§ 2415i. Construction of duties [Effective January 1, 2028]
(a) Generally. This subchapter shall not be construed to restrict a controller’s, processor’s, or consumer health data controller’s ability to:
(1) comply with federal, state, or municipal laws, ordinances, or regulations, except as prohibited by 1 V.S.A. § 150;
(2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, municipal, or other governmental authorities;
(3) cooperate with law enforcement agencies concerning conduct or activity that the controller, processor, or consumer health data controller reasonably and in good faith believes may violate federal, state, or municipal laws, ordinances, or regulations;
(4) investigate, establish, exercise, prepare for, or defend legal claims;
(5) provide a product or service specifically requested by a consumer;
(6) perform under a contract to which a consumer is a party, including fulfilling the terms of a written warranty;
(7) take steps at the request of a consumer prior to entering into a contract;
(8) take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another individual, and if the processing cannot be manifestly based on another legal basis;
(9) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for the action;
(10) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board that determines, or similar independent oversight entities that determine:
(A) whether the deletion of the information is likely to provide substantial benefits that do not exclusively accrue to the controller;
(B) the expected benefits of the research outweigh the privacy risks; and
(C) whether the controller or consumer health data controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification;
(11) assist another controller, processor, consumer health data controller, or third party with any of the obligations under this subchapter; or
(12) process personal data for reasons of public interest in the area of public health, community health, or population health, but solely to the extent that the processing is:
(A) subject to suitable and specific measures to safeguard the rights of the consumer whose personal data are being processed; and
(B) under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law.
(b) Internal use of data. The obligations imposed on controllers, processors, or consumer health data controllers under this subchapter shall not restrict a controller’s, processor’s, or consumer health data controller’s ability to collect, use, or retain data for internal use to:
(1) conduct internal research to develop, improve, or repair products, services, or technology;
(2) effectuate a product recall;
(3) identify and repair technical errors that impair existing or intended functionality;
(4) process personal data for the purposes of profiling in furtherance of any automated decision that may produce any legal or similarly significant effect concerning a consumer, provided the personal data are:
(A) processed only to the extent necessary to detect or correct any bias that may result from processing the data for such purposes, the bias cannot effectively be detected or corrected without processing the data, and the data are deleted once the processing has been completed;
(B) processed subject to appropriate safeguards to protect the rights of consumers secured by the Constitution or laws of this State or of the United States;
(C) subject to technical restrictions concerning the reuse of the data and industry-standard security and privacy measures, including pseudonymization;
(D) subject to measures to ensure that the data are secure, protected, and subject to suitable safeguards, including strict controls concerning, and documentation of, access to the data, to avoid misuse and ensure that only authorized persons may access the data while preserving the confidentiality of the data; and
(E) not transmitted, transferred, or otherwise accessed by any third party;
(5) perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer’s existing relationship with the controller or consumer health data controller, or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party; or
(6) perform internal operations in accordance with the internal operations exception established in COPPA if the controller, processor, or consumer health data controller is processing data in accordance with the exception.
(c) Evidentiary privilege.
(1) The obligations imposed on controllers, processors, or consumer health data controllers under this subchapter shall not apply if compliance by the controller, processor, or consumer health data controller with this subchapter would violate an evidentiary privilege under the laws of this State.
(2) This subchapter shall not be construed to prevent a controller, processor, or consumer health data controller from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this State as part of a privileged communication.
(3) Nothing in this subchapter modifies 2020 Acts and Resolves No. 166, Sec. 14 or authorizes the use of facial recognition technology by law enforcement.
(d) Third parties.
(1) A controller, processor, or consumer health data controller that discloses personal data to a processor or third-party controller pursuant to this subchapter shall not be deemed to have violated this subchapter if the processor or third-party controller that receives and processes the personal data violates this subchapter, provided, at the time the disclosing controller, processor, or consumer health data controller disclosed the personal data, the disclosing controller, processor, or consumer health data controller did not have actual knowledge that the receiving processor or third-party controller would violate this subchapter.
(2) A third-party controller or processor receiving personal data from a controller, processor, or consumer health data controller in compliance with this subchapter is not in violation of this subchapter for the transgressions of the controller, processor, or consumer health data controller from which the third-party controller or processor receives the personal data.
(e) Clarifications. This subchapter shall not be construed to:
(1) impose any obligation on a controller or processor that adversely affects the rights or freedoms of any person, including the rights of any person:
(A) to freedom of speech or freedom of the press guaranteed in the First Amendment to the U.S. Constitution; or
(B) under 12 V.S.A. § 1615;
(2) apply to any person’s processing of personal data in the course of the person’s purely personal or household activities; or
(3) require an independent school as defined in 16 V.S.A. § 11(a)(8) or a private institution of higher education, as defined in 20 U.S.C. § 1001 et seq., to delete personal data or opt out of processing of personal data that would unreasonably interfere with the provision of education services by or the ordinary operation of the school or institution.
(f) Personal data processing.
(1) Personal data processed by a controller or consumer health data controller pursuant to this section may be processed to the extent that the processing is:
(A) reasonably necessary and proportionate to the purposes listed in this section; and
(B) adequate, relevant, and limited to what is necessary in relation to the specific purposes listed in this section.
(2)(A) The collection, use, or retention of personal data pursuant to subsection (b) of this section shall, where applicable, take into account the nature and purpose or purposes of the collection, use, or retention.
(B) The data shall be subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data and to reduce reasonably foreseeable risks of harm to consumers relating to the collection, use, or retention of personal data.
(3) If a controller or consumer health data controller processes personal data pursuant to an exemption in this section, the controller or consumer health data controller bears the burden of demonstrating that the processing qualifies for the exemption and complies with the requirements of this subsection.
(4) Processing personal data for the purposes expressly identified in this section shall not solely make a legal entity a controller or consumer health data controller with respect to the processing. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)