Law / United States / 
Vermont
Vermont Data Privacy and Online Surveillance Act, data protection and impact assessments
A comprehensive regime rule binding private bodies.
- Obligation class
- DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- The assessment duties take effect on ; from that date, conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to a Vermont consumer, including targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, and the processing of sensitive data (9 V.S.A. sec. 2415g(a)).
- In each data protection assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, and factor in deidentified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (9 V.S.A. sec. 2415g(b)).
- Conduct an impact assessment for any profiling you use to make a decision that produces a legal or similarly significant effect concerning a consumer, covering the purpose and deployment context of the profiling, any known or reasonably foreseeable heightened risk of harm and the steps taken to mitigate it, the input data and the outputs, performance metrics and known limitations, transparency measures, and postdeployment monitoring and safeguards (9 V.S.A. sec. 2415g(c)).
- Make a data protection assessment or impact assessment available to the Attorney General when the Attorney General requires its disclosure for an investigation (9 V.S.A. sec. 2415g(d)(1)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer (2415g(a)), weighing the benefits of the processing against the risks as safeguards mitigate them (2415g(b)), and must conduct an impact assessment, with the contents subsection (c) lists, for profiling used to make a decision with a legal or similarly significant effect. The Attorney General may require a controller to disclose either kind of assessment relevant to an investigation, and the controller must make it available (2415g(d)(1)); the assessments are confidential and exempt under the Public Records Act (2415g(d)(3)). The section sets no period for keeping an assessment. Act 145 takes effect on (Sec. 4) and subsection (e)(3) applies the assessment requirements to processing activities created or generated after . The section has no scope clause; the reach is stated in 2415b(a), which this row does not cite, so no hook is taken. Section 2415c, the exemptions section, lists the data and entities the subchapter does not reach and sets no record duty.
- Kind
- Explicit
- As of
- Provision
- 9 V.S.A. sec. 2415g(a), (c) and (d) (documented data protection and impact assessments)
- Trigger
- personal_data_processing
- automated_decisions
What this law does
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, some profiling and the processing of sensitive data. A controller that engages in profiling to make a decision that produces a legal or similarly significant effect concerning a consumer must also conduct an impact assessment for the profiling.
The Attorney General may require a controller to disclose any data protection or impact assessment that is relevant to an investigation, and the controller must make it available to the Attorney General. Data protection and impact assessments are confidential and exempt from disclosure and copying under the Public Records Act. The assessment requirements apply to processing activities created or generated after , and are not retroactive. The Act that enacts the section takes effect on .
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web, deploys a chatbot, processes biometric data, processes voice recordings, trains models or makes high-risk automated decisions.