What does Vermont's data breach law ask a business to do?

Who does this law apply to?

The law says a data collector that owns or licenses computerized personally identifiable information or login credentials must tell the consumer after a security breach.

No consumer notice is owed if the data collector establishes that misuse is not reasonably possible, but it must then send that determination and a detailed explanation to the Attorney General or the Department of Financial Regulation.

Except as otherwise provided in subsection (d) of this section, any data collector that owns or licenses computerized personally identifiable information or login credentials shall notify the consumer that there has been a security breach following discovery or notification to the data collector of the breach.

Notice of a security breach pursuant to subsection (b) of this section is not required if the data collector establishes that misuse of personally identifiable information or login credentials is not reasonably possible and the data collector provides notice of the determination that the misuse of the personally identifiable information or login credentials is not reasonably possible pursuant to the requirements of this subsection.

What counts as personal information?

Personally identifiable information is a person's name together with items such as a social security number, a government identification number, a financial account number, an account password, biometric data, genetic information or health records, where those items are not encrypted, redacted or otherwise made unreadable. Login credentials are covered as well.

"Personally identifiable information" means a consumer's first name or first initial and last name in combination with one or more of the following digital data elements, when the data elements are not encrypted, redacted, or protected by another method that renders them unreadable or unusable by unauthorized persons:

How fast must people be told?

Consumers are told in the most expedient time possible and without unreasonable delay, and no later than 45 days after discovery or notification of the breach.

Notice of the security breach shall be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification, consistent with the legitimate needs of the law enforcement agency, as provided in subdivisions (3) and (4) of this subsection, or with any measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data system.

Who else must be told?

A data collector regulated by the Department of Financial Regulation tells that Department; every other data collector tells the Attorney General.

A preliminary description of the breach goes to the Attorney General or the Department within 14 business days of discovery, or when consumers are told, whichever is sooner.

If more than 1,000 consumers are notified at one time, the nationwide consumer reporting agencies must be told as well.

A data collector or other entity regulated by the Department of Financial Regulation under Title 8 or this title shall provide notice of a breach to the Department. All other data collectors or other entities subject to this subchapter shall provide notice of a breach to the Attorney General.

The data collector shall notify the Attorney General or the Department, as applicable, of the date of the security breach and the date of discovery of the breach and shall provide a preliminary description of the breach within 14 business days,

In the event a data collector provides notice to more than 1,000 consumers at one time pursuant to this section, the data collector shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a(p), of the timing, distribution, and content of the notice.

What if a vendor holds the data?

A data collector that holds information or login credentials it does not own must tell the owner or licensee immediately after it discovers the breach.

Any data collector that maintains or possesses computerized data containing personally identifiable information or login credentials that the data collector does not own or license

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.