The Vermont State Senate and House of Representatives passed, on 14 February 2020, the bill for An Act Relating to Data Privacy and Consumer Protection (S. 110) ('the Bill'). In particular, the Bill outlines, among other things, that data collectors that own or license computerised personally identifiable information ('PII') or login credentials that includes personal information concerning a consumer must notify the consumer that there has been a security breach following discovery or notification of the breach, and that this notice must be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification. In addition, the Bill notes that if a security breach is limited to an unauthorised acquisition of login credentials, a data collector is only required to provide notice of the breach to the Vermont Attorney General or the Vermont Department of Financial Regulation, as applicable, if the login credentials were acquired directly from the data collector or its agent.

Moreover, the Bill highlights that the notice to consumers must include the type of PII that was subject to the security breach, the acts of the data collector to protect the PII from further security breaches, contact details that the consumer may call for further information and assistance, and the approximate date of the security breach. Furthermore, the Bill outlines, among other things, provisions for the protection of student data and privacy, such as the prohibition to knowingly engage in targeted advertising, use information, including a persistent unique identifier, that is created or gathered to amass a profile about a student, and provisions on permissive use or disclosure of student data.

The Bill would take effect on 1 July 2020.

You can read the Bill here, and track its progress here.

UPDATE (2 March 2020)

Data breach bill sent to Governor for signature

The Bill was sent, on 28 February 2020, to the Vermont Governor for his signature.

You can read the Bill here and track its progress here.