Do you control or process the sensitive personal information of 3,000 or more residents of Vermont?

To answer this question, please select “yes” if you control or process the sensitive personal information of 3,000 or more residents of Vermont. 

Sensitive personal information is any information that reveals or relates to a person’s: 

• Racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as nonbinary or transgender, citizenship or immigration status; 

• A mental or physical health condition, diagnosis, disability, or treatment; 

• Consumer health data; 

• Genetic or biometric data or information derived from such data; 

• Personal data collected from a child; 

• Precise geolocation data; 

• Neural data; 

• A financial account number, financial account login information, a credit card or debit card number that, in combination with any required access or security code, password, or credential, would allow access to a consumer’s financial account; or 

• A government-issued identification number (e.g. Social Security number, passport number, state identification number or driver’s license number). 

“Controlling” means determining the purpose and means of processing personal information. For example, if you determine whether individuals are added to an email marketing list or whether a contact form inquiry will be responded to, then you are controlling the personal information that is submitted to your website or application. 

“Processing” means the collection, use, sale, storage, disclosure, analysis, detection or modification of personal information. For example, if you are collecting personal information, then you are processing personal information. 

Related privacy laws

Vermont Data Privacy and Online Surveillance Act