Vermont Attorney General Provides Guidance On Security Breach Notice Act

On March 5, 2020, Gov. Phil Scott (VT-R) signed into law amendments to the Security Breach Notice Act (the "Act"). The amendments, which originated in the State Senate as part of an initiative addressing a number of data privacy issues (S. 110), took effect on July 1, 2020. On July 14, 2020, Vermont Attorney General (AG) TJ Donovan published a comprehensive guidance document to assist companies and other types of data controllers with compliance. This is the first material update to the AG's guidance about the Act since September 2014. See our previous post explaining the most significant changes to the Act for more information.

The AG's guidance notes that it is not directed to entities regulated by the Vermont Department of Financial Regulation (DFR) (the Act mandates that data collectors report security breaches not only to affected consumers, but also to the AG or DFR, depending on whether they are regulated by the DFR or not). However, the guidance still