Places automated calls, in Vermont

9 V.S.A. § 2445 (Added 2005, No. 162 (Adj. Sess.), § 1, eff. Jan. 1, 2007) · Read the law's page

• This binds a business, any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not organized to operate at a profit, including a financial institution, but never the State, a State agency or a political subdivision of the State; a customer's personal information covered is a signature, Social Security number, physical description, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or other financial information.
• Take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information once the business no longer retains them, by shredding, erasing or otherwise modifying the information to make it unreadable or indecipherable through any means.
• An entity in the business of disposing of personal financial information on another business's behalf must implement and monitor policies and procedures that protect against unauthorized access to or use of the information during and after its collection, transportation and disposal.
• This duty applies to disposal only; it does not itself require safeguarding personal information that remains in active use, and it exempts a Gramm-Leach-Bliley-compliant financial institution, a HIPAA-compliant health insurer or facility, and an FCRA-compliant consumer reporting agency.
• A violation is investigated and prosecuted by the Attorney General or a State's Attorney, who may seek remedies under the Consumer Protection Act including a civil penalty of up to $10,000.00 for each violation, or by the Department of Financial Regulation for a business it licenses or registers, which acts under its own Title 8 and Title 9 powers; the section does not itself state whether a violation carries a private right of action.

9 V.S.A. sec. 2440 · Read the law's page

• If you are a business, do not intentionally communicate or otherwise make available to the general public an individual's Social Security number, or intentionally print or imbed it on a card the individual needs to access your products or services.
• Do not require an individual to transmit his or her Social Security number over the Internet unless the connection is secure or the number is encrypted, and do not require an individual to use his or her Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required.
• Do not print an individual's Social Security number on materials mailed to the individual unless State or federal law requires it on the document, and where one may be mailed, do not print it in whole or in part on a postcard or other mailer not requiring an envelope or make it visible on an envelope without the envelope having been opened.
• Do not sell, lease, lend, trade, rent or otherwise intentionally disclose an individual's Social Security number to a third party without the individual's written consent when you know, or with reasonable diligence would have reason to believe, that the third party lacks a legitimate purpose for obtaining it.
• If you use an individual's Social Security number in a manner subsection (b) bars, and you had used it that way before January 1, 2007, keep the use continuous, give the individual an annual disclosure of the right to stop it, and carry out a written request to stop within 30 days at no charge and without denying services, as section 2440(c)(8) requires for the grandfathered use.

9 V.S.A. secs. 2421a to 2421d; 2026 Vt. Acts & Resolves Act 135 · Read the law's page

• If you are a direct-to-consumer genetic testing company (you sell or market consumer-initiated genetic testing products or services directly to Vermont consumers, analyze genetic data obtained from a consumer other than through a person licensed in the healing arts for diagnosis or treatment, or collect, use, maintain or disclose genetic data from such a product or service), give Vermont consumers a plain-language summary of your privacy practices and a prominent, easily accessible privacy notice covering your data collection, consent, use, access, disclosure, maintenance, transfer, security, and retention and deletion practices, plus a notice that deidentified genetic or phenotypic information may be shared with third parties for research.
• Obtain a consumer's express consent, in response to a clear, meaningful and prominent notice and never by inaction or through a dark pattern, for the collection, use and disclosure of the consumer's genetic data, with separate and express consent for each use of the data (including who has access to it, how it may be shared and the specific purposes), for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer or disclosure to a third party other than a service provider (naming the third party and the purpose), and for marketing or facilitating marketing based on the data. You may not require consent to a third-party transfer as a condition of the services ordered.
• Give a consumer a way to withdraw consent that is at least as easy as the way the consumer gave it, at least one of them through your primary medium of communication. Honor a revocation as soon as practicable and no later than 30 days after it, and destroy the consumer's biological sample no later than 30 days after a revocation related to its storage or use.
• Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure.
• Develop procedures and practices that let a consumer easily access the consumer's genetic data, delete the consumer's account and genetic data (except data you must retain to comply with legal and regulatory requirements), and have the consumer's biological sample destroyed, and within 30 days of such a request tell every third party, including service providers, that received the data or sample to delete or destroy it.
• Do not store genetic data or biological samples of consumers in a country sanctioned by the Office of Foreign Assets Control or designated a foreign adversary, and transfer or store them outside the United States only with the consumer's express consent.
• Bind each service provider by contract not to retain, use or disclose the biological sample, genetic data or any information about the consumer's identity for a commercial purpose other than the contracted services, and not to associate or combine them with information it receives from or collects for others. The service provider must destroy all genetic data it retained immediately when the contract ends, and may not disclose, transfer or sell it before destroying it.
• Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment, or to an entity that advises one, and do not disclose any information about a consumer to a government entity without a search warrant issued by a court on a finding of probable cause, or unless the consumer gives express consent after being notified by you.
• If you are a person or a public entity, do not discriminate against a consumer for exercising rights under the subchapter by denying goods, services or benefits, charging different prices or rates, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing.