Processes personal data, in Vermont

18 V.S.A. sec. 9334; sec. 9335(a), (b) · Read the law's page

• If you offer or issue insurance in Vermont (a policy regulated under title 8, including health, life, disability and long-term care policies, hospital and medical service corporation contracts and health maintenance organization benefit plans), do not underwrite a policy or condition it on any requirement or agreement of the individual to undergo genetic testing, or on the results of genetic testing of a member of the individual's family. Section 9332(b) allows insurance genetic testing only within the limits of section 9334.

18 V.S.A. secs. 9331, 9332, 9335(b) · Read the law's page

• Do not perform genetic testing on an individual, or release bodily materials for genetic testing, without the individual's prior written authorization and informed consent, except where section 9332(b) allows testing (to establish parentage, for newborn screening, in a criminal investigation or prosecution, for remains identification, or for the State DNA data bank) or for medical research where the subject's identity is unknown or protected as section 9332(d) requires.
• Disclose the results of genetic testing, or the fact that an individual requested genetic services or underwent genetic testing, only under a written authorization executed by the individual tested or by a person authorized by law to act for the individual, except in the cases section 9332(b) lists.
• When you suggest or request that an individual consent to genetic testing, advise the individual that the results may become part of the individual's permanent medical record and may be material to the ability to obtain certain insurance benefits.
• Do not use samples collected under section 9332(b)(1) to (4) or collected voluntarily by agreement for any purpose in connection with the State DNA data bank, the State DNA database or CODIS, unless chapter 113, subchapter 4 of title 20 specifically authorizes it.

9 V.S.A. sec. 2435 · Read the law's page

• Notify an affected Vermont consumer of a security breach in the most expedient time possible and without unreasonable delay, and no later than 45 days after discovery.
• Notify the Attorney General or the Department of Financial Regulation, as applicable, of the date of the breach and the date of discovery, with a preliminary description of the breach, within 14 business days of discovering the breach or when you notify consumers, whichever is sooner (unless, having sworn to the Attorney General in writing before the breach that you maintain written security policies and procedures, you notify the Attorney General before notifying consumers).

9 V.S.A. § 2445 (Added 2005, No. 162 (Adj. Sess.), § 1, eff. Jan. 1, 2007) · Read the law's page

• This binds a business, any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not organized to operate at a profit, including a financial institution, but never the State, a State agency or a political subdivision of the State; a customer's personal information covered is a signature, Social Security number, physical description, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or other financial information.
• Take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information once the business no longer retains them, by shredding, erasing or otherwise modifying the information to make it unreadable or indecipherable through any means.
• An entity in the business of disposing of personal financial information on another business's behalf must implement and monitor policies and procedures that protect against unauthorized access to or use of the information during and after its collection, transportation and disposal.
• This duty applies to disposal only; it does not itself require safeguarding personal information that remains in active use, and it exempts a Gramm-Leach-Bliley-compliant financial institution, a HIPAA-compliant health insurer or facility, and an FCRA-compliant consumer reporting agency.
• A violation is investigated and prosecuted by the Attorney General or a State's Attorney, who may seek remedies under the Consumer Protection Act including a civil penalty of up to $10,000.00 for each violation, or by the Department of Financial Regulation for a business it licenses or registers, which acts under its own Title 8 and Title 9 powers; the section does not itself state whether a violation carries a private right of action.

9 V.S.A. sec. 2440 · Read the law's page

• If you are a business, do not intentionally communicate or otherwise make available to the general public an individual's Social Security number, or intentionally print or imbed it on a card the individual needs to access your products or services.
• Do not require an individual to transmit his or her Social Security number over the Internet unless the connection is secure or the number is encrypted, and do not require an individual to use his or her Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required.
• Do not print an individual's Social Security number on materials mailed to the individual unless State or federal law requires it on the document, and where one may be mailed, do not print it in whole or in part on a postcard or other mailer not requiring an envelope or make it visible on an envelope without the envelope having been opened.
• Do not sell, lease, lend, trade, rent or otherwise intentionally disclose an individual's Social Security number to a third party without the individual's written consent when you know, or with reasonable diligence would have reason to believe, that the third party lacks a legitimate purpose for obtaining it.
• If you use an individual's Social Security number in a manner subsection (b) bars, and you had used it that way before January 1, 2007, keep the use continuous, give the individual an annual disclosure of the right to stop it, and carry out a written request to stop within 30 days at no charge and without denying services, as section 2440(c)(8) requires for the grandfathered use.

9 V.S.A. sec. 2431(a) · Read the law's page

• This binds any person, not only a data broker: do not acquire brokered personal information (as section 2430 defines the term) through fraudulent means.
• Do not acquire or use brokered personal information for the purpose of stalking or harassing another person, committing a fraud (including identity theft, financial fraud or email fraud), or engaging in unlawful discrimination (including employment discrimination and housing discrimination).

9 V.S.A. sec. 2447 · Read the law's page

• If you are a data broker (as section 2430 defines the term in each version), the duty in section 2447 reads the same before and from January 1, 2027: the only change in section 2447's own text on that date is that the Attorney General's rulemaking authority in subdivision (d)(2) refers to the provisions of the section where it referred to the provisions of the chapter. The definitions the duty relies on do change on that date: section 2430 rewrites the definition of data broker, and rewrites personally identifiable information so that it excludes all publicly available information (until then it excluded only publicly available information lawfully made available from government records) and does not require a name where any listed data element is sufficient to perform or attempt identity theft against the consumer. Develop, implement and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to the size, scope and type of your business, your resources, the amount of data you store and the need for security and confidentiality of personally identifiable information.
• Adopt safeguards in the program that are consistent with the safeguards for protection of personally identifiable information and information of a similar character set forth in other State rules or federal regulations that apply to you.
• At minimum, designate one or more employees to maintain the program; identify and assess reasonably foreseeable internal and external risks to the security, confidentiality and integrity of paper, electronic and other records containing personally identifiable information, with a process for evaluating and improving the safeguards, including ongoing employee training (temporary and contract employees included), employee compliance with policies and procedures, and means for detecting and preventing security system failures.
• At minimum, have security policies for employees on the storage, access and transportation of records containing personally identifiable information outside business premises, disciplinary measures for violations of the program's rules, measures that prevent terminated employees from accessing those records, and reasonable restrictions on physical access to those records and on their storage in locked facilities, storage areas or containers.
• At minimum, supervise service providers: take reasonable steps to select and retain third-party providers capable of maintaining appropriate security measures consistent with applicable law, and require them by contract to implement and maintain appropriate security measures for personally identifiable information.
• At minimum, monitor regularly that the program operates in a manner reasonably calculated to prevent unauthorized access to or use of personally identifiable information, upgrade safeguards as necessary, and review the scope of the security measures at least annually or whenever there is a material change in business practices that may reasonably implicate the security or integrity of those records.
• At minimum, document the responsive actions you take in connection with any incident involving a breach of security, and carry out a mandatory post-incident review of events and actions taken, making changes in business practices relating to protection of personally identifiable information where needed.
• To the extent technically feasible, include secure user authentication protocols; secure access controls that restrict access to those who need the information for their job duties and give each person with computer access a unique identification and a password that is not a vendor-supplied default; encryption of records and files containing personally identifiable information that travel across public networks or are transmitted wirelessly, and of such information stored on laptops or other portable devices (or a protocol that provides a higher level of security); reasonable monitoring of systems for unauthorized use or access; up-to-date firewall protection and operating system security patches for files on an Internet-connected system; up-to-date system security agent software with malware protection; and employee education and training on the proper use of the computer security system and the importance of personally identifiable information security.

9 V.S.A. secs. 2430 and 2446 · Read the law's page

• If you are a data broker (a business that knowingly collects and sells or licenses to third parties the brokered personal information of Vermont residents with whom you have no direct relationship), register with the Secretary of State and pay the $100.00 registration fee on or before January 31 of each year following a year in which you meet that definition.
• In the registration, give your name and primary physical, email and internet addresses, and say whether you implement a purchaser credentialing process.
• In the registration, give the number of data broker security breaches you experienced during the prior year and, if known, the total number of consumers affected.
• If you permit a consumer to opt out of your collection of brokered personal information, of your databases or of certain sales, state in the registration the method for requesting the opt-out, which activities or sales it covers if it covers only certain ones, and whether a consumer may authorize a third party to opt out for them.
• Whether or not you offer an opt-out, state in the registration the data collection, databases or sales activities from which a consumer may not opt out.
• If you have actual knowledge that you possess the brokered personal information of minors, give a separate statement of the data collection practices, databases, sales activities and opt-out policies that apply to it.
• You are not a data broker for developing or maintaining third-party e-commerce or application platforms, for providing directory assistance or directory information services for a telecommunications carrier, or for providing publicly available information related to a consumer's business or profession or via real-time or near-real-time alert services for health or safety purposes, and a one-time or occasional sale of assets in a transfer of control, or a sale or license of data that is merely incidental to the business, is not selling or licensing.

9 V.S.A. secs. 2421a to 2421d; 2026 Vt. Acts & Resolves Act 135 · Read the law's page

• If you are a direct-to-consumer genetic testing company (you sell or market consumer-initiated genetic testing products or services directly to Vermont consumers, analyze genetic data obtained from a consumer other than through a person licensed in the healing arts for diagnosis or treatment, or collect, use, maintain or disclose genetic data from such a product or service), give Vermont consumers a plain-language summary of your privacy practices and a prominent, easily accessible privacy notice covering your data collection, consent, use, access, disclosure, maintenance, transfer, security, and retention and deletion practices, plus a notice that deidentified genetic or phenotypic information may be shared with third parties for research.
• Obtain a consumer's express consent, in response to a clear, meaningful and prominent notice and never by inaction or through a dark pattern, for the collection, use and disclosure of the consumer's genetic data, with separate and express consent for each use of the data (including who has access to it, how it may be shared and the specific purposes), for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer or disclosure to a third party other than a service provider (naming the third party and the purpose), and for marketing or facilitating marketing based on the data. You may not require consent to a third-party transfer as a condition of the services ordered.
• Give a consumer a way to withdraw consent that is at least as easy as the way the consumer gave it, at least one of them through your primary medium of communication. Honor a revocation as soon as practicable and no later than 30 days after it, and destroy the consumer's biological sample no later than 30 days after a revocation related to its storage or use.
• Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure.
• Develop procedures and practices that let a consumer easily access the consumer's genetic data, delete the consumer's account and genetic data (except data you must retain to comply with legal and regulatory requirements), and have the consumer's biological sample destroyed, and within 30 days of such a request tell every third party, including service providers, that received the data or sample to delete or destroy it.
• Do not store genetic data or biological samples of consumers in a country sanctioned by the Office of Foreign Assets Control or designated a foreign adversary, and transfer or store them outside the United States only with the consumer's express consent.
• Bind each service provider by contract not to retain, use or disclose the biological sample, genetic data or any information about the consumer's identity for a commercial purpose other than the contracted services, and not to associate or combine them with information it receives from or collects for others. The service provider must destroy all genetic data it retained immediately when the contract ends, and may not disclose, transfer or sell it before destroying it.
• Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment, or to an entity that advises one, and do not disclose any information about a consumer to a government entity without a search warrant issued by a court on a finding of probable cause, or unless the consumer gives express consent after being notified by you.
• If you are a person or a public entity, do not discriminate against a consumer for exercising rights under the subchapter by denying goods, services or benefits, charging different prices or rates, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing.

9 V.S.A. sec. 2431(b), (c); 2026 Vt. Acts & Resolves Act 138, Sec. 1 · Read the law's page

• If you are a data broker (as section 2430 defines the term from January 1, 2027), maintain procedures that require each prospective user of your brokered personal information to identify themselves, state the purposes for which the information is sought, and certify that the information shall be used for no other purpose.
• Before you disclose brokered personal information to a prospective user, make a reasonable effort to verify the identity of the prospective user and review the user's stated purposes.
• Do not disclose brokered personal information to a prospective user if you have reasonable grounds for believing that the information will be used to violate State or federal law or will not be used for the purposes the user stated.

9 V.S.A. sec. 2436 · Read the law's page

• If you are a data broker, notify each consumer affected by a data broker security breach in the most expedient time possible and without unreasonable delay, and not later than 45 days after discovery or notification, consistent with the needs of law enforcement and with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security and confidentiality of the data system.
• Notify the Attorney General of the date of the breach and the date of discovery and provide a preliminary description of the breach within 14 business days after discovery, and when you notify consumers tell the Attorney General the number of Vermont consumers affected, if known, and give it a copy of the consumer notice.
• You need not give notice if you establish that misuse of the brokered personal information is not reasonably possible and give the Attorney General notice of that determination with a detailed explanation. If you later obtain facts indicating that misuse has occurred or is occurring, give the notice section 2436(b) requires.

9 V.S.A. secs. 2430, 2446; 2026 Vt. Acts & Resolves Act 138, Sec. 1 · Read the law's page

• Beginning January 1, 2027, under section 2446 as rewritten by Act 138 of 2026, register with the Secretary of State as a data broker (a business, or unit or units of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of a Vermont consumer with whom it does not have a direct relationship; a consumer has a direct relationship only if the consumer has intentionally interacted with the business to access, purchase, use, request or obtain information about its products or services, has none if the purpose of the engagement is to exercise a consumer right or for the business to verify the consumer's identity, and has none merely because the business collected the information directly from the consumer; a business is still a data broker as to information it sells that it collected outside a first-party interaction; the exclusions in the version until 2027 for e-commerce and application platforms, directory assistance and sales merely incidental to the business are not in the rewritten definition; and publicly available information is outside brokered personal information, except that biometric data collected without the consumer's knowledge, obscene visual depictions, genetic data the consumer did not make public and nonconsensual intimate images are not publicly available information) not more than 30 days after you meet the definition and again on or before July 1 each year, pay the $900.00 registration fee, and maintain a $20,000.00 bond that runs to the State for any liability arising under the subchapter (an action on the bond must be brought within two years after the cause of action accrues).
• In the registration, give your name, primary physical, email and internet addresses and phone number; whether you implement a purchaser credentialing process; the number of data broker security breaches you experienced during the prior year and, if known, the total number of consumers affected; and, where you have actual knowledge that you possess the brokered personal information of minors, a separate statement of the data collection practices, databases, sales activities and opt-out policies that apply to it.
• State in the registration whether you collect each of the listed kinds of data: precise geolocation; reproductive health care data; biometric data; immigration status; sexual orientation; union membership status; name, date of birth, zip code, email address or phone number; an account login or number with the code that would permit access to a third-party account; a driver's license, State identification, Social Security, passport, military or other unique government identification number; and a mobile advertising, connected television or vehicle identification number.
• State in the registration whether, in the past year, you shared consumers' data with or sold it to a foreign actor, the federal government, other state or local governments, law enforcement (unless the data was shared under a subpoena or other court order) or a developer of a GenAI system or model; and, if you collect none of the name, date of birth, zip code, email address or phone number items and none of the government identification numbers, give the three most common types of personal information you collect.
• File with the registration an electronic copy of your bond and your current privacy policy, and give the URL of a page on your website that, if you permit deletion, lets a consumer ask you to delete their brokered personal information and that tells consumers whether they may opt out of your databases or certain sales, the procedure for requesting an opt-out, which activities or sales it covers, whether an authorized agent may opt out for them and the collection, databases or sales from which they may not opt out.
• State in the registration whether and to what extent you or any of your subsidiaries is regulated by the Fair Credit Reporting Act.
• Amend your registration when the section or the State requires, for an administrative fee of $100.00; if you left out required registration information or filed materially incorrect information, file an amendment supplying or correcting it not later than 30 days after you discover the problem or are notified of it.

Vermont Age-Appropriate Design Code Act, 9 V.S.A. sec. 2449a(14) and (21)(B) · Read the law's page

• From January 1, 2027, if you are a covered business that possesses de-identified data, take reasonable measures to ensure that the data cannot be used to reidentify an individual or be associated with an individual, device or household (9 V.S.A. sec. 2449a(14)(A)).
• Publicly commit to process the data only in a de-identified fashion and not attempt to reidentify it (9 V.S.A. sec. 2449a(14)(B)).
• Contractually obligate any recipients of the de-identified data to comply with all provisions of the subchapter (9 V.S.A. sec. 2449a(14)(C)).

9 V.S.A. sec. 2415a(b)(3), (47) · Read the law's page

• Treat any genetic or biometric data you collect about a Vermont consumer as sensitive data requiring opt-in consent, without needing to show the data was collected to identify that person.
• Treat a voiceprint, faceprint, vein pattern, or gait pattern you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. Vermont's exclusion for recording-derived data does not reach data generated for that purpose.

9 V.S.A. sec. 2415d · Read the law's page

• Give a Vermont consumer access, correction, deletion, portability, opt-out of targeted advertising and sale, a profiling explanation and reevaluation right for housing decisions, and a list of third parties their data was sold to.
• Respond to a consumer rights request without undue delay and not later than 45 days after receipt, with one 45-day extension available.

9 V.S.A. sec. 2415g · Read the law's page

• The assessment duties take effect on January 1, 2028; from that date, conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to a Vermont consumer, including targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, and the processing of sensitive data (9 V.S.A. sec. 2415g(a)).
• In each data protection assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, and factor in deidentified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (9 V.S.A. sec. 2415g(b)).
• Conduct an impact assessment for any profiling you use to make a decision that produces a legal or similarly significant effect concerning a consumer, covering the purpose and deployment context of the profiling, any known or reasonably foreseeable heightened risk of harm and the steps taken to mitigate it, the input data and the outputs, performance metrics and known limitations, transparency measures, and postdeployment monitoring and safeguards (9 V.S.A. sec. 2415g(c)).
• Make a data protection assessment or impact assessment available to the Attorney General when the Attorney General requires its disclosure for an investigation (9 V.S.A. sec. 2415g(d)(1)).

9 V.S.A. sec. 2415j; 2026 Vt. Acts & Resolves Act 145, Secs. 2-3 · Read the law's page

• Cure a violation within 60 days after receiving the Attorney General's notice of violation; from January 1, 2028 through June 30, 2029 the Attorney General must give that notice before bringing an action where a cure is possible.

9 V.S.A. secs. 2415a(b)(18), 2415h · Read the law's page

• From January 1, 2028, if you are a controller in possession of deidentified data, take reasonable measures to ensure that the data cannot be associated with an individual (9 V.S.A. sec. 2415h(a)(1)).
• Publicly commit to maintaining and using the deidentified data without attempting to reidentify it (9 V.S.A. sec. 2415h(a)(2)).
• Contractually obligate any recipients of the deidentified data to comply with the provisions of the subchapter (9 V.S.A. sec. 2415h(a)(3)).
• When you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of those commitments (9 V.S.A. sec. 2415h(d)).

9 V.S.A. secs. 2415a, 2415b · Read the law's page

• Determine whether you control or process the personal data of at least 35,000 Vermont consumers, the sensitive data of at least 3,000, or offer for sale the personal data of at least 3,000, before relying on any exemption.
• Where this Act conflicts with any other law, including the Vermont Age-Appropriate Design Code Act, follow whichever law affords consumers the greatest protection for the right of privacy.