Bill > H0211

This bill significantly updates Vermont's data privacy laws, particularly concerning data brokers, by expanding definitions of personal information, including biometric data and precise geolocation, and clarifying what constitutes a "direct relationship" between a business and a consumer to avoid being classified as a data broker. It mandates that data brokers must register annually with the Secretary of State, pay a $900 fee, maintain a $20,000 bond, and disclose extensive information about their data collection practices, including specific categories of sensitive data they collect and with whom they share it, with a new requirement to provide a URL to a consumer rights webpage. The bill also introduces new requirements for data brokers regarding the disclosure of brokered personal information, requiring them to verify prospective users' identities and stated purposes for seeking the data, and prohibits its use for stalking, harassment, fraud, or unlawful discrimination. Furthermore, it establishes a new "Data Broker Security Breach Notice Act" requiring data brokers to notify consumers and the Attorney General within 45 days of discovering a breach, and mandates that the Secretary of State study the feasibility of a centralized deletion mechanism for consumers to request the removal of their data from all registered data brokers. The bill also makes changes to the Cybersecurity Advisory Council's membership and extends the repeal date for a chapter on cybersecurity, while also introducing new registration requirements for providers of educational technology products used in Vermont schools.