Ships a mobile app, in Vermont

9 V.S.A. § 2445 (Added 2005, No. 162 (Adj. Sess.), § 1, eff. Jan. 1, 2007) · Read the law's page

• This binds a business, any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not organized to operate at a profit, including a financial institution, but never the State, a State agency or a political subdivision of the State; a customer's personal information covered is a signature, Social Security number, physical description, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or other financial information.
• Take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information once the business no longer retains them, by shredding, erasing or otherwise modifying the information to make it unreadable or indecipherable through any means.
• An entity in the business of disposing of personal financial information on another business's behalf must implement and monitor policies and procedures that protect against unauthorized access to or use of the information during and after its collection, transportation and disposal.
• This duty applies to disposal only; it does not itself require safeguarding personal information that remains in active use, and it exempts a Gramm-Leach-Bliley-compliant financial institution, a HIPAA-compliant health insurer or facility, and an FCRA-compliant consumer reporting agency.
• A violation is investigated and prosecuted by the Attorney General or a State's Attorney, who may seek remedies under the Consumer Protection Act including a civil penalty of up to $10,000.00 for each violation, or by the Department of Financial Regulation for a business it licenses or registers, which acts under its own Title 8 and Title 9 powers; the section does not itself state whether a violation carries a private right of action.

Attachment C, Standard State Provisions for Contracts and Grants, provision 14B, under 3 V.S.A. sec. 2222(a)(2) · Read the law's page

• If you provide digital products, services or content under a State of Vermont contract or grant, make them adhere to the accessibility standards of Section 504 of the Rehabilitation Act of 1973 and Title II of the Americans with Disabilities Act of 1990, 28 CFR Part 35, which reach websites, software applications, electronic reports and output documentation, and training delivered in electronic formats (Attachment C, provision 14B).
• Warrant that the software, products, services or subscriptions you provide under the agreement comply with that rule, and defend, indemnify and hold the State harmless against any claim related to a product's non-compliance (Attachment C, provision 14B(i)).
• When you update or upgrade a product, develop functionality that supports accessibility in conformance with the rule, and if nonconformance issues arise, provide alternative solutions on request at no additional cost to the State (Attachment C, provision 14B(ii)(a)).
• Document how each update or upgrade will affect the product's accessibility and usability, and on request give that documentation to the State in advance, within an agreed timeframe that lets the State approve the changes or ask for a remediation plan (Attachment C, provision 14B(ii)(b)).
• This reaches a contractor, grantee or subrecipient whose agreement with the State of Vermont includes Attachment C, which Bulletin 3.5 requires in every contract the State procures except a Short Form Contract for services of up to 12 months and $24,999.99 (Attachment C, provision 1; Bulletin 3.5, sections 10.1.2(c) and 10.1.2.2).