Processes biometric data, in Vermont

9 V.S.A. § 2445 (Added 2005, No. 162 (Adj. Sess.), § 1, eff. Jan. 1, 2007) · Read the law's page

• This binds a business, any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not organized to operate at a profit, including a financial institution, but never the State, a State agency or a political subdivision of the State; a customer's personal information covered is a signature, Social Security number, physical description, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or other financial information.
• Take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information once the business no longer retains them, by shredding, erasing or otherwise modifying the information to make it unreadable or indecipherable through any means.
• An entity in the business of disposing of personal financial information on another business's behalf must implement and monitor policies and procedures that protect against unauthorized access to or use of the information during and after its collection, transportation and disposal.
• This duty applies to disposal only; it does not itself require safeguarding personal information that remains in active use, and it exempts a Gramm-Leach-Bliley-compliant financial institution, a HIPAA-compliant health insurer or facility, and an FCRA-compliant consumer reporting agency.
• A violation is investigated and prosecuted by the Attorney General or a State's Attorney, who may seek remedies under the Consumer Protection Act including a civil penalty of up to $10,000.00 for each violation, or by the Department of Financial Regulation for a business it licenses or registers, which acts under its own Title 8 and Title 9 powers; the section does not itself state whether a violation carries a private right of action.

9 V.S.A. secs. 2430, 2446; 2026 Vt. Acts & Resolves Act 138, Sec. 1 · Read the law's page

• Beginning January 1, 2027, under section 2446 as rewritten by Act 138 of 2026, register with the Secretary of State as a data broker (a business, or unit or units of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of a Vermont consumer with whom it does not have a direct relationship; a consumer has a direct relationship only if the consumer has intentionally interacted with the business to access, purchase, use, request or obtain information about its products or services, has none if the purpose of the engagement is to exercise a consumer right or for the business to verify the consumer's identity, and has none merely because the business collected the information directly from the consumer; a business is still a data broker as to information it sells that it collected outside a first-party interaction; the exclusions in the version until 2027 for e-commerce and application platforms, directory assistance and sales merely incidental to the business are not in the rewritten definition; and publicly available information is outside brokered personal information, except that biometric data collected without the consumer's knowledge, obscene visual depictions, genetic data the consumer did not make public and nonconsensual intimate images are not publicly available information) not more than 30 days after you meet the definition and again on or before July 1 each year, pay the $900.00 registration fee, and maintain a $20,000.00 bond that runs to the State for any liability arising under the subchapter (an action on the bond must be brought within two years after the cause of action accrues).
• In the registration, give your name, primary physical, email and internet addresses and phone number; whether you implement a purchaser credentialing process; the number of data broker security breaches you experienced during the prior year and, if known, the total number of consumers affected; and, where you have actual knowledge that you possess the brokered personal information of minors, a separate statement of the data collection practices, databases, sales activities and opt-out policies that apply to it.
• State in the registration whether you collect each of the listed kinds of data: precise geolocation; reproductive health care data; biometric data; immigration status; sexual orientation; union membership status; name, date of birth, zip code, email address or phone number; an account login or number with the code that would permit access to a third-party account; a driver's license, State identification, Social Security, passport, military or other unique government identification number; and a mobile advertising, connected television or vehicle identification number.
• State in the registration whether, in the past year, you shared consumers' data with or sold it to a foreign actor, the federal government, other state or local governments, law enforcement (unless the data was shared under a subpoena or other court order) or a developer of a GenAI system or model; and, if you collect none of the name, date of birth, zip code, email address or phone number items and none of the government identification numbers, give the three most common types of personal information you collect.
• File with the registration an electronic copy of your bond and your current privacy policy, and give the URL of a page on your website that, if you permit deletion, lets a consumer ask you to delete their brokered personal information and that tells consumers whether they may opt out of your databases or certain sales, the procedure for requesting an opt-out, which activities or sales it covers, whether an authorized agent may opt out for them and the collection, databases or sales from which they may not opt out.
• State in the registration whether and to what extent you or any of your subsidiaries is regulated by the Fair Credit Reporting Act.
• Amend your registration when the section or the State requires, for an administrative fee of $100.00; if you left out required registration information or filed materially incorrect information, file an amendment supplying or correcting it not later than 30 days after you discover the problem or are notified of it.

9 V.S.A. sec. 2415a(b)(3), (47) · Read the law's page

• Treat any genetic or biometric data you collect about a Vermont consumer as sensitive data requiring opt-in consent, without needing to show the data was collected to identify that person.
• Treat a voiceprint, faceprint, vein pattern, or gait pattern you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. Vermont's exclusion for recording-derived data does not reach data generated for that purpose.