Vermont Passes Groundbreaking Consumer Data Privacy Law

The Green Mountain State has taken a bold step forward in protecting the privacy rights of its residents. On May 12, 2024, Vermont State Representative Monique Priestley announced via LinkedIn that the Vermont House of Representatives and the State Senate passed House Bill 121 , a comprehensive act to enhance consumer privacy. This milestone legislation, known as the Vermont Data Privacy Act, is set to revolutionize how personal data is handled and safeguarded in the state.

Key Provisions of the Vermont Data Privacy Act:

1. Scope: The bill applies to businesses that conduct operations in Vermont or target their products or services to Vermont residents. It also applies to businesses that either control or process the personal data of at least 25,000 consumers or derive more than 50% of their gross revenue from the sale of personal data.
2. Consumer Rights: Vermonters will gain the right to opt out of processing their data for purposes such as targeted advertising, sale of personal data, or profiling, which leads to automated decisions with significant effects on the consumer. Controllers must respond to consumer requests within 60 days and provide information free of charge once per year.
3. Obligations of Controllers and Processors: The bill lists specific duties for those who control or process personal data, including special obligations towards minors. Controllers are prohibited from processing the personal data of known minors for targeted advertising purposes.
4. Confidentiality of Consumer Health Data: The bill includes strict provisions to protect the confidentiality of consumer health data, prohibiting its sale or unauthorized access by employees, contractors, or processors.
5. Artificial Intelligence and Data Privacy Advisory Council: The bill establishes an advisory council to guide the development, employment, and procurement of artificial intelligence in the Vermont State Government.
6. Age-Appropriate Design Code: The bill introduces an Age-Appropriate Design Code that recognizes minor consumers' distinct needs and diversities at different age ranges. Covered businesses must adhere to a minimum duty of care when processing minors' data and are prohibited from engaging in practices that exploit or harm minors.

Effective Dates and Enforcement:

The provisions relating to the Artificial Intelligence and Data Privacy Advisory Council will take effect on July 1, 2024, while the Vermont Data Privacy Act, Protection of Personal Information, and the Age-Appropriate Design Code will come into force on July 1, 2025. The Attorney General of Vermont is granted the authority to enforce the bill's provisions, although there is no private right of action.

The passage of the Vermont Data Privacy Act marks a significant milestone in the ongoing battle to protect consumer privacy rights in the digital age. As one of the most comprehensive state privacy laws, it sets a high bar for other states. Businesses operating in Vermont or serving Vermont residents must carefully review their data practices and make necessary adjustments to comply with these new requirements.

Representative Priestley's announcement on LinkedIn has generated buzz among privacy advocates, consumers, and industry stakeholders. As the bill awaits the Governor's signature, Vermonters can look forward to a future where their data is treated with the respect and protection it deserves.

Track the progress of the bill here .