What happened?

The Vermont legislature recently passed H. 121, the Vermont Data Privacy Act. This law makes Vermont the 18th state to grant consumers privacy rights similar to those under the California Consumer Privacy Act (CCPA). The Act is scheduled to go into effect on July 1, 2025.

What are the details?

Applicability

The Vermont Data Privacy Act (H. 121) applies to businesses that process or control the personal data of at least 25,000 consumers in Vermont in a given year. It also applies to businesses that make more than 50% of their gross revenue from selling personal data. The law also applies to people who do business in Vermont or produce products or services for Vermont residents.

Provisions

• The Act includes provisions similar to the CCPA, such as consumer rights to delete, access, correct, and opt-out.
• However, it also includes some provisions that are more protective than the CCPA:
  • Data Minimization: The Act prohibits businesses from collecting personal information for any purpose outside of providing the product or service.
  • Private Right of Action: The Act grants consumers a private right of action against businesses not only when the entity causes a breach of personal information, but also if the business misuses data about their race, religion, sexual orientation, health, or other categories of sensitive information.

Limitations and Future Considerations

• The law’s private right of action must be reauthorized after two years and only applies to large data brokers.
• The Vermont legislature passed this law amidst the push by the federal government to pass a comprehensive privacy law, which has yet to come to fruition over the last decade.
• Businesses should continue to monitor new consumer privacy rights laws and consider how these laws may affect their data collection and use practices.

Business Considerations

• Data Collection Practices: With the data minimization requirements, businesses should review and possibly revise their data collection practices to ensure they are not collecting personal information for any purpose outside of providing the product or service.
• Consumer Rights: Businesses should understand and implement processes to handle consumer rights to delete, access, correct, and opt-out of their personal data.
• Private Right of Action: Businesses should be aware of the expanded private right of action and consider the potential legal risks associated with misuse of sensitive information.
• Reauthorization Requirement: Businesses, especially large data brokers, should keep track of the reauthorization requirement for the law’s private right of action and plan accordingly.
• Ongoing Monitoring: Given the evolving nature of privacy laws, businesses should continue to monitor new consumer privacy rights laws and consider how these laws may affect their data collection and use practices.

Source References

• Vermont Data Privacy Act, Most Robust Consumer Protections Since CCPA
• Official Bill Page: H 121
• H121 – Vermont Data Privacy Act

Resources

• Vermont’s data privacy law sparks state lawmaker alliance against tech lobbyists

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.