1. What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

Rhode Island does not specifically regulate CBD oil in products to be sold to the public. However, R.I. Gen. Laws Section 2-26-1 et seq. (“Hemp Growth Act”) allows for the growth, sale and regulation of industrial hemp products, which includes any oils and substances collected from the plant. Only licensed cultivators may sell products containing CBD oil harvested from marijuana, and they may only sell these products to registered Rhode Island compassion centers. 230 R.I.C.R. 80-05-1.7(B). Otherwise, CBD may be sold legally to consumers pursuant to 2014 federal farming law.

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

Rhode Island passed the Identity Theft Protection Act in 2015. The Act requires all persons and municipalities that collect personal information from Rhode Island residents to implement a risk-based information security program. RI ST § 11-49.3-2. 216-RICR- 10-10-6.3 is the latest privacy regulation that was passed in August, 2018. This implemented the voluntary Health Information Exchange, and confidential information can only be accessed, released, or exchanged through this system; the Regional Health Information Organization develops policies and procedures relating to this regulation. 216-RICR- 10-10-6.3. Otherwise, no other laws have been passed in the state.