Bill > S0269

This bill proposes to afford data privacy protections to Vermonters. The key provisions include: - Defining terms and setting the scope of the Vermont Data Privacy Act, which applies to businesses that collect or process personal data of Vermont residents above certain thresholds. - Granting consumers the rights to confirm processing of their personal data, correct inaccuracies, delete their data, and opt-out of targeted advertising, data sales, and certain automated decision-making. - Establishing duties for controllers (businesses that determine the purpose and means of data processing) and processors (businesses that process data on behalf of controllers), including requirements for security, transparency, and consumer consent. - Creating a data protection assessment process for controllers to evaluate and mitigate risks associated with certain high-risk data processing activities. - Providing an enforcement role for the Vermont Attorney General, including the ability to issue notices of violation and civil penalties for non-compliance. - Amending existing law to add requirements for data brokers, including a registration system, consumer opt-out mechanisms, and credentialing procedures for data recipients. - Establishing new protections for the collection and use of biometric identifiers like fingerprints and iris scans.