Vermont H. 208: An act relating to creating the Commission on the State Bank of Vermont

Bill Text

BILL AS INTRODUCED H.208
2025 Page 1 of 65

VT LEG #378938 v.1
H.208 1
Introduced by Representatives Priestley of Bradford, Marcotte of Coventry, 2
Arsenault of Williston, Austin of Colchester, Berbeco of 3
Winooski, Bos-Lun of Westminster, Bosch of Clarendon, 4
Boyden of Cambridge, Brown of Richmond, Burke of 5
Brattleboro, Burrows of West Windsor, Campbell of St. 6
Johnsbury, Carris-Duncan of Whitingham, Casey of 7
Montpelier, Chapin of East Montpelier, Cina of Burlington, 8
Cole of Hartford, Cordes of Bristol, Donahue of Northfield, 9
Duke of Burlington, Eastes of Guilford, Goldman of 10
Rockingham, Graning of Jericho, Greer of Bennington, Harple 11
of Glover, Headrick of Burlington, Holcombe of Norwich, 12
Krasnow of South Burlington, Lipsky of Stowe, Masland of 13
Thetford, McCann of Montpelier, McGill of Bridport, Micklus 14
of Milton, Mihaly of Calais, Minier of South Burlington, 15
Mrowicki of Putney, Nugent of South Burlington, O’Brien of 16
Tunbridge, Ode of Burlington, Olson of Starksboro, Pezzo of 17
Colchester, Pouech of Hinesburg, Rachelson of Burlington, 18
Satcowitz of Randolph, Sibilia of Dover, Stevens of Waterbury, 19
Surprenant of Barnard, Tomlinson of Winooski, Torre of 20
Moretown, Waszazak of Barre City, and White of Bethel 21

BILL AS INTRODUCED H.208
2025 Page 2 of 65

VT LEG #378938 v.1
Referred to Committee on 1
Date: 2
Subject: Commerce and trade; consumer protection; data privacy 3
Statement of purpose of bill as introduced: This bill proposes to provide data 4
privacy and online surveillance protections to Vermonters. 5
An act relating to consumer data privacy and online surveillance 6
It is hereby enacted by the General Assembly of the State of Vermont: 7
Sec. 1. 9 V.S.A. chapter 61A is added to read: 8
CHAPTER 61A. VERMONT DATA PRIVACY AND ONLINE 9
SURVEILLANCE ACT 10
§ 2415. DEFINITIONS 11
As used in this chapter: 12
(1)(A) “Affiliate” means a legal entity that shares common branding 13
with another legal entity or controls, is controlled by, or is under common 14
control with another legal entity. 15
(B) As used in subdivision (A) of this subdivision (1), “control” or 16
“controlled” means: 17
(i) ownership of, or the power to vote, more than 50 percent of the 18
outstanding shares of any class of voting security of a company; 19

BILL AS INTRODUCED H.208
2025 Page 3 of 65

VT LEG #378938 v.1
(ii) control in any manner over the election of a majority of the 1
directors or of individuals exercising similar functions; or 2
(iii) the power to exercise controlling influence over the 3
management of a company. 4
(2) “Authenticate” means to use reasonable means to determine that a 5
request to exercise any of the rights afforded under subdivisions 2418(a)(1)–6
(6) of this title is being made by, or on behalf of, the consumer who is entitled 7
to exercise the consumer rights with respect to the personal data at issue. 8
(3)(A) “Biometric data” means data generated from the technological 9
processing of an individual’s unique biological, physical, or physiological 10
characteristics that allow or confirm the unique identification of the consumer, 11
including: 12
(i) iris or retina scans; 13
(ii) fingerprints; 14
(iii) facial or hand mapping, geometry, or templates; 15
(iv) vein patterns; 16
(v) voice prints or vocal biomarkers; and 17
(vi) gait or personally identifying physical movement or patterns. 18
(B) “Biometric data” does not include: 19
(i) a digital or physical photograph; 20
(ii) an audio or video recording; or 21

BILL AS INTRODUCED H.208
2025 Page 4 of 65

VT LEG #378938 v.1
(iii) any data generated from a digital or physical photograph, or 1
an audio or video recording, unless such data is generated to identify a specific 2
individual. 3
(4) “Business associate” has the same meaning as in HIPAA. 4
(5) “Child” has the same meaning as in COPPA. 5
(6)(A) “Consent” means a clear affirmative act signifying a consumer’s 6
freely given, specific, informed, and unambiguous agreement to allow the 7
processing of personal data relating to the consumer in response to a specific 8
request, provided the request: 9
(i) is provided to the consumer in a clear and conspicuous 10
disclosure; 11
(ii) includes a description of the processing purpose for which the 12
consumer’s consent is sought; 13
(iii) clearly distinguishes between an act or practice that is 14
necessary to fulfill a request of the consumer and an act or practice that is for 15
another purpose; 16
(iv) clearly states the specific categories of personal data that the 17
controller intends to collect or process under each act or practice; 18
(v) clearly states the specific categories of personal data that the 19
controller intends to collect or process under each act or practice; and 20
(vi) is accessible to a consumer with disabilities. 21

BILL AS INTRODUCED H.208
2025 Page 5 of 65

VT LEG #378938 v.1
(B) “Consent” may include a written statement, including by 1
electronic means, or any other unambiguous affirmative ac