Records text chat, in Vermont

9 V.S.A. § 2445 (Added 2005, No. 162 (Adj. Sess.), § 1, eff. Jan. 1, 2007) · Read the law's page

• This binds a business, any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not organized to operate at a profit, including a financial institution, but never the State, a State agency or a political subdivision of the State; a customer's personal information covered is a signature, Social Security number, physical description, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or other financial information.
• Take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information once the business no longer retains them, by shredding, erasing or otherwise modifying the information to make it unreadable or indecipherable through any means.
• An entity in the business of disposing of personal financial information on another business's behalf must implement and monitor policies and procedures that protect against unauthorized access to or use of the information during and after its collection, transportation and disposal.
• This duty applies to disposal only; it does not itself require safeguarding personal information that remains in active use, and it exempts a Gramm-Leach-Bliley-compliant financial institution, a HIPAA-compliant health insurer or facility, and an FCRA-compliant consumer reporting agency.
• A violation is investigated and prosecuted by the Attorney General or a State's Attorney, who may seek remedies under the Consumer Protection Act including a civil penalty of up to $10,000.00 for each violation, or by the Department of Financial Regulation for a business it licenses or registers, which acts under its own Title 8 and Title 9 powers; the section does not itself state whether a violation carries a private right of action.