Vermont S 93: An act relating to the creation of an income tax deduction for union dues

Bill Text

BILL AS INTRODUCED S.93
2025 Page 1 of 45

VT LEG #380226 v.1
S.93 1
Introduced by Senators Chittenden, Beck, Cummings, Mattos and Ram 2
Hinsdale 3
Referred to Committee on 4
Date: 5
Subject: Commerce and trade; consumer protection; data privacy 6
Statement of purpose of bill as introduced: This bill proposes to provide data 7
privacy protections to Vermonters. 8
An act relating to consumer data privacy 9
It is hereby enacted by the General Assembly of the State of Vermont: 10
Sec. 1. 9 V.S.A. chapter 61A is added to read: 11
CHAPTER 61A. VERMONT DATA PRIVACY ACT 12
§ 2415. DEFINITIONS 13
As used in this chapter: 14
(1) “Abortion” means terminating a pregnancy for any purpose other 15
than producing a live birth. 16
(2)(A) “Affiliate” means a legal entity that shares common branding 17
with another legal entity or controls, is controlled by, or is under common 18
control with another legal entity. 19

BILL AS INTRODUCED S.93
2025 Page 2 of 45

VT LEG #380226 v.1
(B) As used in subdivision (A) of this subdivision (2), “control” or 1
“controlled” means: 2
(i) ownership of, or the power to vote, more than 50 percent of the 3
outstanding shares of any class of voting security of a company; 4
(ii) control in any manner over the election of a majority of the 5
directors or of individuals exercising similar functions; or 6
(iii) the power to exercise controlling influence over the 7
management of a company. 8
(3) “Authenticate” means to use reasonable means to determine that a 9
request to exercise any of the rights afforded under subdivisions 2418(a)(1)–10
(4) of this title is being made by, or on behalf of, the consumer who is entitled 11
to exercise the consumer rights with respect to the personal data at issue. 12
(4)(A) “Biometric data” means personal data generated by automatic 13
measurements of an individual’s unique biological patterns or characteristics 14
that are used to identify a specific individual. 15
(B) “Biometric data” does not include: 16
(i) a digital or physical photograph; 17
(ii) an audio or video recording; or 18
(iii) any data generated from a digital or physical photograph, or 19
an audio or video recording, unless such data is generated to identify a specific 20
individual. 21

BILL AS INTRODUCED S.93
2025 Page 3 of 45

VT LEG #380226 v.1
(5) “Business associate” has the same meaning as in HIPAA. 1
(6) “Child” has the same meaning as in COPPA. 2
(7)(A) “Consent” means a clear affirmative act signifying a consumer’s 3
freely given, specific, informed, and unambiguous agreement to allow the 4
processing of personal data relating to the consumer. 5
(B) “Consent” may include a written statement, including by 6
electronic means, or any other unambiguous affirmative action. 7
(C) “Consent” does not include: 8
(i) acceptance of a general or broad terms of use or similar 9
document that contains descriptions of personal data processing along with 10
other, unrelated information; 11
(ii) hovering over, muting, pausing, or closing a given piece of 12
content; or 13
(iii) agreement obtained through the use of dark patterns. 14
(8)(A) “Consumer” means an individual who is a resident of the State. 15
(B) “Consumer” does not include an individual acting in a 16
commercial or employment context or as an employee, owner, director, officer, 17
or contractor of a company, partnership, sole proprietorship, nonprofit, or 18
government agency whose communications or transactions with the controller 19
occur solely within the context of that individual’s role with the company, 20
partnership, sole proprietorship, nonprofit, or government agency. 21

BILL AS INTRODUCED S.93
2025 Page 4 of 45

VT LEG #380226 v.1
(9) “Consumer health data” means any personal data that a controller 1
uses to identify a consumer’s physical or mental health condition or diagnosis, 2
including gender-affirming health data and reproductive or sexual health data. 3
(10) “Consumer health data controller” means any controller that, alone 4
or jointly with others, determines the purpose and means of processing 5
consumer health data. 6
(11) “Controller” means a person who, alone or jointly with others, 7
determines the purpose and means of processing personal data. 8
(12) “COPPA” means the Children’s Online Privacy Protection Act of 9
1998, 15 U.S.C. § 6501–6506, and any regulations, rules, guidance, and 10
exemptions adopted pursuant to the act, as the act and regulations, rules, 11
guidance, and exemptions may be amended. 12
(13) “Covered entity” has the same meaning as in HIPAA. 13
(14) “Dark pattern” means a user interface designed or manipulated with 14
the substantial effect of subverting or impairing user autonomy, decision-15
making, or choice and includes any practice the Federal Trade Commission 16
refers to as a “dark pattern.” 17
(15) “Decisions that produce legal or similarly significant effects 18
concerning the consumer” means decisions made by the controller that result in 19
the provision or denial by the controller of