Establishes a new chapter for privacy protections for location information derived from electronic devices. DBR would be responsible for promulgating rules and regulations to implement administer and enforce this chapter.
H6062 creates a new Rhode Island law chapter governing the collection, processing, disclosure, and monetization of location information derived from electronic devices. The bill defines location information broadly to include data such as GPS coordinates, IP addresses capable of revealing location, and cell-site location information, and it applies to most private covered entities while excluding government agencies, courts, and individuals acting in a non-commercial context.
Under the bill, a covered entity may collect or process location information only for a listed permissible purpose and generally must provide a location privacy policy and obtain opt-in consent before doing so. The bill also requires purpose-specific consent, limits retention and precision of data, prohibits sale or leasing of location data, restricts disclosure to third parties and government entities, and requires clear opt-out rights for targeted advertising. Consent expires after one year, when the purpose is complete, or when revoked, and data must then be permanently destroyed. The bill also bars retaliation against individuals who exercise their rights and voids contractual waivers of those rights.
The bill would add a new chapter to Title 6 of the General Laws and place significant new compliance obligations on businesses and other covered entities that handle location data. It would require privacy policies, consent procedures, deletion practices, and annual reporting to the Department of Business Regulation, which is assigned rulemaking, investigative, and administrative responsibilities under the act. It also creates a private right of action in superior court or other competent court, with statutory damages, emotional distress damages, punitive damages, attorneys’ fees, and injunctive relief available for violations. Healthcare-related location data protected by HIPAA and certain public health, treatment, payment, and research uses are excluded from the chapter.
The available record shows no committee transcript, vote tally, or recorded floor debate, so there is no direct evidence of support or opposition from the legislative process. Based on the bill text, the measure is framed as a consumer privacy and data-protection bill, suggesting a generally privacy-protective policy approach. The absence of recorded votes or discussion means sentiment cannot be measured from legislative history in the provided materials.
The main points of potential contention are the bill’s broad restrictions on commercial use of location data, especially the ban on selling, renting, trading, or leasing location information and the limits on targeted advertising. Businesses that rely on location data for analytics, advertising, authentication, or service delivery may view the consent, deletion, and reporting requirements as burdensome, while privacy advocates are likely to support them. Another likely area of dispute is the strong enforcement scheme, including a private right of action, statutory damages, and invalidation of contractual waivers, which increases litigation exposure for covered entities.