United States of America: Introduced Vermont Act relating to enhancing consumer privacy (HB 121) including cybersecurity regulation

On 26 January 2023, a Bill for an Act relating to enhancing consumer privacy (HB 121) including cybersecurity regulation was introduced in the Vermont General Assembly. The Bill would introduce cybersecurity incident reporting requirements for data brokers, defined as a business which sells or licenses personal information to third parties. In case of a data breach, data brokers are required to notify affected consumers within 45 days of discovery of the breach. Further, data brokers would be required to notify the state Attorney General within 14 business days.