Law / United States / 
Vermont
Vermont Data Privacy and Online Surveillance Act, sensitive data categories and biometric data definition
9 V.S.A. sec. 2415a(b)(3), (47)
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Treat any genetic or biometric data you collect about a Vermont consumer as sensitive data requiring opt-in consent, without needing to show the data was collected to identify that person.
- Treat a voiceprint, faceprint, vein pattern, or gait pattern you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. Vermont's exclusion for recording-derived data does not reach data generated for that purpose.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does "information derived therefrom" in the definition of sensitive data in 9 V.S.A. ยง 2415a reach an inference or template computed from genetic or biometric data that no longer identifies a specific consumer?
What it makes you log
Logging duty
Section 2415a(b)(3) defines biometric data and (b)(47) defines sensitive data. Definitions state what the terms cover and impose no duty, so the cited provisions require no log, register or record. The cited provisions carry no territorial clause, so no hook is coded.
- Kind
- None
- As of
What this law does
As enacted, sensitive data means personal data that includes data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as nonbinary or transgender, or citizenship or immigration status; data revealing a mental or physical health condition, diagnosis, disability, or treatment; consumer health data; genetic or biometric data or information derived therefrom; personal data collected from an individual the controller has actual knowledge, or willfully disregards, is a child; precise geolocation data; neural data; a consumer's financial account number, financial account login information, or credit card or debit card number that, in combination with any required access or security code, password, or credential, would allow access to a consumer's financial account; and a government-issued identification number, including, but not limited to, Social Security number, passport number, State identification card number, or driver's license number, that applicable law does not require to be publicly displayed.
Genetic or biometric data carries no unique-identification qualifier, unlike New Hampshire's, Kentucky's, and Rhode Island's sensitive-data clauses.
"Biometric data" lists more enumerated modalities than those three states, including iris or retina scans, fingerprints, facial or hand geometry, vein patterns, voiceprints, and gait, and excludes a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual, the same clawback structure New Hampshire, Kentucky, and Rhode Island each use.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .