top of page

Vermont's Data Protection and Breach Notification Law


The Data Breach Notification Law in Vermont is a piece of legislation that sets the groundwork for how organizations need to protect consumer data. Particularly, Section 2435 (c)(2) outlines key requirements for security procedures and practices. As cybersecurity risks continue to evolve, understanding this law isn't just about ticking off a compliance checklist; it's essential for maintaining robust operational security. In this post, we'll dive into Section 2435 (c)(2), examine the broader aspects of Vermont's separate Data Breach Notification Law, and discuss actionable steps for your organization to stay prepared and compliant.

Understanding Section 2435 (c)(2)

Section 2435 (c)(2) states:

"A data collector that owns or licenses computerized data that includes personal information shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information and the size, complexity, and capabilities of the data collector to protect the personal information from unauthorized access, use, modification, disclosure, or destruction."

This might sound like a lot to unpack, but let's break it down... What is a Data Collector?

The term "data collector" refers to any entity that owns or licenses computerized data containing personal information. This is a broad definition and can encompass a wide range of organizations, from small businesses to large corporations. Essentially, if your organization stores, processes, or transmits personal information in a computerized form, you fall under the category of a data collector as per Vermont law. This designation carries the legal responsibility of implementing and maintaining appropriate security measures to protect this information.

Reasonable Security Procedures

The term "reasonable" is intentionally vague, allowing for flexibility. What is reasonable for a small non-profit will differ drastically from a multinational corporation. It often involves a balance between the criticality of the data and the costs of implementing security measures.

The Nature of the Information

Personal information can range from basic identifiers like names and addresses to more sensitive information such as Social Security numbers or financial details. Naturally, the more sensitive the data, the more stringent the security measures should be.

The Size, Complexity, and Capabilities

The law recognizes that not all data collectors are created equal. A startup with ten employees shouldn't be held to the same standard as a Fortune 500 company. However, the law does expect all organizations, regardless of size, to make an earnest effort within their capabilities to secure data.

The Data Breach Notification Law at a high level

Beyond the preventative measures outlined in Section 2435 (c)(2), the Vermont Data Breach Notification Law serves as a complete blueprint for how organizations must respond when a data breach occurs. This law carefully delineates the types of data considered as "personal information" and spells out the obligations that data collectors have towards affected individuals and the State.

What Counts as "Personal Information"

Before delving into the actions to take, it's crucial to understand what the law classifies as "personal information." This generally includes data like names coupled with Social Security numbers, driver’s license numbers, or financial account numbers. A breach concerning any of this information triggers the law’s notification requirements.

Timelines for Reporting

When it comes to reporting a breach, time is of the essence. Organizations have a 45-day window to notify affected Vermont residents. This is a hard deadline and missing it could result in penalties. Alongside this, the law mandates that the Vermont Attorney General be notified within 14 business days of discovering the breach, allowing the State to take timely actions if needed. This means that while you are actively responding to a breach, you need to be preparing to notify the state and your clients.

Content of Notification

The law is quite prescriptive about what your notification should encompass. It's not just a matter of saying a breach happened; the notice must be detailed and actionable. Organizations are required to specify the nature of the breach, the categories of information compromised, and provide guidance on steps that individuals can take to safeguard themselves. This often includes advising on credit monitoring services and reminding people to change passwords for compromised accounts.

Obligations to the State

Apart from notifying the affected individuals, organizations have a responsibility to report the breach to the State. This involves sharing details about the incident, its impact, and the remedial actions being undertaken. This allows the State to maintain a record of breaches, which could be valuable for law enforcement and future policymaking. It also means that breaches are listed publicly.

Preparing for the Inevitable: Best Practices

Unfortunately, some level of data breach is more a question of 'when' rather than 'if,' and preparedness is key. Here are some steps to consider:

Cybersecurity Assessment

The first step any organization should take is to conduct a thorough cybersecurity assessment. This will identify vulnerabilities, assess existing security measures, and provide recommendations for improvement. Remember, the best time to act is before an incident happens.

Detection and Response Capabilities

Having state-of-the-art intrusion detection systems and an incident response team available can help you catch a breach before it causes significant damage. Monitor system logs, traffic patterns, and other indicators for signs of unauthorized access.

Incident Response and Reporting Plan

A well-designed incident response plan outlines roles, responsibilities, and steps for addressing a breach. This plan should be in alignment with the state's reporting requirements, ensuring timely and compliant notification. It should also be familiar to anyone who's name is on it... Practice, practice, practice!

Wrapping it up

While this post outlines the minimum requirements for compliance with Vermont's state law, it's essential to remember that federal laws like the Gramm-Leach-Bliley Act also impose cybersecurity standards on financial institutions. Practicing due care to protect both your organization's and clients' data is not just legal obligation, its smart business. While disclosing breaches is the right thing to do (and the law), it can also severely harm a business's reputation, which is a risk all organizations should weigh.

By understanding and adhering to Vermont's Data Breach Notification Law and Section 2435 (c)(2), your organization takes a pivotal step in building a robust cybersecurity posture. Ignorance is not an excuse in the eyes of the law. Make cybersecurity preparedness a top priority, starting today.

2 views0 comments


bottom of page