Law / United States / 
Vermont
Data Broker Security Breach Notice Act: notice to consumers and the Attorney General
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- If you are a data broker, notify each consumer affected by a data broker security breach in the most expedient time possible and without unreasonable delay, and not later than 45 days after discovery or notification, consistent with the needs of law enforcement and with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security and confidentiality of the data system.
- Notify the Attorney General of the date of the breach and the date of discovery and provide a preliminary description of the breach within 14 business days after discovery, and when you notify consumers tell the Attorney General the number of Vermont consumers affected, if known, and give it a copy of the consumer notice.
- You need not give notice if you establish that misuse of the brokered personal information is not reasonably possible and give the Attorney General notice of that determination with a detailed explanation. If you later obtain facts indicating that misuse has occurred or is occurring, give the notice section 2436(b) requires.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 2436(e)(1) makes a violation an unfair and deceptive act in commerce under section 2453 of title 9, and section 2436(e)(2) gives the Attorney General the authority to bring civil actions as provided under chapter 63, subchapter 1. Section 2458(b)(1) in that subchapter allows the court to impose a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce. Section 2436 states no penalty of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Vermont Attorney General, who has the same authority to adopt rules, conduct civil investigations, enter into assurances of discontinuance and bring civil actions as provided under chapter 63, subchapter 1 of title 9 (9 V.S.A. section 2436(e)(2)).
What this law does
A data broker must notify a consumer of a data broker security breach affecting the consumer in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification. A data broker must notify the Attorney General of the date of the security breach and the date of discovery and provide a preliminary description of the breach within 14 business days after the data broker's discovery of the breach.
A data broker security breach is an unauthorized acquisition, or a reasonable belief of an unauthorized acquisition, of more than one instance of unencrypted, unredacted brokered personal information maintained by a data broker. A data broker need not give notice under section 2436(b) if it establishes that misuse of the brokered personal information is not reasonably possible and provides notice of that determination as section 2436(c) requires.
A person who violates section 2436 commits an unfair and deceptive act in commerce in violation of section 2453 of title 9.
When LexLint raises it
When your app profile says your app crawls the web, tracks devices or sends automated outreach.