Makes employment decisions, in Vermont

18 V.S.A. sec. 9333; sec. 9335(a), (b) · Read the law's page

• Do not, directly or indirectly, use the fact that genetic counseling or testing services have been requested or that genetic testing has been performed, use genetic testing results or genetic information from a person or a member of the person's family, use the diagnosis of a genetic disease derived from a clinical interview and examination rather than a genetic test, or require genetic testing, as a condition of or to affect the terms, conditions or privileges of employment (including application for employment), membership in a labor organization, or professional licensure, certification or registration. Subject to the underwriting limits of section 9334, the bar does not prohibit use of genetic testing results or genetic information in connection with life, disability income or long-term care insurance provided under an employee benefit plan.
• Do not disclose to an employer, labor organization, employment agency or licensing agency any genetic testing results or genetic information, that genetic services have been requested, or that genetic testing has been performed, with respect to an employee, labor organization member, professional licensee, certificate holder or registrant.

9 V.S.A. § 2445 (Added 2005, No. 162 (Adj. Sess.), § 1, eff. Jan. 1, 2007) · Read the law's page

• This binds a business, any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not organized to operate at a profit, including a financial institution, but never the State, a State agency or a political subdivision of the State; a customer's personal information covered is a signature, Social Security number, physical description, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or other financial information.
• Take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information once the business no longer retains them, by shredding, erasing or otherwise modifying the information to make it unreadable or indecipherable through any means.
• An entity in the business of disposing of personal financial information on another business's behalf must implement and monitor policies and procedures that protect against unauthorized access to or use of the information during and after its collection, transportation and disposal.
• This duty applies to disposal only; it does not itself require safeguarding personal information that remains in active use, and it exempts a Gramm-Leach-Bliley-compliant financial institution, a HIPAA-compliant health insurer or facility, and an FCRA-compliant consumer reporting agency.
• A violation is investigated and prosecuted by the Attorney General or a State's Attorney, who may seek remedies under the Consumer Protection Act including a civil penalty of up to $10,000.00 for each violation, or by the Department of Financial Regulation for a business it licenses or registers, which acts under its own Title 8 and Title 9 powers; the section does not itself state whether a violation carries a private right of action.

2026 Vt. Acts & Resolves Act 101 (H.814); 3 V.S.A. ch. 69 (amending); effective July 1, 2026

• Disclose whenever artificial intelligence is used to make or inform a decision affecting an individual in a health or human services context, including clinical care, insurance coverage determinations, or a chatbot substituting for a licensed mental health professional.
• Notify affected individuals when using artificial intelligence to evaluate prior authorizations or coverage.
• Obtain informed consent before collecting neural data through a brain-computer interface.
• Delete neural data within 10 days of the individual revoking consent.

9 V.S.A. sec. 2415d · Read the law's page

• Give a Vermont consumer access, correction, deletion, portability, opt-out of targeted advertising and sale, a profiling explanation and reevaluation right for housing decisions, and a list of third parties their data was sold to.
• Respond to a consumer rights request without undue delay and not later than 45 days after receipt, with one 45-day extension available.

9 V.S.A. sec. 2415g · Read the law's page

• The assessment duties take effect on January 1, 2028; from that date, conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to a Vermont consumer, including targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, and the processing of sensitive data (9 V.S.A. sec. 2415g(a)).
• In each data protection assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, and factor in deidentified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (9 V.S.A. sec. 2415g(b)).
• Conduct an impact assessment for any profiling you use to make a decision that produces a legal or similarly significant effect concerning a consumer, covering the purpose and deployment context of the profiling, any known or reasonably foreseeable heightened risk of harm and the steps taken to mitigate it, the input data and the outputs, performance metrics and known limitations, transparency measures, and postdeployment monitoring and safeguards (9 V.S.A. sec. 2415g(c)).
• Make a data protection assessment or impact assessment available to the Attorney General when the Attorney General requires its disclosure for an investigation (9 V.S.A. sec. 2415g(d)(1)).