Law / United States / 
Vermont
Social Security Number Protection Act: businesses and State agencies
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are a business, do not intentionally communicate or otherwise make available to the general public an individual's Social Security number, or intentionally print or imbed it on a card the individual needs to access your products or services.
- Do not require an individual to transmit his or her Social Security number over the Internet unless the connection is secure or the number is encrypted, and do not require an individual to use his or her Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required.
- Do not print an individual's Social Security number on materials mailed to the individual unless State or federal law requires it on the document, and where one may be mailed, do not print it in whole or in part on a postcard or other mailer not requiring an envelope or make it visible on an envelope without the envelope having been opened.
- Do not sell, lease, lend, trade, rent or otherwise intentionally disclose an individual's Social Security number to a third party without the individual's written consent when you know, or with reasonable diligence would have reason to believe, that the third party lacks a legitimate purpose for obtaining it.
- If you use an individual's Social Security number in a manner subsection (b) bars, and you had used it that way before , keep the use continuous, give the individual an annual disclosure of the right to stop it, and carry out a written request to stop within 30 days at no charge and without denying services, as section 2440(c)(8) requires for the grandfathered use.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 2440(g)(1) gives the Attorney General and State's Attorney sole and full authority to enforce, prosecute, obtain and impose remedies for a violation of the subchapter as they have under chapter 63 of title 9. Section 2458(b)(1) of that chapter lets the court impose a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce. Section 2440 states no penalty of its own and does not itself declare a violation an unfair or deceptive act.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Vermont Attorney General and State's Attorneys, who have sole and full authority to investigate and enforce violations by businesses and the State, and the Department of Financial Regulation for a person or entity it licenses or registers (9 V.S.A. section 2440(g)).
What this law does
Except as subsection (c) provides, a business may not intentionally make an individual's Social Security number available to the general public, intentionally print or imbed it on an access card, require its transmission over the Internet unless the connection is secure or the number is encrypted, require its use to access an Internet website without a password or other authentication device, print it on materials mailed to the individual, or disclose it to a third party without written consent when it knows or should know the third party lacks a legitimate purpose.
Section 2440(b) does not apply when a Social Security number is included in an application or in documents related to an enrollment process, or to establish, amend or terminate an account, contract or policy.
The State, a State agency or political subdivision, and an agent or employee of the State may not collect a Social Security number from an individual unless authorized or required by law, State or federal regulation or grant agreement, or unless the collection is related to the performance of the agency's duties and responsibilities as prescribed by law.
A person has the right to ask a town clerk or clerk of court to remove from an image or copy of an official record placed on a publicly available Internet website the person's Social Security number and the other identifiers section 2440(f) lists.
The Attorney General and State's Attorney have sole and full authority to investigate, enforce, prosecute, obtain and impose remedies for violations of the subchapter, as they have under chapter 63 of title 9, by businesses and by the State, State agencies and political subdivisions, other than a person or entity licensed or registered with the Department of Financial Regulation.
The Department of Financial Regulation has full authority to investigate and enforce violations of the subchapter by a person or entity licensed or registered with the Department under title 8 or title 9.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.