{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":1,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Vermont"]
["Key Legislation Overview"]
["What is the key legislation?",{"$cut":{"chars":17478,"head":" \n\t Title 1, Chapter 5, Subchapter 4 3 of the Vermont Statutes (1 V.S.A. §§ 315-320) – Vermont Public Records Act \n\t Title 9, Chapter 62 of the Vermont Statutes (9 V.S.A. §§ 2430 et seq.) – Protection of Personal Information     \n\t \n\t\t 9 V.S.A. §§ 2431, 2446, 2447 – Data Broker Law \n\t\t 9 V.S.A. § 2435 – Vermont Security Breach Notice Act \n\t\t 9 V.S.A. § 2440 – Vermont Social Security Number Protection Act \n\t\t 9 V.S.A. § 2443-2443f – Vermont Student Data Privacy Law \n\t\t 9 V.S.A. § 2445 – Vermont Document Safe Destruction Act \n\t \n\t \n\t Title 9, Chapter 63 of the Vermont Statutes (9 V.S.A. §§ 2451 et seq.) – Vermont Consumer Protection Act \n\t \n\t\t 9 V.S.A. §§ 2464a-2464d – Telephone Solicitations \n\t\t 9 V.S.A. §§ 2480a-2480n – Vermont Fair Credit Reporting Act \n\t \n\t \n\t Title 12, Chapter 63 of the Vermont Statutes (12 V.S.A. §§ 1691 et seq.) – Records and Other Documents \n\t \n\t\t 12 V.S.A. § 1691a – Procedure for production of employee personnel records \n\t \n\t \n\t Title 13, Chapter 47 of the Vermont Statutes (13 V.S.A. §§ 2001 et seq.) – Frauds \n\t \n\t\t 13 V.S.A. § 2030 – Identity theft \n\t \n\t \n\t Title 13, Chapter 232 of the Vermont Statutes (13 V.S.A. §§ 8101-8108) – Vermont Electronic Communication Privacy Act \n\t Title 18, Chapter 42B of the Vermont Statutes (18 V.S.A. §§ 1881-1882) – Health Care Privacy \n\t Title 18, Chapter 84A of the Vermont Statutes (18 V.S.A. §§ 4281 et seq.) – Vermont Prescription Monitoring System \n\t \n\t\t 18 V.S.A. § 4284 – Protection and disclosure of information \n\t \n\t \n\t Title 21, Chapter 5, Subchapter 6 of the Vermont Statutes (21 V.S.A. §§ 495 et seq.) – Fair Employment Practices \n\t \n\t\t 21 V.S.A. § 495i – Employment based on credit information; prohibitions \n\t\t 21 V.S.A. § 495j – Criminal history records; employment applications \n\t\t 21 V.S.A. § 495l – Social media account privacy; prohibitions \n\t\t 21 V.S.A. § 495m – Salary history; employment applications \n\t \n\t \n\t Title 21, Chapter 5, Subchapter 11 of the Vermont Statutes (21 V.S.A. §§ 511 et seq.) – Drug Testing  \n\t \n\t\t 21 V.S.A. § 516 – Confidentiality \n\t \n\t \n\t Title 22, Chapter 4 of the Vermont Statutes (22 V.S.A. §§ 171-173) – Library Patron Records \n\t In addition to the above-listed statutes, various regulations in Vermont address privacy matters, including:\n\t \n\t\t Vermont Department of Financial Regulation, Banking Division, Regulation B-2018-01, CVR 21-010-016 (Privacy of Consumer Financial and Health Information Regulation) \n\t\t Vermont Department of Banking, Insurance, Securities & Health Care Administration, Division of Insurance, Division of Health Care Administration, Regulation IH-2001-01, CVR 21-020-053 (Privacy of Consumer Financial and Health Information Regulation) \n\t\t Vermont Department of Financial Regulation, Insurance Division, Regulation IH-2002-03, CVR 21-020-055 (Standards for Safeguarding Customer Information) \n\t\t Vermont Department of Financial Regulation, Securities Division, Regulation S-2016-01, CVR 21-030-001 (Vermont Securities Regulations) \n\t\t Vermont Agency of Human Services, CVR 13-000-002 (Consumer Information and Privacy) \n\t\t Vermont Agency of Human Services, CVR 13-001-001 (General Provisions and Definitions) \n\t\t Vermont Agency of Human Services, Department for Children and Families, CVR 13-170-001 (Health Benefits Eligibility and Enrollment) \n\t\t Vermont Agency of Human Services, Department of Health, CVR 13-140-021 (Immunization) \n\t\t Vermont Agency of Human Services, Department of Disabilities, Aging and Independent Living, CVR 13-110-006 (Licensing Regulations for Homes for the Terminally Ill) \n\t\t Vermont Agency of Human Services, Department of Disabilities, Aging and Independent Living, CVR 13-110-009 (Residential Care Home Licensing) \n\t\t Vermont Agency of Human Services, Department of Disabilities, Aging and Independent Living, CVR 13-110-012 (Licensing and Operating Regulations for Therapeutic Community Residences) \n\t\t Vermont Agency of Human Services, Department of Social and Rehabilitation Services, CVR 13-160-003 (Regulations for Commissioner-Designated Shelter Programs) \n\t\t Vermont Agency of Human Services, Divisio"}}]
["Key Data Protection Provisions"]
["What data is protected?"," \n\t The Vermont Security Breach Notice Act defines “personally identifiable information” as follows: \n \n\n “A consumer’s first name or first initial and last name in combination with one or more of the following digital data elements, when either the name or the data elements are not encrypted, redacted, or protected by another method that renders them unreadable or unusable by unauthorized persons \n\n \n\t a Social Security number;  \n\t a driver license or nondriver State identification card number, individual taxpayer identification number, passport number, military identification card number, or another identification number that originates from a government identification document that is commonly used to verify identity for a commercial transaction;  \n\t a financial account number or credit or debit card number, if the number could be used without additional identifying information, access codes, or passwords;  \n\t  a password, personal identification number, or other access code for a financial account;  \n\t unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee of the data to identify or authenticate the consumer, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data;  \n\t genetic information; and  \n\t (i) health records or records of a wellness program or similar program of health promotion or disease prevention; (ii) a health care professional’s medical diagnosis or treatment of the consumer; or (iii) a health insurance policy number.” \n \n\n Excluded from the definition of “personally identifiable information” is publicly available information that is lawfully made available to the general public from federal, state, or local government records. \n\n \n\t The Vermont Security Breach Notice Act defines “login credentials” as “a consumer’s user name or e-mail address, in combination with a password or an answer to a security question, that together permit access to an online account.” \n\t The Vermont Document Safe Destruction Act defines “personal information” is information that identifies, relates to, describes, or is capable of being associated with a particular individual, including signature, Social Security number, physical characteristics or description, passport number, driver's license or state identification card number, insurance policy number, bank account number, credit card number, debit card number, or any other financial information. \n\t Vermont’s data broker defines “brokered personal information” to include “one or more of the following computerized data elements about a consumer if categorized or organized for dissemination to third parties:\n\t \n\t\t name; \n\t\t address; \n\t\t date of birth; \n\t\t place of birth; \n\t\t mother's maiden name; \n\t\t unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee of the data to identify or authenticate the consumer, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data; \n\t\t name or address of a member of the consumer's immediate family or household; \n\t\t Social Security number or another government-issued identification number; or \n\t\t other information that alone or in combination with the other information sold or licensed would allow a reasonable person to identify the consumer with reasonable certainty.”   \n\t \n\t \n\t \"Financial information” is defined as “an original or copy of, or information derived from: (A) a document that grants signature authority over a deposit or share account; (B) a statement, ledger card, or another record of a deposit or share account that shows transactions in or with respect to that deposit or account; (C) a check, clear draft, or money order that is drawn on a financial institution or issued and payable by or through a financial institution; (D) any item, other than an institutional or periodic charge, that is made under an agreement between a financial institution and another person's deposit or share account; (E) any information that relates to a loan account or an application for a loan; or (F) evidence of a transaction conducted by electronic or telephonic means.” \n\t “Protected health information” is defined as in 45 C.F.R. § 160.103. \n\t Vermont’s Student Data Privacy Law defines “covered information” as “personal information or material, or information that is linked to personal information or material, in any media or format,” that “personally identifies a student, including information in the student’s education record or electronic mail; first and last name; home address; telephone number; electronic mail address or other information that allows physical or online contact; discipline records; test results; special education data; juvenile dependency records; grades; evaluations; criminal records; medical records; health records; social security number; biometric information; disability status; socioeconomic information; food purchases; political affiliations; religious information; text messages; documents; student identifiers; search activity; photos; voice recordings; or geolocation information.”  To qualify as “covered information,” the information must also meet the following criteria:  (1) it is not publicly available, or it is made publicly available pursuant to the federal Family Educational and Rights and Privacy Act; and (2) it is created by or provided to an operator by a student or the student’s parent or legal guardian in the course of the student’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for PreK–12 school purposes; or it is created by or provided to an operator by an employee or agent of a school or school district for PreK–12 school purposes; or it is gathered by an operator through the operation of its site, service, or application for PreK–12 school purposes. \n\t The Vermont Identity Theft Statute protects “name, address, birth date, Social Security number, motor vehicle personal identification number, telephone number, financial services account number, savings account number, checking account number, credit card number, debit card number, picture, identification document or false identification document, electronic identification number, educational record, health care record, financial record, credit record, employment record, e-mail address, computer system password, or mother’s maiden name, or similar personal number, record, or information.” \n\t 18 V.S.A. § 4284 protects prescription information. \n\t Vermont’s fair employment practices statute and related provisions protect employees’ and applicants’ credit reports, credit histories, criminal history records, social media accounts, salary history information, and drug test results. \n\t 12 V.S.A. § 1691a protects employee personnel records. \n\t Vermont’s library patron records statute protects “patron registration records” and “patron transaction records.” \n\t The Vermont Electronic Communication Privacy Act protects “protected user information,” which is defined as “electronic communication content, including the subject line of e-mails, cellular tower-based location data, GPS or GPS-derived location data, the contents of files entrusted by a user to an electronic communication service pursuant to a contractual relationship for the storage of the files whether or not a fee is charged, data memorializing the content of information accessed or viewed by a user, and any other data for which a reasonable expectation of privacy exists.” \n\t CVR 13-000-002 protects consumers’ “Individually Identifiable Information.” \n\t CVR 13-001-001 and CVR 13-170-001 protect “Personally Identifiable Information.” \n\t Regulation IH-2001-01, CVR 21-020-053 protects “nonpublic personal health information” and “nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees.” \n\t Regulation IH-2002-03, CVR 21-020-055 protects customer information. \n\t Regulation B-2018-01, CVR 21-010-016 protects “nonpublic personal health information” and “nonpublic personal information about individuals who obtain financial products or services primarily for personal, family, or household purposes from [financial institutions].” \n\t CVR 31-010-003 protects the geographical location of a telephone being used by a caller. \n\t CVR 30-000-7600 protects information about consumers and their calling patterns. \n\t CVR 10-060-004 protects records and files kept by the Vermont Department of Taxes, including tax returns and return information. \n\t CVR 10-060-033 protects consumers’ “personally identifiable information,\" meaning all information that identifies a person. \n\t CVR 22-000-006 protects students’ “education records,” which are defined as under the federal Family Educational Rights Act of 1974 (\" FERPA \"), and “personally identifiable information,” defined as “(1) The name of a child, the child’s parent, or other family member; (2) The address of the child; (3) A personal identifier such as the child or parent’s social security number; or (4) A list of personal characteristics or other information that would make it possible to identify the child with reasonable certainty such as the child’s date of birth or disability.”   \n \n"]
["Who is subject to privacy obligations?"," \n\t “Data collectors,” defined as any person or public or private entity that, for any purpose, whether by automated collection or otherwise, handles, collects, disseminates, or otherwise deals with nonpublic personal information.  \n\t “Data brokers,” defined as a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship. \n\t Public and private entities dealing with social security numbers. \n\t Businesses with custody or control over personal information. \n\t “Financial institutions” as defined under 8 V.S.A. § 10202 and Regulation B-2018-01, CVR 21-010-016. \n\t “Covered entities” as defined in 45 C.F.R. § 160.103. \n\t Operators of websites, online services, online applications, or mobile applications who have actual knowledge that the site, service, or application is used primarily for, and was designed and marketed for, “ PreK–12 school purposes. ” \n\t The Vermont Department of Health and other persons who receive prescription information, data, or reports from the Vermont Prescription Monitoring System. \n\t CVR 13-000-002 applies to employees, grantees, and contractors of the Vermont Agency of Human Services. \n\t CVR 13-001-001 applies to the Vermont Agency of Human Services. \n\t Regulation IH-2001-01, CVR 21-020-053 and Regulation IH-2002-03, CVR 21-020-055 apply to insurers licensed by the State of Vermont. \n\t Regulation S-2016-01, CVR 21-030-001 applies to securities professionals and to applicants for initial registration as investment advisers. \n\t Vermont’s fair employment practices statute and related provisions apply to employers in Vermont. \n\t 12 V.S.A. § 1691a applies to litigants and counsel engaged in civil litigation matters. \n\t 9 V.S.A. §§ 2464a-2464d apply to telemarketers and others who place telephone calls to make a telephone solicitation, or to induce a charitable contribution, donation, or gift of money or another thing of value. \n\t The Vermont Fair Credit Reporting Act applies to credit reporting agencies and users of credit reports. \n\t The Vermont Electronic Communication Privacy Act applies to law enforcement. \n\t Vermont’s library patron records statute applies to libraries, library officers, employees, and volunteers in Vermont. \n\t CVR 31-010-003 applies to local exchange carriers, alternative local exchange carriers, and telecommunications companies. \n\t CVR 30-000-7600 applies to telecommunications carriers. \n\t CVR 10-060-004 applies to the Vermont Department of Taxes. \n\t CVR 10-060-033 applies to certified service providers working on behalf of sellers, and also to the Vermont Commissioner of Taxes. \n\t CVR 22-000-006 applies to various educational institutions in Vermont. \n \n"]
["What are the principles applicable to personal data processing?","The various statutes and regulations listed above contain various provisions addressing this issue. Also, failure to engage in fair and reasonable data security practices is generally deemed to be a violation of the \nVermont Consumer Protection Act."]
["How is the processing of personal data regulated?","The various statutes and regulations listed above contain various provisions addressing this issue. Also, failure to engage in fair and reasonable data security practices is generally deemed to be a violation of the \nVermont Consumer Protection Act."]
["How are storage, security and retention of personal data regulated?","The various statutes and regulations listed above contain various provisions addressing this issue. Also, failure to engage in fair and reasonable data security practices is generally deemed to be a violation of the \nVermont Consumer Protection Act."]
["What are the data subjects' rights?","CVR 10-060-033 requires that the Vermont Commissioner of Taxes must provide consumers with reasonable access to their own personally identifiable information in the state’s possession, as well as the right to correct any inaccurately recorded information. \n"]
["Are there restrictions on cross-border data transfers?","N/A\n"]
["Are there any notification requirements for data breaches?"," The Vermont Security Breach Notice Act contains the following notice requirements for breaches involving PII : \n\n \n\t Preliminary notice must be given to the Vermont Attorney General’s Office or the Vermont Department of Financial Regulation within 14 business days after discovery of a breach or at the same time notice of the breach is provided to consumers, whichever is sooner.  The notice must include the date of the breach, the date of discovery of the breach, a description of the breach (including the number of Vermont consumers affected, if known), and a copy of the notice provided to consumers if already made.   \n\t Notice to affected consumers must be given as quickly as possible and without unreasonable delay, but no later than 45 days after the discovery of a breach.  The notice must be clear and conspicuous and must include the following if known: a description of the breach itself (in general terms), including the approximate date of the breach and the type of PII that was subject to the breach; a description of the general actions taken to protect the PII from further breaches; a telephone number (toll-free if available) consumers may call for further information and assistance; and advice directing consumers to remain vigilant by reviewing account statements and monitoring free credit reports. The notice may be made by written, electronic, or telephonic means, or in some instances by substitute means (website notice or statewide and regional media notice).  \n \n\n The Security Breach Notice Act contains the following notice requirements for breaches that are limited to login credentials: \n\n \n\t A data collector is only required to provide notice of the security breach to the Attorney General or Department of Financial Regulation, as applicable, if the login credentials were acquired directly from the data collector or its agent. \n\t If the login credentials are for an online account other than an e-mail account, the data collector must provide notice to the consumer electronically or through other authorized means (written, telephonic, or substitute) and must advise the consumer to take steps necessary to protect the online account, including to change his or her login credentials for the account and for any other account for which the consumer uses the same login credentials. \n\t If the breach is limited to login credentials for an email account, the data collector may not provide notice of the breach through that email account, and must provide notice through written, electronic, or telephonic means, or in some instances by substitute means, or by clear and conspicuous notice delivered to the consumer online when the consumer is connected to the online account from an Internet protocol address or online location from which the data collector knows the consumer customarily accesses the account.   \n \n\n In all cases, the required notice may be delayed if requested to do so by a law enforcement agency. If the request is not made in writing, it must be documented in writing, including the name of the law enforcement agency and officer.  After the agency reports that there is no longer a need to delay the required notification, such notification must be made without unreasonable delay. \n\n Notice of a breach is not required if (1) the data collector establishes that misuse of personal information personally identifiable information or login credentials is not reasonably possible and (2) the data collector provides notice of the determination of this fact and a detailed explanation for the determination to the Vermont Attorney General or to the Department of Financial Regulation, as applicable.  If the data collector subsequently obtains facts indicating that misuse of the personal information personally identifiable information or login credentials has occurred or is occurring, the data collector must provide notice of the breach. \n\n If notice must be provided to more than 1,000 consumers for a breach, notice must also be promptly given to all national consumer credit reporting agencies of the timing, distribution, and content of the consumer notice. \n\n A data collector that is subject to the privacy, security, and breach notification rules adopted in 45 C.F.R. Part 164 pursuant to the federal Health Insurance Portability and Accountability Act is deemed to be in compliance with the Security Breach Notice Act if (1) the data collector experiences a security breach that is limited to personally identifiable information specified in 2430(10)(A)(vii) ; and (2) the data collector provides notice to affected consumers pursuant to the requirements of the breach notification rule in 45 C.F.R. Part 164. \n"]
["Who is the privacy regulator?","The Vermont Attorney General’s Office is the primary regulator of matters concerning privacy and data security in Vermont. Other agencies that have issued regulations covering privacy issues include the Vermont Department of Financial Regulation; the Vermont Department of Banking, Insurance, Securities & Health Care Administration; the Vermont Agency of Human Services; and the Vermont Department of Public Service.\n"]
["What are the consequences of a privacy breach?","The \nVermont Security Breach Notice Act is enforced under the same authority as the \nVermont Consumer Protection Act. Enforcement actions under the \nAct may seek injunctive relief and civil penalties of up to USD $10,000 per violation per day. (Other Vermont privacy-related laws contain similar enforcement provisions.) In addition to enforcement actions, a party experiencing a data breach is potentially subject to private lawsuits arising from compromised personal information.\n"]
["How is electronic marketing regulated?","Electronic marketing is generally regulated under the \nVermont Consumer Protection Act (\nTitle 9, Chapter 63 of the Vermont Statutes, 9 V.S.A. §§ 2451 et seq.), which covers “unfair methods of competition, unfair or deceptive acts or practices, and anti-competitive practices in order to protect the public and to encourage fair and honest competition.” Also, the Vermont Attorney General issues rules and conducts investigations and enforcement actions in the area of consumer protection.\n"]
["Are there any recent developments or expected reforms?","Vermont has introduced four bills – \nH.75, H.160, H.233, and\n H.570. These bills are all still in committee. \nH.75 proposes the adoption of consumer protection measures allowing consumers to opt-out of using technology for facial and voice recognition, requiring consent for the collection of data from minors, and requiring that businesses operating social networking services provide consumers an option to delete all personally identifiable data in the records upon closing their account. \nH.160 proposes the adoption of consumer privacy protections giving Vermonters more control over the amount and type of data that personal device manufacturers and service providers collect about them, as well as the adoption of other protections similar to those in the \nCalifornia Consumer Privacy Act. H.233 proposes consumer privacy measures to protect the confidentiality of consumers’ genetic data. H.570 proposes to enhance data privacy protections for consumers.\nNote: Vermont’s data broker statute is the first of its kind in the nation. Also, Vermont’s 14-day “preliminary notice” requirement for data breaches is unique to the state.\n"]