, or electronic scan;

     (B) Consent shall be for a period specified in the written consent of not more than one year

and shall automatically expire at the end of such period unless renewed pursuant to the same

procedures. Upon expiration of consent, any biometric or location information possessed by a

covered entity must be destroyed;

     (2) Retention and destruction. A covered entity in possession of biometric or location

information must develop a specific written policy, made available to the public, establishing a

retention schedule and guidelines for permanently destroying biometric or location information

when the initial purpose for processing such information has been satisfied or within one year of

the individual's consent, unless renewed, whichever occurs first:

     (i) Absent a valid warrant issued by a court of competent jurisdiction, a covered entity in

possession of biometric or location information must comply with its established retention schedule

and destruction guidelines;

     (3) Disclosure. No covered entity or data processor in possession of biometric or location

information may disclose, cause to disclose, sell, or otherwise disseminate or cause to disseminate

to third parties, including government agencies, an individual's biometric or location information

unless:

     (i) The individual gives consent in writing to the disclosure; or

     (ii) The disclosure completes a financial transaction requested or authorized by the subject

of the biometric or location information; or

     (iii) The disclosure is required by state or federal law, in which case the individual must be

given adequate notice on the occasion of obtaining the consent; or

     (iv) The disclosure is required pursuant to a valid warrant issued by a court of competent

jurisdiction, in which case the individual must be given adequate notice in accordance with § 42-

162-17;

     (4) Monetizing. No covered entity in possession of biometric or location information may

monetize or otherwise profit from an individual's biometric or location information;

LC003582 - Page 15 of 35

     (i) A covered entity may process an individual's biometric or location information to

recommend actions, services, goods, or products provided that:

     (A) There is full disclosure to the individual about the biometric or location information

processed;

     (B) Consent was given in a manner consistent with this section; and

     (C) There is full disclosure that such recommendation is based on the biometric or location

information processed.

     42-162-11. Prohibition of discrimination.

     (a) Individual's shall have the right not to be subject to processing of their personal

information that results in unlawful discriminatory actions.

     (b) Covered entities that process personal information shall not engage in unlawful

discriminatory practices connected with the use of personal information and the provision of

services, products, or goods.

     (c) Unlawful discriminatory practices are acts or practices that:

     (1) Process personal information in the course of advertising, marketing, soliciting,

offering, selling, leasing, licensing, renting, or otherwise commercially contracting for

employment, finance, health care, credit, insurance, housing, or education opportunities in a

manner that directly results in discrimination against or otherwise makes an opportunity

unavailable on the basis of an individual's or group of individual's actual or perceived belonging to

a protected class;

     (2) Process personal information in a manner that discriminates in, or otherwise makes

unavailable, whether in a commercial transaction or otherwise, any place of public accommodation,

resort, or amusement, on the basis of an individual's or group of individual's actual or perceived

belonging to a protected class; or

     (3) Enable the use of covered entities' services or products to place targeted advertisements

for employment, finance, health care, credit, insurance, housing, or education opportunities in such

a way that enables the advertiser to determine whether to serve an advertisement to an individual

or group of individual's on the basis of actual or perceived belonging to a protected class.

     (d) Nothing in this section shall limit covered entities from processing personal information

for:

     (1) Legitimate testing to prevent unlawful discrimination or otherwise determine the extent

or effectiveness of the covered entity's compliance with this section; and

     (2) The purpose of advertising, marketing, soliciting, or offering education or employment

opportunities to members of a protected class so long as such opportunities are within an affirmative

LC003582 - Page 16 of 35

action, diversity program, or similar initiative that intends to provide opportunities to the protected

classes.

     42-162-12. Prohibition of unfair and deceptive trade practices.

     (a) Unfair and deceptive trade practices relating to information privacy are hereby declared

unlawful.

     (b) Unfair and deceptive trade practices are acts or practices that:

     (1) Materially interfere with the ability of an individual to understand the way the covered

entity processes personal information; or

     (2) Take unreasonable advantage of:

     (i) A lack of understanding on the part of the individual of the material risks, costs, or

conditions of the processing of personal information; or

     (ii) The inability of the individual to protect the interests of the individual in selecting or

using a product, good, or service provided by the covered entity; or

     (iii) The reasonable reliance by the individual on a covered entity to act in the interests of

the consumer.

     42-162-13. The Rhode Island information privacy commission.

     (a) The commission shall have all the powers necessary or convenient to carry out and

effectuate its purposes including, but not limited to, the power to:

     (1) Appoint officers and hire employees;

     (2) Establish and amend a plan of organization that it considers expedient;

     (3) Execute all instruments necessary or convenient for accomplishing the purposes of this

chapter and its regulation;

     (4) Adopt, amend, or repeal regulations for the implementation, administration, and

enforcement of this chapter;

     (5) Enter into agreements or other transactions with a person, including, but not limited to,

a governmental entity or other governmental instrumentality or authority in connection with its

powers and duties under this chapter;

     (6) Appear on its own behalf before boards, commissions, departments, or other agencies

of municipal, state, or federal government;

     (7) Apply for and accept subventions, grants, loans, advances, and contributions of money,

property, labor, or other things of value from any source, to be held, used, and applied for its

purposes;

     (8) Provide and pay for advisory services and technical assistance as may be necessary for

its judgment to carry out this chapter and fix the compensation of persons providing such services

LC003582 - Page 17 of 35

or assistance;

     (9) Prepare, publish and distribute, with or without charge as the commission may

determine, such studies, reports, bulletins, and other materials as the commission considers

appropriate;

     (10) Gather facts and information applicable to the commission's obligation to enforce this

chapter and ensure its compliance;

     (11) Conduct investigations for possible violations of this chapter;

     (12) Conduct administrative proceedings and promulgate regulations;

     (13) Refer cases for criminal prosecution to the appropriate federal, state, or local

authorities;

     (14) Maintain an official Internet website for the commission;

     (15) Conduct a study to determine the most effective way for covered entities to obtain

individuals’ consent.

     The commission may request data and information from covered entities conducting

business in Rhode Island, Rhode Island government entities administering notice and consent

regimes, consumer protection experts, privacy advocates, and researchers, Internet standards-

setting bodies such as the Internet Engineering Taskforce and Institute of Electrical and Electronics

Engineers, and other relevant sources to meet the purpose of the study;

     (16) Assess and impose civil administrative penalties on covered entities, data processors,

and third parties who fail to comply with or violate any provision of this chapter or regulation

enacted pursuant to this chapter, and create an administrative procedure for such purpose; and

     (17) Create and disseminate information to the public about their rights in relation to

personal information privacy and what to do if they believe their rights have been violated.

     42-162-14. Enforcement -- Civil administrative penalties.

     (a) Any individual or group of individual's alleging a violation of this chapter or a

regulation promulgated under this chapter may bring an administrative complaint before the

commission.

     (1) The commission shall promulgate a form of complaint for use under this section, which

shall be in such form and language to permit an individual to prepare and file such complaint pro

se.

     (2) An individual shall not be required to accept mandatory arbitration of a claim under

this chapter as a condition of bringing an administrative complaint.

     (3) The administrative complaint shall be directed against the covered entity, data

processor, and the third parties alleged to have committed the violation.

LC003582 - Page 18 of 35

     (4) The commission shall investigate the allegations and decide whether it amounts to the

imposition of a civil administrative penalty.

     (b) The commission shall also open investigations without any particular alleged violation

to assess the compliance of covered entities, data processors, and third parties with this chapter and

shall impose civil administrative penalties if necessary.

     (c) Whenever the commission seeks to assess a civil administrative penalty on any covered

entities, data processors, and third parties, the commission shall cause to be served upon such

person, either by service, in hand, or by certified mail, return receipt requested, a written notice of

its intent to assess a civil administrative penalty which shall include: a concise statement of the

alleged act or omission for which such civil administrative penalty is sought to be assessed, each

law, regulation, or order violated as a result of such alleged act or omission; the amount which the

commission seeks to assess as a civil administrative penalty for each such alleged act or omission;

a statement of such person's right to an administrative hearing on the proposed assessment; the

requirements such person must comply with to avoid being deemed to have waived the right to an

administrative hearing; and the manner of payment thereof if such person elects to pay the penalty

and waive an administrative hearing. After such notice of intent to assess a civil administrative

penalty has been given, each such day thereafter during which such noncompliance or violation

occurs or continues shall constitute a separate offense and shall be subject to a separate civil

administrative penalty if reasonable efforts have not been made to promptly come into compliance.

     (d) Whenever the commission seeks to assess a civil administrative penalty on any person,

such person shall have the right to an administrative hearing under the provisions of chapter 35 of

title 42. Such person shall be deemed to have waived such right to an administrative hearing unless,

within twenty-one (21) days of the date of the commission's notice of intent to assess a civil

administrative penalty, such person files with the commission a written statement denying the

occurrence of any of the acts or omissions alleged by the commission in such notice, or asserting

that the money amount of the proposed civil administrative penalty is excessive. In any

administrative hearing authorized pursuant to chapter 35 of title 42, the commission shall, by a

preponderance of the evidence, prove the occurrence of each act or omission alleged by the

commission.

     (e) If a person waives his/her right to an administrative hearing, the proposed civil

administrative penalty shall be final immediately upon such waiver.

     (f) If a civil administrative penalty is assessed at the conclusion of an administrative

hearing, said civil administrative penalty shall be final upon the expiration of thirty (30) days if no

action for judicial review of such decision is commenced pursuant to chapter 35 of title 42.

LC003582 - Page 19 of 35

     (g) Any person who institutes proceedings for judicial review of the final assessment of a

civil administrative penalty shall place the full amount of the final assessment in an interest-bearing

escrow account in the custody of the clerk of the reviewing court. The establishment of such an

interest-bearing escrow account shall be a condition precedent to the jurisdiction of the reviewing

court unless the party seeking judicial review demonstrates in a preliminary hearing held within

twenty (20) days of the filing of the complaint either the presence of a substantial question for

review by the court or an inability to pay. Upon such a demonstration, the court may grant an

extension or waiver of the interest-bearing escrow account or may require, in lieu of such interest-

bearing escrow account, the posting of a bond payable directly to the state in the amount of one

hundred twenty-five percent (125%) of the assessed penalty. If, after judicial review, in a case

where the requirement for an escrow account has been waived, and in cases where a bond has been

posted in lieu of such requirement, the court affirms, in whole or in part, the assessment of a civil

administrative penalty the commission shall be paid the amount thereof. If, after such review in a

case where an interest-bearing escrow account has been established, the court affirms the

assessment of such penalty, in whole or in part, the commission shall be paid the amount thereof

together with the accumulated interest thereon in such interest-bearing escrow account. If the court

sets aside the assessment of a civil administrative penalty in a case where the amount of such

penalty has been deposited in an interest-bearing escrow account, the person on whom the civil

administrative penalty was assessed shall be repaid the amount so set aside, together with the

accumulated interest thereon.

     (h) Each person who fails to pay a civil administrative penalty on time, and each person

who issues a bond pursuant to this section and who fails to pay to the state on time the amount

required hereunder, shall be liable to the state for up to three (3) times the amount of the civil

administrative penalty, together with costs, plus interest from the time the civil administrative

penalty became final and attorneys' fees, including all costs and attorneys' fees incurred directly in

the collection thereof.

     (i) No civil administrative penalty assessed hereunder shall be:

     (1) Less than fifteen hundredths percent (0.15%) of the annual global revenue of the

covered entity, data processor, or third party or fifteen thousand dollars ($15,000), whichever is

greater, per individual violation; or

     (2) More than four percent (4%) of the covered entity's annual global revenue, data

processor, or third party or twenty million dollars ($20,000,000), whichever is greater, if the

commission assesses a civil administrative penalty for multiple violations that affect multiple

individuals.

LC003582 - Page 20 of 35

     (j) In determining the amount of each civil administrative penalty, the commission shall

include, but not be limited to, the following in its consideration:

     (1) The number of affected individuals;

     (2) The severity of the violation or noncompliance;

     (3) The risks caused by the violation or noncompliance;

     (4) Whether the violation or noncompliance was part of a pattern of noncompliance and

violations and not an isolated instance;

     (5) Whether the violation or noncompliance was willful and not the result of error;

     (6) The precautions taken by the defendant to prevent a violation;

     (7) The number of administrative actions, lawsuits, settlements, and consent decrees under

this chapter involving the defendant;

     (8) The number of administrative actions, lawsuits, settlements, and consent-decrees

involving the defendant in other states and at the federal level in issues involving information

privacy; and

     (9) The international record of the defendant when it comes to information privacy issues;

     (k) Notwithstanding any general or special law to the contrary, including the limitations

and considerations set forth in this section, the commission may require that the amount of a civil

administrative penalty imposed pursuant to this section exceeds the economic benefit realized by a

person for noncompliance.

     (l) When imposing civil administrative penalties, the commission shall consider the

following:

     (1) Each individual whose personal information was unlawfully processed and each

instance of processing counts as a separate violation;

     (2) Each subsection of this chapter that was violated counts as a separate violation;

     (3) If a series of steps or transactions were component parts of a single transaction to avoid

the reach of this chapter, the commission shall disregard the intermediate steps or transactions and

consider everything one transaction.

     (m) All civil administrative penalties assessed shall be paid to the state. Once the payment

is received, the state shall:

     (1) Earmark ten percent (10%) of the civil administrative penalties collected to fund the

commission's budget; and

     (2) Identify the individuals affected by the violation and use the remaining proceeds

collected to redress and mitigate harms caused by the violation.

     42-162-15. Enforcement -- Judicial remedies.

LC003582 - Page 21 of 35

     (a) Private right of action. Any individual alleging a violation of this chapter or a regulation

promulgated under this chapter may bring a civil action in any court of competent jurisdiction.

     (1) An individual protected by this chapter may not be required, as a condition of service

or otherwise, to file an administrative complaint with the commission or to accept mandatory

arbitration of a claim under this chapter.

     (2) The civil action shall be directed to the covered entity, data processor, and the third

parties alleged to have committed the violation.

     (3) A violation of this chapter or a regulation promulgated under this chapter regarding an

individual's personal information constitutes a rebuttable presumption of harm to that individual.

     (4) In a civil action in which the plaintiff prevails, the court may award:

     (i) Liquidated damages of not less than fifteen hundredths percent (0.15%) of the annual

global revenue of the covered entity or fifteen thousand dollars ($15,000) per violation, whichever

is greater;

     (ii) Punitive damages; and

     (iii) Any other relief, including, but not limited to, an injunction that the court deems to be

appropriate.

     (5) In addition to any relief awarded pursuant to the previous subsection, the court shall

award reasonable attorneys’ fees and costs to any prevailing plaintiff.

     (6) The court may request the opinion of the commission on the matters discussed.

     (b) The attorney general may bring an action pursuant to chapter 13.1 of title 6 against a

covered entity, data processor, or third party to remedy violations of this chapter and for other relief

that may be appropriate.

     (1) If the court finds that the defendant has employed any method, act, or practice which

they knew or should have known to be in violation of this chapter, the court may require such

person to pay to the state a civil penalty of:

     (i) Not less than fifteen hundredths percent (0.15%) of the annual global revenue or fifteen

thousand dollars ($15,000), whichever is greater, per violation; and

     (ii) Not more than four percent (4%) of the annual global revenue of the covered entity,

data processor, or third party or twenty million dollars ($20,000,000), whichever is greater, per

action if such action includes multiple violations to multiple individuals;

     (2) During the proceedings, the court may also request the opinion of the commission on

the matters discussed.

     (3) All money awards shall be paid to the state. The state shall identify the individuals

affected by the violation and earmark such money awards, penalties, or assessments collected for

LC003582 - Page 22 of 35

purposes of paying for the damages they suffered as a consequence of the violation.

     (c) When calculating awards and civil penalties in all the actions in this section, a court

shall consider the factors mentioned in § 42-162-14(j).

     (d) When assessing the defendant’s behavior in judicial proceedings, the court shall

consider the factors mentioned in § 42-162-14(l).

     (e) It is a violation of this chapter for a covered entity or anyone else acting on behalf of a

covered entity to retaliate against an individual who makes a good-faith complaint that there has

been a failure to comply with any part of this chapter.

     (1) An injured individual by a violation of the previous subsection may bring a civil action

for monetary damages and injunctive relief in any court of competent jurisdiction.

     42-162- 16. Enforcement -- Miscellaneous.

     (a) Non-waivable rights. Any provision of a contract or agreement of any kind, including

a covered entity's terms of service or a privacy policy, including the short-form privacy notice

required under § 42-162-5 that purports to waive or limit in any way an individual's rights under

this chapter, including, but not limited to, any right to a remedy or means of enforcement shall be

deemed contrary to public policy and shall be void and unenforceable.

     (b) No covered entity that is a provider of an interactive computer service, as defined in 47

U.S.C. § 230, shall be treated as the publisher or speaker of any personal information provided by

another information content provider, as defined in 47 U.S.C. § 230 and allowing posting of

information by a user without other action by the interactive computer service shall not be deemed

processing of the personal information by the interactive computer service.

     (c) No private or government action brought pursuant to this chapter shall preclude any

other action under this chapter.

     42-162-17. Exceptions.

     (a) A covered entity shall not be required to provide meaningful notice or obtain consent

for processing personal information in accordance with §§ 42-162-5 and 42-162-6:

     (1) The processing is necessary to execute the specific transaction for which the individual

is providing personal information, such as the provision of financial information to complete a

purchase or the provision of a mailing address to deliver a package;

     (i) Notwithstanding the previous subsection, personal information shall not be processed

for any other purpose beyond that clear primary purpose without providing meaningful notice to

and obtaining consent from the individual to whom the personal information pertains.

     (2) The covered entity believes that an emergency involving immediate danger of death or

serious physical injury to any individual requires obtaining without delay personal information so

LC003582 - Page 23 of 35

that it can be used to respond to the emergency, and the request is narrowly tailored to address the

emergency, subject to the following limitations.

     (i) The request shall document the factual basis for believing that an emergency involving

immediate danger of death or serious physical injury to an individual requires obtaining without

delay personal information relating to the emergency; and

     (ii) Simultaneous with the covered entity obtaining personal information under this

subsection, the covered entity shall use reasonable efforts to inform the individual of the personal

information obtained; the details of the emergency; and the reasons why the covered entity needed

to obtain the personal information and shall continue such efforts to inform until receipt of

information is confirmed; or

     (3) The processing involves only de-identified information; provided that, a covered entity

that processes de-identified information must:

     (i) Have a privacy policy that details how the de-identified information is processed;

     (ii) Implement technical safeguards that prohibit indirect re-identification of the

information;

     (iii) Implement business processes that expressly prohibit indirect re-identification of the

information;

     (iv) Implement business processes that prevent inadvertent release of de-identified

information; and

     (v) Not attempt to re-identify the information.

     (b) A covered entity, its affiliated data processors, or the third parties they contracted with

shall not be required to obtain consent for disclosing or sharing personal information in accordance

with this chapter if:

     (1) Disclosure is required to respond to a legal request; provided that:

     (i) A covered entity receiving such legal request shall serve or deliver the following

information to the individual to which the legal request for personal information refers by registered

or first-class mail, electronic mail, or other means reasonably calculated to be effective:

     (A) A copy of the legal request and a notice that informs the individual of the nature of the

inquiry with reasonable specificity;

     (B) That personal information related to the individual was supplied to, or requested by, a

requesting entity and the date on which the supplying or request took place;

     (C) An inventory of the personal information requested or supplied;

     (D) Whether the information was in possession of the covered entity, an affiliate data

processor, or a third party they contracted with; and

LC003582 - Page 24 of 35

     (E) The identity of the person that sought the legal request from the court, if known.

     (ii) The covered entity shall serve or deliver such notification immediately upon receiving

a legal request asking for or compelling the disclosure of personal information; provided that, a

covered entity may apply to the court for an order delaying notification. The court may issue the

order if notification of the existence of the legal request will result in danger to the life or physical

safety of an individual, flight from prosecution, destruction of or tampering with evidence, or

intimidation of potential witnesses, or otherwise seriously jeopardize an investigation or unduly

delay a trial.

     (A) If granted, such an order shall not exceed thirty (30) days, but may be renewed up to

thirty (30) days at a time while grounds for the delay persist.

     (B) The disclosure is a routine disclosure required by state or federal law; provided that,

the individual received notice of such requirement in accordance with §§ 42-162-4 and 42-162-6.

     42-162-18. Transparency.

     (a) Covered entities that receive any form of a legal request for disclosure of personal

information pursuant to this chapter shall:

     (1) Provide the commission and the general public a bi-monthly report containing the

following aggregate information related to legal requests received by the covered entity, their

affiliated data processors, and any third parties they contracted with:

     (i) The total number of legal requests, disaggregated by type of requests such as warrants,

court orders, and subpoenas;

     (ii) The number of legal requests that resulted in the covered entity disclosing personal

information;

     (iii) The number of legal requests that did not result in the covered entity disclosing

personal information, including the reasons why the information was not disclosed;

     (iv) The type of personal information sought in the legal requests received by the covered

entity;

     (v) The total number of legal requests seeking the disclosure of location or biometric

information;

     (vi) The number of legal requests that resulted in the covered entity disclosing location or

biometric information;

     (vii) The number of legal requests that did not result in the covered entity disclosing

location or biometric information, including the reasons for such disclosure; and

     (viii) The nature of the proceedings from which the requests were ordered and whether it

was a government entity or a private person seeking the legal request;

LC003582 - Page 25 of 35

     (2) Take all reasonable measures and engage in all legal actions available to ensure that the

legal request is valid under applicable laws and statutes; and

     (3) Require their affiliate data processors and third parties they contracted with to have

similar practices and standards.

     (b) Covered entities that are required to disclose personal information as a matter of law

pursuant to § 42-162-17(b) shall provide the commission and the general public a bi-monthly report

containing the following aggregate information:

     (1) The total number of times that they share information, disaggregated by:

     (i) Applicable law or statute that mandates such disclosure;

     (ii) Government entity or private party that received the information; and

     (iii) The type of personal information disclosed.

     (2) The total number of individuals affected by such disclosures, disaggregated by race,

ethnicity, gender, and age, if such demographics are known.

     (c) The commission shall:

     (1) Establish a standardized reporting form to comply with this section;

     (2) Determine whether a more concise presentation of the reporting is appropriate and, if

so, shall establish a standardized version of such form;

     (3) Dedicate a section of its website to making the reports available to the general public;

and

     (4) Promulgate regulations specifying additional requirements for purposes of advancing

information related to the sharing of information with the government.

     42-162-19. Non-applicability.

     This chapter shall not apply to:

     (1) Personal information captured from a patient by a health care provider or health care

facility or biometric information collected, processed, used, or stored exclusively for medical

education or research, public health or epidemiological purposes, health care treatment, insurance,

payment, or operations under the federal Health Insurance Portability and Accountability Act of

1996, or to X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or

other image or film of the human anatomy used exclusively to diagnose, prognose, or treat an illness

or other medical condition or to further validate scientific testing or screening;

     (2) Individuals sharing their personal contact information such as email addresses with

other individuals in the workplace, or other social, political, or similar settings where the purpose

of the information is to facilitate communication among such individuals; provided that, this

chapter shall cover any processing of such contact information beyond interpersonal

LC003582 - Page 26 of 35

communication.

     (3) Covered entities' publication of entity-based member or employee contact information

where such publication is intended to allow members of the public to contact such member or

employee in the ordinary course of the entity's operations.

     42-162-20. Relationship with other laws.

     (a) The provisions of this chapter shall supersede local or state laws, regulations, and

ordinances, except when such local or state laws, regulations, or ordinances provide stronger

privacy protections for individuals.

     (b) This chapter covers businesses that are subject to federal laws concerning the

processing of individuals' personal information to the extent that this chapter provides stronger

privacy protections for individuals than those federal laws; and those federal laws do not explicitly

preempt state laws.

     (c) Nothing in this chapter shall diminish any individual's rights or obligations under any

other applicable law.

     42-162-21. The Rhode Island information privacy commission.

     (a) There shall be a Rhode Island information privacy commission to have general

supervision and sole regulatory and enforcement authority over chapter 162 of title 42.

     (b) The commission shall consist of five (5) commissioners: one of whom shall be

appointed by the governor; one of whom shall be appointed by the attorney general; one of whom

shall be appointed by the secretary of state; and two (2) of whom shall be appointed by a majority

vote of the governor, attorney general and secretary of state, with the advice and consent of the

senate. The secretary of state shall designate the chair of the commission. The chair shall serve in

that capacity throughout the term of appointment and until a successor shall be appointed.

     (c) All commissioners must have a background in one or more of the following:

     (1) Information privacy, technology, and the law;

     (2) Social implications of artificial intelligence and digital equity;

     (3) Data science and data surveillance; or

     (4) Digital services, digital markets, and consumer protection of digital data.

     (d) Prior to appointment to the commission, a background investigation shall be conducted

into the financial stability, integrity, and responsibility of a candidate, including the candidate’s

reputation for good character and honesty.

     (e) Each commissioner shall be a resident of the state within ninety (90) days of

appointment and, while serving on the commission, shall not:

     (1) Hold, or be a candidate for, federal, state, or local elected office;

LC003582 - Page 27 of 35

     (2) Hold an appointed office in a federal, state or local government; or

     (3) Serve as an official in a political party. Not more than three (3) commissioners shall be

from the same political party.

     (f) Each commissioner shall serve for a term of five (5) years or until a successor is

appointed and shall be eligible for reappointment; provided, however, that no commissioner shall

serve more than ten (10) years. A person appointed to fill a vacancy in the office of a commissioner

shall be appointed in a like manner and shall serve for only the unexpired term of that

commissioner.

     (g) The secretary of state, the governor or the attorney general may remove a commissioner

who was appointed by that appointing authority if the commissioner:

     (1) Is guilty of malfeasance in office;

     (2) Substantially neglects the duties of a commissioner;

     (3) Is unable to discharge the powers and duties of the office;

     (iv) Commits gross misconduct; or

     (v) Is convicted of a felony.

     (h) The secretary of state, the governor and the attorney general may, by majority vote,

remove a commissioner who was appointed by a majority vote of the secretary of state, the governor

and the attorney general if the commissioner:

     (1) Is guilty of malfeasance in office;

     (2) Substantially neglects the duties of a commissioner;

     (3) Is unable to discharge the powers and duties of the commissioner’s office;

     (4) Commits gross misconduct; or

     (5) Is convicted of a felony.

     (i) Before removal, the commissioner shall be provided with a written statement of the

reason for removal and an opportunity to be heard.

     (j) Three (3) commissioners shall constitute a quorum, and the affirmative vote of three (3)

commissioners shall be required for an action of the commission. The chair or three (3) members

of the commission may call a meeting; provided, however, that notice of all meetings shall be given

to each commissioner and to other persons who request such notice. The commission shall adopt

regulations establishing procedures, which may include electronic communications, by which a

request to receive notice shall be made and the method by which timely notice may be given.

     (k) Commissioners shall receive reasonable salaries. Commissioners shall devote their full

time and attention to the duties of their office.

     (l) The commission shall annually elect one of its members to serve as secretary and one

LC003582 - Page 28 of 35

of its members to serve as treasurer. The secretary shall keep a record of the proceedings of the

commission and shall be the custodian and keeper of the records of all books, documents, and

papers filed by the commission and of its minute book. The secretary shall cause copies to be made

of all minutes and other records and documents of the commission and shall certify that such copies

are true copies, and all persons dealing with the commission may rely upon such certification.

     (m) The chair shall have and exercise supervision and control over all the affairs of the

commission. The chair shall preside at all hearings at which the chair is present and shall designate

a commissioner to act as chair in the chair's absence. To promote efficiency in administration, the

chair shall make such division or re-division of the work of the commission among the

commissioners as the chair deems expedient.

     (n) The commissioners shall, if so directed by the chair, participate in the hearing and

decision of any matter before the commission; provided, however, that at least two (2)

commissioners shall participate in the hearing and decision of matters other than those of formal or

administrative character coming before the commission; and provided further, that any such matter

may be heard, examined and investigated by an employee of the commission designated and

assigned by the chair, with the concurrence of one other commissioner. Such employee shall make

a report in writing relative to the hearing, examination, and investigation of every such matter to

the commission for its decision. For the purposes of hearing, examining, and investigating any such

matter, such employee shall have all of the powers conferred upon a commissioner by this section.

For each hearing, the concurrence of a majority of the commissioners participating in the decision

shall be necessary.

     (o) The commission shall appoint an executive director. The executive director shall serve

at the pleasure of the commission, shall receive such salary as may be determined by the

commission, and shall devote full-time and attention to the duties of the office. The executive

director shall be a person with skill and experience in management, shall be the executive and

administrative head of the commission, and shall be responsible for administering and enforcing

the law relative to the commission and each administrative unit thereof. The executive director shall

appoint and employ a chief financial and accounting officer and may, subject to the approval of the

commission, employ other employees, consultants, agents, and advisors, including legal counsel,

and shall attend meetings of the commission. The chief financial and accounting officer of the

commission shall be in charge of its funds, books of account, and accounting records. No funds

shall be transferred by the commission without the approval of the commission and the signatures

of the chief financial and accounting officer and the treasurer of the commission. In the case of an

absence or vacancy in the office of the executive director or in the case of disability, as determined

LC003582 - Page 29 of 35

by the commission, the commission may designate an acting executive director to serve as

executive director until the vacancy is filled or the absence or disability ceases. The acting executive

director shall have all of the powers and duties of the executive director and shall have similar

qualifications as the executive director.

     (p) Chapter 14 of title 36 shall apply to the commissioners and to employees of the

commission; provided, however, that the commission shall establish a code of ethics for all

members and employees that shall be more restrictive than chapter 14 of title 36. A copy of the

code shall be filed with the state ethics commission. The code shall include provisions reasonably

necessary to carry out the purposes of this section and any other laws subject to the jurisdiction of

the commission including, but not limited to:

     (1) Prohibiting the receipt of gifts by commissioners and employees from any entity subject

to the jurisdiction of the commission;

     (2) Prohibiting the participation by commissioners and employees in a particular matter as

defined in § 36-14-5 that affects the financial interest of a relative within the third degree of

consanguinity or a person with whom such commissioner or employee has a significant relationship

as defined in the code; and

     (3) Providing for recusal of a commissioner in a decision due to a potential conflict of

interest.

     (q) The commission shall, for the purposes of compliance with state finance law, operate

as a state agency and shall be subject to the laws applicable to agencies under the control of the

governor; provided, however, that the comptroller may identify any additional instructions or

actions necessary for the commission to manage fiscal operations in the state accounting system

and meet statewide and other governmental accounting and audit standards. The commission shall

properly classify the commission's operating and capital expenditures and shall not include any

salaries of employees in the commission's capital expenditures. Unless otherwise exempted by law

or the applicable central service agency, the commission shall participate in any other available

state central services including, but not limited to, the state payroll system pursuant to chapter 13.1

of title 6, and may purchase other goods and services provided by state agencies in accordance with

comptroller provisions. The comptroller may chargeback the commission for the transition and

ongoing costs for participation in the state accounting and payroll systems and may retain and

expend such costs without further appropriation for the purposes of this section.

     42-162-22. Funding.

     It is hereby appropriated, out of any money in the treasury not otherwise appropriated for

the fiscal year 2022-2023, the sum of seven hundred fifty thousand dollars ($750,000) for the Rhode

LC003582 - Page 30 of 35

Island information privacy commission for the supervision, regulation and enforcement over

chapter 162 of title 42. The state controller is hereby authorized and directed to draw his/her orders

upon the general treasurer for the payment of said sum, or so much thereof as may be from time to

time required, upon receipt by him/her of properly authenticated vouchers.

     42-162-23. Workplace surveillance.

     (a) For the purposes of this section, the following words shall have the following meanings

unless the context clearly requires otherwise:

     (1) "Electronic monitoring" means the collection of information concerning employee

activities, communications, actions, biometrics, or behaviors by electronic means.

     (2) "Employment-related decision" means any decision made by the employer that affects

wages, benefits, hours, work schedule, performance evaluation, hiring, discipline, promotion,

termination, job content, productivity requirements, workplace health and safety, or any other terms

and conditions of employment.

     (3) "Facial recognition technology" shall have the meaning an automated or semi-

automated process that assists in identifying or verifying an individual or capturing information

about an individual based on the physical characteristics of an individual's face, head or body, that

uses characteristics of an individual's face, head or body to infer emotion, associations, activities

or the location of an individual.

     (4) "Information" also referred to as "employee information," or "data" means information

that identifies, relates to, describes, is reasonably capable of being associated with, or could

reasonably be linked, directly or indirectly, with a particular employee, regardless of how the

information is collected, inferred, or obtained.

     (5) "Vendor" means a business engaged in a contract with an employer to provide services,

software, or technology that collects, stores, analyzes, or interprets employee information.

     (b) An employer, or vendor acting on behalf of an employer, shall not electronically

monitor an employee unless:

     (1) The electronic monitoring only purpose is to;

     (i) Enable tasks that are necessary to accomplish essential job functions;

     (ii) Monitor production processes or quality;

     (iii) Comply with employment, labor, or other relevant laws;

     (iv) Protect the safety and security of employees; or

     (v) Carry on other purposes as determined by the department of labor standards; and

     (2) The specific form of electronic monitoring is:

     (i) Necessary to accomplish the allowable purpose;

LC003582 - Page 31 of 35

     (ii) The least invasive means that could reasonably be used to accomplish the allowable

purpose;

     (iii) Limited to the smallest number of employees; and

     (iv) Collecting the least amount of information necessary to accomplish the purposes

mentioned in subsection (b)(1) of this section.

     (c) Notwithstanding § 42-162-23(b), the following practices shall be prohibited:

     (1) Use of electronic monitoring that either directly or indirectly harms an employee's

physical health, mental health, personal safety or wellbeing;

     (2) Monitoring of employees who are off-duty and not performing work-related tasks;

     (3) Audio-visual monitoring of bathrooms or other similarly private areas including locker

rooms and changing areas;

     (4) Audio-visual monitoring of break rooms, lounges, and other social spaces, except to

investigate specific illegal activity;

     (5) Use of facial recognition technology other than for the purpose of verifying the identity

of an employee for security purposes; and

     (6) Any other forms of electronic monitoring such as may be prohibited by the department

of labor standards.

     (d) Employers shall not require employees to install applications on personal or mobile

devices that collect employee information or require employees to wear data-collecting devices,

including those that are incorporated into items of clothing or personal accessories, unless the

electronic monitoring is necessary to accomplish essential job functions and is narrowly limited to

only the activities and times necessary to accomplish essential job functions.

     (e) Information resulting from electronic monitoring shall be accessed only by authorized

agents and used only for the purpose and duration for which notice was given in accordance with

subsection (f) of this section.

     (f) Employers shall provide employees with notice that electronic monitoring will occur

prior to conducting each specific form of electronic monitoring. The notice must, at a minimum,

include a description of;

     (1) The purpose that the specific form of electronic monitoring is intended to accomplish,

as specified in § 42-162-23(b);

     (2) The specific activities, locations, communications, and job roles that will be

electronically monitored;

     (3) The technologies used to conduct the specific form of electronic monitoring;

     (4) The vendors or other third parties that the information collected through electronic

LC003582 - Page 32 of 35

monitoring will be disclosed or transferred to, including the name of the vendor and the purpose

for the data transfer;

     (5) The organizational positions that are authorized to access the information collected

through the specific form of electronic monitoring, and under what conditions; and

     (6) The dates, times, and frequency that electronic monitoring will occur.

     (g) Employers shall provide employees with notice that electronic monitoring will occur

prior to conducting each specific form of electronic monitoring and the notice must, at a minimum,

include the names of any vendors conducting electronic monitoring on the employer’s behalf.

     (h) Employers shall provide employees with notice that electronic monitoring will occur

prior to conducting each specific form of electronic monitoring and the notice must, at a minimum,

include an explanation of:

     (1) The reasons why the specific form of electronic monitoring is necessary to accomplish

the purpose; and

     (2) How the specific monitoring practice is the least invasive means available to

accomplish the allowable monitoring purpose.

     (i) The notice provided for in § 42-162-23(f) shall be clear and conspicuous and provide

the employee with actual notice of electronic monitoring activities.

     (1) A notice that provides electronic monitoring "may" take place or that the employer

"reserves the right" to monitor shall not suffice.

     (j) An employer who engages in random or periodic electronic monitoring of employees

will inform the affected employees of the specific events which are being monitored at the time the

monitoring takes place with a notice that shall be clear and conspicuous.

     (1) Notwithstanding the previous subsection, notice of random or periodic electronic

monitoring may be given after electronic monitoring has occurred only if necessary to preserve the

integrity of an investigation of wrongdoing or protect the immediate safety of employees,

customers, or the public.

     (k) An employer shall only use employee information collected through electronic

monitoring to accomplish its purpose, unless the information documents illegal activity.

     (l) When making a hiring or employment-related decision using information collected

through electronic monitoring, an employer shall:

     (1) Not make the decision based solely on such information;

     (2) Give the affected employee access to the data and provide an opportunity to correct or

explain it;

     (3) Corroborate such information by other means, such as independent documentation by

LC003582 - Page 33 of 35

supervisors or managers, or by consultation with other employees; and

     (4) Document and communicate to affected employees the basis for the corroboration prior

to the decision going into effect.

     (m) Section 42-162-23(k) shall not apply to those cases when electronic monitoring data

provides evidence of illegal activity.

     42-162-24. Severability.

     Should any provision of this chapter or part hereof be held under any circumstances in any

jurisdiction to be invalid or unenforceable, such invalidity or unenforceability shall not affect the

validity or enforceability of any other provision of this or other parts of this chapter.

     SECTION 2. This act shall take effect on January 1, 2023, except for the appropriation

contained in § 42-162-22 which shall take effect upon passage.

========

LC003582

========

LC003582 - Page 34 of 35

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO STATE AFFAIRS AND GOVERNMENT – RHODE ISLAND

INFORMATION PRIVACY ACT

***

     This act would create the Rhode Island information privacy act. This act would allow an

individual to access and learn what personal information about the individual has been gathered

and stored by covered entities that conduct business in Rhode Island. The act would also establish

the Rhode Island information privacy commission to oversee and enforce the provisions of the

Rhode Island information privacy act.

     This act would take effect on January 1, 2023, except for the appropriation contained in §

42-162-22, which would take effect upon passage.

========

LC003582

========

LC003582 - Page 35 of 35