What's Happening?
Vermont has enacted Senate Bill 71, a comprehensive privacy law set to take effect on January 1, 2028. This legislation will regulate how businesses collect, use, disclose, sell, and protect personal data of Vermont residents. The law applies to entities
that meet specific thresholds, such as processing the personal data of at least 35,000 consumers or the sensitive data of at least 3,000 consumers. It includes provisions for consumer health data and offers heightened protections for children and minors. The law mandates that businesses provide clear privacy notices, allow consumers to opt out of data processing for targeted advertising, and maintain data protection assessments for high-risk activities. Enforcement will be managed by the Vermont Attorney General, who will provide guidance and annual reports on enforcement activities.
Why It's Important?
This legislation positions Vermont as a leader in consumer data protection, reflecting a growing trend among states to enhance privacy rights in the absence of comprehensive federal legislation. The law's stringent requirements for data controllers and processors aim to safeguard consumer privacy and address gaps left by existing federal laws like HIPAA. Businesses operating in Vermont will need to adapt their data practices to comply with these new standards, potentially influencing data privacy norms across the U.S. The law's focus on consumer rights and data minimization could serve as a model for other states considering similar measures, thereby shaping the future landscape of data privacy regulation.
What's Next?
As the law's implementation date approaches, businesses will need to review and possibly overhaul their data management practices to ensure compliance. The Vermont Attorney General's office will play a crucial role in providing guidance and overseeing enforcement. Companies may also need to invest in new technologies and processes to meet the law's requirements, such as developing systems for consumer data access and correction. The law's impact will likely extend beyond Vermont, as businesses with operations in multiple states may adopt these standards more broadly to streamline compliance efforts.
