Exemptions

What it requires

Replaces the Senate-passed version's blanket carve-outs for all nonprofits and institutions of higher education with a granular list that largely restores, and adds to, the introduced bill's: government entities; HIPAA covered entities that are not hybrid entities, health care components of hybrid entities, and business associates; protected health information; specific federal human-subjects research regimes; Fair Credit Reporting Act activity; data subject to GLBA Title V; state- or federally chartered banks and credit unions; regulated securities professionals; persons regulated under Vermont's insurance code (8 V.S.A. part 3, other than self-insurers not otherwise in the insurance business); health care providers and facilities; victim-services data; employment-context data; and narrow nonprofit and noncommercial-media carve-outs.

Statute text

This subchapter does not apply to: (1) ... a federal, state, tribal, or local government entity ...; (2)(A) a covered entity that is not a hybrid entity; ... (13) data subject to Title V of the Gramm-Leach-Bliley Act ...; (14) a state- or federally chartered bank or credit union ....

Vermont Data Privacy and Online Surveillance Act, § 2415cRead the full section from Vermont Office of the Attorney General