Data Breach Requirements: 9 V.S.A. § 2430 et seq.
The numbering and internal citations herein are derived from the applicable state statute.
Personal Information
The term “personally identifiable information” means a consumer’s first name or first initial and last name in combination with one or more of the following digital data elements, when the data elements are not encrypted, redacted, or protected by another method that renders them unreadable or unusable by unauthorized persons:
(i) A Social Security number;
(ii) A driver’s license or nondriver state identification card number, individual taxpayer identification number, passport number, military identification card number, or other identification number that originates from a government identification document that is commonly used to verify identity for a commercial transaction;
(iii) A financial account number or credit or debit card number, if the number could be used without additional identifying information, access codes, or passwords;
(iv) A password, personal identification number, or other access code for a financial account;
(v) Unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee of the data to identify or authenticate the consumer, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data;
(vi) Genetic information; and
(vii)(I) Health records or records of a wellness program or similar program of health promotion or disease prevention; (II) a health care professional’s medical diagnosis or treatment of the consumer; or (III) a health insurance policy number.
“Login credentials” means a consumer’s username or email address, in combination with a password or an answer to a security question, that together permit access to an online account.
Security Breach Definition
The term “security breach” means unauthorized acquisition of electronic data, or a reasonable belief of an unauthorized acquisition of electronic data, that compromises the security, confidentiality, or integrity of a consumer’s personally identifiable information or login credentials maintained by a data collector.
Good Faith Exception
A “security breach” does not include good faith but unauthorized acquisition of personally identifiable information or login credentials by an employee or agent of the data collector for a legitimate purpose of the data collector, provided that the personally identifiable information or login credentials are not used for a purpose unrelated to the data collector’s business or subject to further unauthorized disclosure.
Risk of Harm Analysis
Notice of a security breach is not required if the data collector establishes that misuse of personally identifiable information or login credentials is not reasonably possible and the data collector provides notice of the determination that the misuse of the personally identifiable information or login credentials is not reasonably possible as follows. If the data collector establishes that misuse of the personally identifiable information or login credentials is not reasonably possible, the data collector shall provide notice of its determination that misuse of the personally identifiable information or login credentials is not reasonably possible and a detailed explanation for said determination to the Vermont Attorney General or to the Department of Financial Regulation in the event that the data collector is a person or entity licensed or registered with the Department under Title 8 or this title. The data collector may designate its notice and detailed explanation to the Vermont Attorney General or the Department of Financial Regulation as “trade secret” if the notice and detailed explanation meet the definition of trade secret contained in 1 V.S.A. § 317(c)(9).
If a data collector established that misuse of personally identifiable information or login credentials was not reasonably possible and subsequently obtains facts indicating that misuse of the personally identifiable information or login credentials has occurred or is occurring, the data collector shall provide notice of the security breach.
Notification Timeline
A breach notification shall be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification, consistent with the legitimate needs of the law enforcement agency, or with any measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data system.
Security and Investigation Exceptions
The breach notice to a consumer shall be delayed upon request of a law enforcement agency. A law enforcement agency may request the delay if it believes that notification may impede a law enforcement investigation, or a national or Homeland Security investigation, or jeopardize public safety or national or Homeland Security interests. In the event law enforcement makes the request for a delay in a manner other than in writing, the data collector shall document such request contemporaneously in writing, including the name of the law enforcement officer making the request and the officer’s law enforcement agency engaged in the investigation. A law enforcement agency shall promptly notify the data collector in writing when the law enforcement agency no longer believes that notification may impede a law enforcement investigation or a national or Homeland Security investigation or jeopardize public safety or national or Homeland Security interests. The data collector shall provide notice without unreasonable delay upon receipt of a written communication, which includes facsimile or electronic communication, from the law enforcement agency withdrawing its request for delay.
Notification Content Requirements
The breach notice shall be clear and conspicuous. A notice to a consumer of a security breach involving personally identifiable information shall include a description of each of the following, if known to the data collector:
(A) the incident in general terms;
(B) the type of personally identifiable information that was subject to the security breach;
(C) the general acts of the data collector to protect the personally identifiable information from further security breach;
(D) a telephone number, toll-free if available, that the consumer may call for further information and assistance;
(E) advice that directs the consumer to remain vigilant by reviewing account statements and monitoring free credit reports; and
(F) the approximate date of the security breach.
If a security breach is limited to an unauthorized acquisition of login credentials for an online account other than an email account, the data collector shall provide notice of the security breach to the consumer electronically or through one or more of the methods authorized (See Delivery Methods) and shall advise the consumer to take steps necessary to protect the online account, including to change his or her login credentials for the account and for any other account for which the consumer uses the same login credentials.
Delivery Methods
A breach notice may be provided by one of the following methods:
(A)(i) written notice mailed to the consumer’s residence;
(ii) electronic notice, for those consumers for whom the data collector has a valid email address, if: (I) the data collector’s primary method of communication with the consumer is by electronic means, the electronic notice does not request or contain a hypertext link to a request that the consumer provide personal information, and the electronic notice conspicuously warns consumers not to provide personal information in response to electronic communications regarding security breaches; or (II) the notice is consistent with the provisions regarding electronic records and signatures for notices in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act); or
(iii) telephonic notice, provided that telephonic contact is made directly with each affected consumer and not through a prerecorded message.
(B)(i) Substitute notice, if:
(I) the data collector demonstrates that the lowest cost of providing notice to affected consumers pursuant to subdivision (6)(A) of this subsection among written, email, or telephonic notice would exceed $10,000; or
(II) the data collector does not have sufficient contact information.
(ii) A data collector shall provide substitute notice by:
(I) conspicuously posting the notice on the data collector’s website if the data collector maintains one; and
(II) notifying major statewide and regional media.
If a security breach is limited to an unauthorized acquisition of login credentials for an email account: (A) the data collector shall not provide notice of the security breach through the email account; and (B) the data collector shall provide notice of the security breach through one or more of authorized methods (See Delivery Methods) or by clear and conspicuous notice delivered to the consumer online when the consumer is connected to the online account from an internet protocol address or online location from which the data collector knows the consumer customarily accesses the account.
Substitute Notice
See Delivery Methods.
Notice to Government Agencies
(3) A data collector or other entity subject to this subchapter shall provide notice of a breach to the Office of the Attorney General or to the Department of Financial Regulation, as applicable, as follows:
(A) A data collector or other entity regulated by the Department of Financial Regulation under Title 8 or this title shall provide notice of a breach to the department. All other data collectors or other entities subject to this subchapter shall provide notice of a breach to the attorney general.
(B)(i) The data collector shall notify the attorney general or the department, as applicable, of the date of the security breach and the date of discovery of the breach and shall provide a preliminary description of the breach within 14 business days, consistent with the legitimate needs of the law enforcement agency of the data collector’s discovery of the security breach, or when the data collector provides notice to consumers, whichever is sooner.
(ii) Notwithstanding subdivision (B)(i), a data collector who, prior to the date of the breach, on a form and in a manner prescribed by the attorney general, had sworn in writing to the attorney general that it maintains written policies and procedures to maintain the security of personally identifiable information or login credentials and respond to a breach in a manner consistent with Vermont law shall notify the attorney general of the date of the security breach and the date of discovery of the breach and shall provide a description of the breach prior to providing notice of the breach to consumers.
(iii) If the date of the breach is unknown at the time notice is sent to the attorney general or to the department, the data collector shall send the attorney general or the department the date of the breach as soon as it is known.
(iv) Unless otherwise ordered by a court of this state for good cause shown, a notice provided under this subdivision (3)(B) shall not be disclosed to any person other than the department, the authorized agent, or representative of the attorney general, a state’s attorney, or another law enforcement officer engaged in legitimate law enforcement activities without the consent of the data collector.
(C)(i) When the data collector provides notice of the breach pursuant to subdivision (1) of this subsection (b), the data collector shall notify the attorney general or the department, as applicable, of the number of Vermont consumers affected, if known to the data collector, and shall provide a copy of the notice provided to consumers.
(ii) The data collector may send to the attorney general or the department, as applicable, a second copy of the consumer notice, from which is redacted the type of personally identifiable information or login credentials that was subject to the breach, and which the attorney general or the department shall use for any public disclosure of the breach.
(D) If a security breach is limited to an unauthorized acquisition of login credentials, a data collector is only required to provide notice of the security breach to the Office of the Attorney General or Department of Financial Regulation, as applicable, if the login credentials were acquired directly from the data collector or its agent.
Consumer Reporting Agencies
In the event a data collector provides a breach notice to more than 1,000 consumers at one time, the data collector shall notify, without unreasonable delay, all consumer reporting agencies of the timing, distribution, and content of the notice. This subsection shall not apply to a person who is licensed or registered under Title 8 by the Department of Financial Regulation.
Preemption and Compliance
A data collector that is subject to the privacy, security, and breach notification rules adopted in pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is deemed to be in compliance with this subchapter if: (1) the data collector experiences a security breach that is limited to personally identifiable information specified in 2430(10)(A)(vii); and (2) the data collector provides notice to affected consumers pursuant to the requirements of the breach notification rule in HIPAA.
Except as provided in subdivision (3) of this subsection, a financial institution that is subject to the following guidances, and to any revisions, additions, or substitutions relating to an interagency guidance, shall be exempt from this section: (1) The Federal Interagency Guidance Response Programs for Unauthorized Access to Consumer Information and Customer Notice. (2) Final Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice, issued on April 14, 2005, by the National Credit Union Administration. (3) A financial institution regulated by the Department of Financial Regulation that is subject to subdivision (1) or (2) of this subsection shall notify the department as soon as possible after it becomes aware of an incident involving unauthorized access to or use of personally identifiable information.
Data Processor Obligations
Any data collector that maintains or possesses computerized data containing personally identifiable information or login credentials that the data collector does not own or license or any data collector that acts or conducts business in Vermont that maintains or possesses records or data containing personally identifiable information or login credentials that the data collector does not own or license shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement.
Other Information
The term “Data collector” means a person who, for any purpose, whether by automated collection or otherwise, handles, collects, disseminates, or otherwise deals with personally identifiable information, and includes the State, State agencies, political subdivisions of the State, public and private universities, privately and publicly held corporations, limited liability companies, financial institutions, and retail operators.
In determining whether personally identifiable information or login credentials have been acquired or are reasonably believed to have been acquired by a person without valid authorization, a data collector may consider the following factors, among others:
(i) indications that the information is in the physical possession and control of a person without valid authorization, such as a lost or stolen computer or other device containing information;
(ii) indications that the information has been downloaded or copied;
(iii) indications that the information was used by an unauthorized person, such as fraudulent accounts opened or instances of identity theft reported; or
(iv) that the information has been made public.
(B) A Vermont law enforcement agency with a reasonable belief that a security breach has or may have occurred at a specific business shall notify the business in writing of its belief. The agency shall also notify the business that additional information on the security breach may need to be furnished to the Office of the Attorney General or the Department of Financial Regulation and shall include the website and telephone number for the office and the department in the notice.
Data Disposal and Security: 9 V.S.A. § 2445.
The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.
Key Terms
The term “personal information” means the following information that identifies, relates to, describes, or is capable of being associated with a particular individual: his or her signature, Social Security number, physical characteristics or description, passport number, driver’s license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or any other financial information.
Written Policy
See Other Information (implementing and monitoring compliance with policies and procedures).
Data Disposal
A business shall take all reasonable steps to destroy or arrange for the destruction of a customer’s records within its custody or control containing personal information that is no longer to be retained by the business by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or indecipherable through any means for the purpose of:
(1) Ensuring the security and confidentiality of customer personal information;
(2) Protecting against any anticipated threats or hazards to the security or integrity of customer personal information; and
(3) Protecting against unauthorized access to or use of customer personal information that could result in substantial harm or inconvenience to any customer.
Other Information
An entity that is in the business of disposing of personal financial information that conducts business in Vermont or disposes of personal information of residents of Vermont must take all reasonable measures to dispose of records containing personal information by implementing and monitoring compliance with policies and procedures that protect against unauthorized access to or use of personal information during or after the collection and transportation and disposing of such information.