Construction of Duties

What it requires

Clarifies that the Act does not restrict compliance with law, law-enforcement cooperation, fraud/security response, contract performance, or approved scientific research, and adds a new exception (not in the introduced bill) allowing limited internal use of personal data to detect or correct bias in automated decision-making. Also confirms the Act does not authorize facial recognition use by law enforcement.

Statute text

(b) Internal use of data. [...] (4) process personal data for the purposes of profiling in furtherance of any automated decision that may produce any legal or similarly significant effect concerning a consumer, provided the personal data are: (A) processed only to the extent necessary to detect or correct any bias that may result from processing the data for such purposes, the bias cannot effectively be detected or corrected without processing the data, and the data are deleted once the processing has been completed; [...] (c) Evidentiary privilege. [...] (3) Nothing in this subchapter modifies 2020 Acts and Resolves No. 166, Sec. 14 or authorizes the use of facial recognition technology by law enforcement.

Vermont Data Privacy and Online Surveillance Act, § 2415iRead the full section from Vermont Office of the Attorney General