The Vermont Statutes Online

Title 9 : Commerce and Trade

Chapter 061a : Data Privacy [Effective January 1, 2028]

Subchapter 001 : Vermont Data Privacy and Online Surveillance Act [Effective January 1, 2028]

• § 2415c. Exemptions [Effective January 1, 2028]

  (a) This subchapter does not apply to:

  (1) in the ordinary course of its operation, a federal, state, tribal, or local government entity or an instrumentality of the State;

  (2)(A) a covered entity that is not a hybrid entity;

  (B) any health care component of a hybrid entity; or

  (C) a business associate;

  (3) patient-identifying information, for purposes of 42 U.S.C. § 290DD-2;

  (4)(A) information to the extent it is used for public health, community health, or population health activities and purposes, as authorized by HIPAA, when provided by or to a covered entity or when provided by or to a business associate in accordance with the business associate agreement with a covered entity;

  (B) information that is a health care record, as that term is defined in 18 V.S.A. § 9419, if the information is held by an entity that is a covered entity or business associate under HIPAA because it collects, uses, or discloses protected health information;

  (C) information that is deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. § 164.514 and that is derived from individually identifiable health information as described in HIPAA; and

  (D) personal information consistent with the human subject protection requirements of the U.S. Food and Drug Administration;

  (5) information used only for public health activities and purposes described in 45 C.F.R. § 164.512 (disclosure of protected health information without authorization);

  (6) information that identifies a consumer in connection with:

  (A) activities that are subject to the Federal Policy for the Protection of Human Subjects, codified as 45 C.F.R. Part 46 (HHS protection of human subjects) and in various other federal regulations;

  (B) activities that are subject to the protections provided in 21 C.F.R. Parts 50 (FDA clinical investigations protection of human subjects) and 56 (FDA clinical investigations institutional review boards); or

  (C) research conducted in accordance with the requirements set forth in subdivisions (A) and (B) of this subdivision (a)(6) or otherwise in accordance with applicable law;

  (7) patient-identifying information that is collected and processed in accordance with 42 C.F.R. Part 2 (confidentiality of substance use disorder patient records);

  (8) patient safety work product that is created and used for purposes of patient safety improvement in accordance with 42 C.F.R. § 3, established in accordance with 42 U.S.C. §§ 299b-21 through 299b-26;

  (9) information or documents created for the purposes of the Healthcare Quality Improvement Act of 1986, 42 U.S.C. §§ 11101–11152, and regulations adopted to implement that act;

  (10) information processed or maintained solely in connection with, and for the purpose of, enabling notice of an emergency to persons that an individual specifies;

  (11) any activity that involves collecting, maintaining, disclosing, selling, communicating, or using information for the purpose of evaluating a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living if done strictly in accordance with the provisions of the Fair Credit Reporting Act, 15 U.S.C. §§ 1681–1681x, as may be amended, by:

  (A) a consumer reporting agency;

  (B) a person who furnishes information to a consumer reporting agency under 15 U.S.C. § 1681s-2 (responsibilities of furnishers of information to consumer reporting agencies); or

  (C) a person who uses a consumer report as provided in 15 U.S.C. § 1681b(a)(3) (permissible purposes of consumer reports);

  (12) information collected, processed, sold, or disclosed under and in accordance with the following laws and regulations:

  (A) the Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721– 2725;

  (B) data that is subject to the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and regulations adopted to implement that act;

  (C) data that is subject to the Airline Deregulation Act, Pub. L. No. 95-504, only to the extent that an air carrier collects information related to prices, routes, or services, and only to the extent that the provisions of the Airline Deregulation Act preempt this subchapter;

  (D) data that is subject to the Farm Credit Act, Pub. L. No. 92-181, as may be amended; and

  (E) data that is subject to federal policy under 21 U.S.C. § 830 (regulation of listed chemicals and certain machines);

  (13) data subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act;

  (14) a state- or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities, as described in 12 U.S.C. § 1843(k);

  (15) an agent, broker-dealer, investment adviser, or investment adviser representative, as those terms are defined in section 5102 of this title, who is regulated by the Department of Financial Regulation or the Securities and Exchange Commission;

  (16) a person regulated pursuant to 8 V.S.A. part 3 (chapters 101–165) other than a person who, alone or in combination with another person, establishes and maintains a self-insurance program and who does not otherwise engage in the business of entering into policies of insurance;

  (17) health care providers and health care facilities, as those terms are defined in 18 V.S.A. § 9402, provided such providers and facilities maintain all protected health information in accordance with the requirements of 18 V.S.A. § 1881 and HIPAA regardless of whether such providers or facilities are covered entities under 45 C.F.R. § 160.103;

  (18) protected health information under HIPAA;

  (19) a third-party administrator, as that term is defined in the Third Party Administrator Rule adopted pursuant to 18 V.S.A. § 9417, provided that the third-party administrator is subject to and in compliance with the Department of Financial Regulation’s Regulation IH-2001-01 (Privacy of Consumer Financial and Health Information);

  (20) personal data of a victim or witness of child abuse, domestic violence, human trafficking, sexual assault, violent felony, or stalking that a victim services organization collects, processes, or maintains in the course of its operation;

  (21) a nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance;

  (22) information that is processed for purposes of compliance, enrollment or degree verification, or research services by a nonprofit organization that is established to provide enrollment data reporting services on behalf of postsecondary schools as that term is defined in 16 V.S.A. § 176;

  (23) noncommercial activity of:

  (A) a publisher, editor, reporter, or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet, report, or other publication in general circulation;

  (B) a radio or television station that holds a license issued by the Federal Communications Commission;

  (C) a nonprofit organization that provides programming to radio or television networks; or

  (D) a press association or wire service; or

  (24) data processed or maintained:

  (A) in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, consumer health data controller, or third party, to the extent that the data is collected and used within the context of that role;

  (B) as the emergency contact information of a consumer pursuant to this subchapter, used for emergency contact purposes; or

  (C) that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information pursuant to subdivision (18) of this subsection (a) and used for the purposes of administering such benefits.

  (b) Controllers, processors, and consumer health data controllers that comply with the verifiable parental consent requirements of COPPA shall be deemed compliant with any obligation to obtain parental consent pursuant to this subchapter. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)