United States of America: Passed Vermont Act relating to enhancing consumer privacy (HB 121) including data protection regulation

On 22 March 2024, a Bill for an Act relating to enhancing consumer privacy (HB 121), including data protection regulation, was passed by the House of Representatives in the State of Vermont. The Bill sets out obligations for data controllers, such as a prohibition on the use of information collected for a purpose inconsistent with the purpose for which it was initially collected and a prohibition on retention of personal information if the initial purpose, notice, or consent cannot be determined. Further, the Bill would provide a number of data subject rights to consumers, with their content to be specified by the Attorney General's rule. The Bill would also introduce further obligations for data brokers, defined as businesses selling or licensing personal information to third parties, such as allowing consumers to opt out of data collection and sale. Finally, the Bill would create separate data protection obligations in relation to biometric information, such as providing conspicuous notice and obtaining consent prior to collection.