Consumer Personal Data Rights

What it requires

Grants rights to confirm and access personal data (including inferences derived from it, and whether it is processed for profiling behind decisions with legal or similarly significant effects), correct inaccuracies, delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of such automated decisions. Where that profiling occurred, a consumer may, if feasible, question the result, be told the reason, and review the personal data used; only for housing decisions may the consumer also correct the data and have the decision reevaluated. Consumers may also obtain a list of the third parties to which the controller sold their personal data. Compared with the Senate-passed version, the rights to access inferences and profiling use, to question profiling results, and to obtain the sold-to list are new, and authorized-agent opt-out designation moves from a standalone section into § 2415d(b)(2). The bill as introduced had a broader list right (every third party the data was disclosed to) and a right to know whether data is used in an AI system; the Act narrowed the first and dropped the second.

Statute text

A consumer shall have the right to: ... (6) if the consumer's personal data were processed for the purposes of profiling ...: (A) question the result of such profiling; (B) be informed of the reason ...; and (7) obtain from the controller a list of the third parties to which such controller has sold the consumer's personal data ....

Vermont Data Privacy and Online Surveillance Act, § 2415dRead the full section from Vermont Office of the Attorney General