Title 09, Commerce and Trade

§ 2415e. Duties of controllers [Effective January 1, 2028] (a) Data collection and processing. A controller shall: (1) limit the collection of a consumer’s personal data to what is reasonably necessary and proportionate in relation to the purposes for which the data are processed…

§ 2415f. Processors’ duties; contracts between controllers and processors [Effective January 1, 2028] (a) Generally. A processor shall adhere to the instructions of a controller and shall assist the controller in meeting the controller’s obligations under this subchapter, includi…

§ 2415g. Data protection and impact assessments; disclosure to Attorney General [Effective January 1, 2028] (a) Generally. A controller shall conduct and document a data protection assessment for each of the controller’s processing activities that presents a heightened risk of ha…

§ 2415h. Deidentified data [Effective January 1, 2028] (a) Requirements. A controller in possession of deidentified data shall: (1) take reasonable measures to ensure that the data cannot be associated with an individual; (2) publicly commit to maintaining and using deidentified …

§ 2415i. Construction of duties [Effective January 1, 2028] (a) Generally. This subchapter shall not be construed to restrict a controller’s, processor’s, or consumer health data controller’s ability to: (1) comply with federal, state, or municipal laws, ordinances, or regulation…

§ 2415j. Attorney General enforcement; reporting [Effective January 1, 2028] (a) Consumer Protection Act. A violation of this subchapter shall be deemed a violation of the Vermont Consumer Protection Act, pursuant to chapter 63 of this title. The Attorney General has the same aut…

§ 2415k. Consumer health data privacy [Effective January 1, 2028] A person shall not: (1) provide any employee or contractor with access to consumer health data unless the employee or contractor is subject to a contractual or statutory duty of confidentiality; (2) provide any pro…

§ 2421a. Short title and definitions (a) This subchapter shall be known, and may be cited, as the “Genetic Information Privacy Act.” (b) As used in this subchapter: (1) “Affirmative authorization” means an action that demonstrates an intentional decision by a consumer. (2) “Biolo…

§ 2421b. Requirements (a) Privacy terms and consent. To safeguard the privacy, confidentiality, security, and integrity of a consumer’s genetic data, a direct-to-consumer genetic testing company shall: (1) provide clear and complete information regarding the company’s policies an…

§ 2421c. Enforcement (a) A direct-to-consumer genetic testing company or service provider that violates this subchapter or rules adopted pursuant to this subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title. (b) The Attorney Genera…

§ 2421d. Applicability (a) The provisions of this subchapter shall not reduce a direct-to-consumer genetic testing company’s duties, obligations, requirements, or standards under any applicable State and federal laws for the protection of privacy and security. (b) In the event of…