Blog
Vermont Amends Its Data Breach Notification Law
Blog
June 26, 2012
Amendments to Vermont’s data breach notification law recently went into effect. The amendments revise the timing and manner of notification in the event of a data breach. They also modify the definition of a breach. Notice of a security breach must now be given to consumers no later than 45 days after the discovery of a breach. (The law did not previously provide a specific deadline, just that it be made “expediently” and “without unreasonable delay.”) This amended time frame mirrors that which already exists in Florida. In addition, data collectors must now also notify the Vermont attorney general within 14 business days of the data collector’s discovery of the security breach or when the notice is provided consumers, whichever is sooner – but “consistent with the needs of law enforcement.” The notification to the attorney general must include the dates of the breach and discovery of the breach and a description of the breach. Once consumers are notified, the data collector must also provide the attorney general with the number of impacted residents and a copy of the notice provided to consumers. The amendment also restricts the definition of “security breach” to eliminate instances of unauthorized “access” so that breaches occur only when there is unauthorized acquisition of electronic data. The law now also lists factors for data collectors to consider in determining whether personally identifiable information was acquired or is reasonably believed to have been acquired without authorization. These factors include, incidents involving lost or stolen devices, indications that the information has been downloaded or copied, and indications that the information was used by an unauthorized party.
TIP: Companies should keep in mind the new timing deadlines under Vermont’s law. If companies had a nationwide plan that took into account Florida’s 45 day timing, then the most significant impact will be the new requirement to notify the Vermont attorney general.
This entry has been created for information and planning purposes. It is not intended to be, nor should it be substituted for, legal advice, which turns on specific facts.