Law / United States / 
Vermont
Vermont Data Privacy and Online Surveillance Act, deidentified data
9 V.S.A. secs. 2415a(b)(18), 2415h
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- From , if you are a controller in possession of deidentified data, take reasonable measures to ensure that the data cannot be associated with an individual (9 V.S.A. sec. 2415h(a)(1)).
- Publicly commit to maintaining and using the deidentified data without attempting to reidentify it (9 V.S.A. sec. 2415h(a)(2)).
- Contractually obligate any recipients of the deidentified data to comply with the provisions of the subchapter (9 V.S.A. sec. 2415h(a)(3)).
- When you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of those commitments (9 V.S.A. sec. 2415h(d)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 2415h states the conditions on a controller that holds deidentified data and the oversight a controller exercises when it discloses such data. It states no log or record duty and sets no retention period.
- Kind
- None
- As of
What this law does
Under 9 V.S.A. sec. 2415a(b)(18), deidentified data is data that does not identify and cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to the individual, if the controller that possesses the data meets three conditions. For the definition of deidentified data, reasonable measures include the deidentification requirements set forth under section 164.514 of title 45 of the Code of Federal Regulations.
Personal data does not include deidentified data or publicly available information. A controller in possession of deidentified data must take reasonable measures to ensure that the data cannot be associated with an individual. A controller in possession of deidentified data must publicly commit to maintaining and using the data without attempting to reidentify it.
A controller in possession of deidentified data must contractually obligate any recipients of the data to comply with the provisions of the subchapter. The subchapter does not require a controller or processor to reidentify deidentified data or pseudonymous data.
A controller that discloses pseudonymous data or deidentified data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the data is subject and take appropriate steps to address any breaches of those commitments. The Act that enacts the section takes effect on .
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .