Vermont S 70: An act relating to data brokers and personal information

Bill Text

BILL AS INTRODUCED S.70
2025 Page 1 of 30

VT LEG #380863 v.1
S.70 1
Introduced by Senators Clarkson, Harrison, Hashim, Major, Vyhovsky and 2
White 3
Referred to Committee on 4
Date: 5
Subject: Commerce and trade; protection of personal information; data brokers 6
Statement of purpose of bill as introduced: This bill proposes to add various 7
provisions to Vermont’s laws that protect the personal information of its 8
residents, including requiring data brokers to provide notice of security 9
breaches, to certify that the personal information it discloses will be used for a 10
legitimate purpose, and to delete the personal information of consumers who 11
make such a request through the use of an accessible deletion mechanism. 12
An act relating to data brokers and personal information 13
It is hereby enacted by the General Assembly of the State of Vermont: 14
Sec. 1. 9 V.S.A. chapter 62 is amended to read: 15
CHAPTER 62. PROTECTION OF PERSONAL INFORMATION 16
Subchapter 1. General Provisions 17
§ 2430. DEFINITIONS 18
As used in this chapter: 19
(1) “Authorized agent” means: 20

BILL AS INTRODUCED S.70
2025 Page 2 of 30

VT LEG #380863 v.1
(A) a person designated by a consumer to act on the consumer’s 1
behalf; 2
(B) a parent or legal guardian that acts on behalf of the parent’s child 3
or on behalf of a child for whom the guardian has legal responsibility; or 4
(C) a guardian or conservator that acts on behalf of a consumer that is 5
subject to a guardianship, conservatorship, or other protective arrangement. 6
(2)(A) “Biometric data” means data generated from the technological 7
processing of an individual’s unique biological, physical, or physiological 8
characteristics that is linked or reasonably linkable to an individual, including: 9
(i) iris or retina scans; 10
(ii) fingerprints; 11
(iii) facial or hand mapping, geometry, or templates; 12
(iv) vein patterns; 13
(v) voice prints; and 14
(vi) gait or personally identifying physical movement or patterns. 15
(B) “Biometric data” does not include: 16
(i) a digital or physical photograph; 17
(ii) an audio or video recording; or 18
(iii) any data generated from a digital or physical photograph, or 19
an audio or video recording, unless such data is generated to identify a specific 20
individual. 21

BILL AS INTRODUCED S.70
2025 Page 3 of 30

VT LEG #380863 v.1
(3)(A) “Brokered personal information” means one or more of the 1
following computerized data elements about a consumer, if categorized or 2
organized for dissemination to third parties: 3
(i) name; 4
(ii) address; 5
(iii) date of birth; 6
(iv) place of birth; 7
(v) mother’s maiden name; 8
(vi) unique biometric data generated from measurements or 9
technical analysis of human body characteristics used by the owner or licensee 10
of the data to identify or authenticate the consumer, such as a fingerprint, retina 11
or iris image, or other unique physical representation or digital representation 12
of biometric data; 13
(vii) name or address of a member of the consumer’s immediate 14
family or household; 15
(viii) Social Security number or other government-issued 16
identification number; or 17
(ix) phone number; or 18
(x) other information that, alone or in combination with the other 19
information sold or licensed, would allow a reasonable person to identify the 20
consumer with reasonable certainty. 21

BILL AS INTRODUCED S.70
2025 Page 4 of 30

VT LEG #380863 v.1
(B) “Brokered personal information” does not include publicly 1
available information to the extent that it is related to a consumer’s business or 2
profession. 3
(2)(4) “Business” means a controller, a consumer health data controller, 4
a processor, or a commercial entity, including a sole proprietorship, 5
partnership, corporation, association, limited liability company, or other group, 6
however organized and whether or not organized to operate at a profit, 7
including a financial institution organized, chartered, or holding a license or 8
authorization certificate under the laws of this State, any other state, the United 9
States, or any other country, or the parent, affiliate, or subsidiary of a financial 10
institution, but does not include the State, a State agency, any political 11
subdivision of the State, or a vendor acting solely on behalf of, and at the 12
direction of, the State. 13
(3)(5) “Consumer” means an individual residing in this State. 14
(6) “Consumer health data controller” means any controller that, alone 15
or jointly with others, determines the purpose and means of processing 16
consumer health data. 17
(7) “Controller” means a person who, alone or jointly with others, 18
determines the purpose and means of processing personal data. 19
(4)(8)(A) “Data broker” means a business, or unit or units of a business, 20
separately or together, that knowingly collects and sells or licenses to third 21

BILL AS INTRODUCED S.70
2025 Page 5 of 30

VT LEG #380863 v.1
parties the brokered personal information of a consumer with who