Law / United States / 
Vermont
Vermont Data Privacy and Online Surveillance Act, consumer rights
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Give a Vermont consumer access, correction, deletion, portability, opt-out of targeted advertising and sale, a profiling explanation and reevaluation right for housing decisions, and a list of third parties their data was sold to.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P4
- Respond to a consumer rights request without undue delay and not later than 45 days after receipt, with one 45-day extension available.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- When is it "feasible" for a controller to let a consumer question the result of profiling, be told the reason for it and review the data used under 9 V.S.A. § 2415d(a)(6)?
What it makes you log
What the log must hold
Decision basis
Logging duty
A controller that denies an opt-out request as fraudulent must hold a good faith, reasonable and documented belief, and must tell the requester why (2415d(c)(4)(C)); the documented belief is a record of the grounds of the decision. The record of a deletion request in 2415d(c)(5)(A) is one of two routes to deemed compliance, so it is an option and not a duty, the list of third parties in (a)(7) falls back to a list of all third parties where the controller keeps none, and the written appeal explanation in (d)(3) is a notice. The section sets no retention period and names no one entitled to the documented belief. The reach comes from the definition of consumer, an individual who is a resident of the State; the thresholds in 2415b are not invoked by this section.
- Kind
- Implicit
- As of
- Provision
- 9 V.S.A. sec. 2415d(c)(4)(B)
- Trigger
- consent_or_optout
What this law does
As enacted, sec. 2415d grants access (including a right to know about profiling used for legal or significant-effect decisions), correction, deletion, portability, opt-out of targeted advertising, sale, and profiling, a profiling-specific explanation and correction-and-reevaluation right for housing decisions, and a right to a list of third parties personal data was sold to, a broader rights list than New Hampshire, Kentucky, or Rhode Island.
A controller must respond without undue delay and not later than 45 days after receipt, with one 45-day extension available.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .