Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

On May 8, 2012, the Vermont General Assembly approved changes to the state&rsquo;s consumer protection law (Act 109, in effect on passage 5/8/12).&nbsp; The changes include substantial revisions to Vermont&rsquo;s data protection and notification law.&nbsp; A summary of the changes are provided below.&nbsp;
<ul>
<li>The term &ldquo;personally identifiable information&rdquo; (&ldquo;PII&rdquo;) has been adopted. </li>
<li>&nbsp;&ldquo;Security breach&rdquo; is defined as the &ldquo;unauthorized acquisition of electronic data or a reasonable belief of an unauthorized acquisition of electronic data.&rdquo;&nbsp; </li>
<li>In determining whether PII has been or reasonably believed to have been acquired, the following factors may be considered: 
<ul>
<li>Physical possession of the information (such as a lost or stolen computer or device);</li>
<li>Indications that information has been downloaded or copied;</li>
<li>Indications that information has been used (opening of fraudulent accounts or instances of identity theft reported); and</li>
<li>Information has been made public.&nbsp;&nbsp;&nbsp;</li>
</ul>
</li>
</ul>
Notification of a security breach to a consumer:&nbsp;
<ul>
<li>must be made no later than 45 days after discovery, and</li>
<li>the approximate date of the security breach must also be provided to consumers.&nbsp;</li>
</ul>
For notice of a security breach to the attorney general, two notifications are required:
<ul>
<li>First, within 14 business days of the discovery of the incident, the attorney general must be provided the date of the security breach, date of discovery, and a preliminary description of the breach.&nbsp; 
<ul>
<li>For an entity that has sworn in writing to the attorney general that it maintains written policies and procedures to maintain the security of PII, the attorney general must be provided the date of the security breach, date of discovery, and a preliminary description of the breach prior to notifying consumers.&nbsp; </li>
</ul>
</li>
<li>Second, once notice is made to consumers, the attorney general must be notified of the number of Vermont consumers affected and provided a copy of the notice.&nbsp; 
<ul>
<li>A second copy of the consumer notification letter, with PII that was subject to the breach redacted, can also be provided to the attorney general which will be used for any public disclosure of the breach.&nbsp;</li>
</ul>
</li>
</ul>
The Vermont General Assembly&rsquo;s Act 109 can be found <a href="http://www.leg.state.vt.us/docs/2012/Acts/ACT109.pdf">here</a>.&nbsp;

Significant Changes to Vermont’s Data Protection and Notification Law