Rhode Island General Laws Title 6. Commercial Law--General Regulatory Provisions § 6-48.1-4. Processing of information

(a) This section shall apply to for-profit entities that conduct business in the state or for-profit entities that produce products or services that are targeted to residents of the state and that during the preceding calendar year did any of the following:

(b) The controller shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data.

(c) The controller shall not process sensitive data concerning a customer without obtaining customer consent and shall not process sensitive data of a known child unless consent is obtained and the information is processed in accordance with COPPA.  Controllers and processors that comply with the verifiable parental consent requirements of the Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) shall be deemed compliant with any obligation to obtain parental consent under this chapter.

(d) The controller shall not process personal data in violation of the laws of this state and federal laws that prohibit unlawful discrimination against customers.

(e) The controller shall provide customers with a mechanism to grant and revoke consent where consent is required.  Upon receipt of revocation, the controller shall suspend the processing of data as soon as is practicable.  The controller shall have no longer than fifteen (15) days from receipt to effectuate the revocation.