Duty LXD-1136
Processes de-identified data, in Vermont
Vermont Age-Appropriate Design Code Act, de-identified datafrom , in 7 weeks3 lines
Vermont Age-Appropriate Design Code Act, 9 V.S.A. sec. 2449a(14) and (21)(B) · Read the law's page
- From , if you are a covered business that possesses de-identified data, take reasonable measures to ensure that the data cannot be used to reidentify an individual or be associated with an individual, device or household (9 V.S.A. sec. 2449a(14)(A)).
- Publicly commit to process the data only in a de-identified fashion and not attempt to reidentify it (9 V.S.A. sec. 2449a(14)(B)).
- Contractually obligate any recipients of the de-identified data to comply with all provisions of the subchapter (9 V.S.A. sec. 2449a(14)(C)).
Vermont Data Privacy and Online Surveillance Act, deidentified datafrom , in 14 months4 lines
9 V.S.A. secs. 2415a(b)(18), 2415h · Read the law's page
- From , if you are a controller in possession of deidentified data, take reasonable measures to ensure that the data cannot be associated with an individual (9 V.S.A. sec. 2415h(a)(1)).
- Publicly commit to maintaining and using the deidentified data without attempting to reidentify it (9 V.S.A. sec. 2415h(a)(2)).
- Contractually obligate any recipients of the deidentified data to comply with the provisions of the subchapter (9 V.S.A. sec. 2415h(a)(3)).
- When you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of those commitments (9 V.S.A. sec. 2415h(d)).