To date, there is no comprehensive Vermont privacy law in effect. The good news is that a bill for consumer privacy has been introduced this year in the state legislature.
Proposal for Vermont Consumer Privacy Act
The Vermont House is considering House Bill 121 which would change Vermont’s consumer privacy status to grant citizens the option of asking that their data not be monitored by data brokers and that any data that has already been gathered be erased. The rule would also forbid businesses from taking customers’ fingerprints without their permission and from giving them to law authorities without a court order.
On January 26, 2023, Vermont House lawmakers introduced a Vermont privacy act House Bill 121, titled “An act relating to enhancing consumer privacy.” Similar to the data privacy legislation proposed in Washington, Vermont’s HB 121 is a thoroughly updated consumer privacy law with provisions pertaining to biometrics.
Important Definitions in the Act
Biometric Identifier
The bill adds a definition for “biometric identifier,” specifically as “unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee of the data to identify or authenticate the consumer, including a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data.”
Personal Information
According to the bill, “personal information” comprises personally identifiable information, brokered personal information, login information, and covered information. It is defined as “any information that identifies, relates to, describes, or is capable of being associated with a particular consumer.” This definition is in line with the expansive meaning of “personal information” or phrases of a similar kind in the GDPR and the various state privacy laws in the United States. Furthermore, it is specifically stated in the bill’s definition that the phrase “shall be interpreted broadly.” However, the definition does not include regularly used exceptions such as information that is publicly accessible, aggregated, de-identified, and pseudonymized.
Sale of Personal Data
The bill adds a definition for “sale of personal data” to mean “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means personal information by the business to another business or a third party for monetary or other valuable consideration.” The meaning goes far beyond actual “selling” as that term is commonly understood. The proposed term is comparable to those found in other state laws in the United States. By adding the phrase “or other valuable consideration,” Vermont is modeling itself after the standard set by California, Colorado, and Connecticut. This significantly broadens the definition’s applicability to circumstances in which personal information is shared with third parties in exchange for anything of value.
Protecting Biometric Data
Illinois, Texas, and Washington are the three American states that have passed legislation specifically addressing privacy concerns in regard to biometric data. In many other states, legislation pertaining to biometric data is being proposed. The Vermont law proposes extensive requirements for “biometric identifiers,” as described above in Section A, continuing the trend started by Illinois, Texas, and Washington.
Centraleyes will keep you updated on the status of Vermont’s HB 121, as well as other state privacy laws.
