Student Privacy and Consumer Protection Law Takes Effect

Act 89 – a wide-ranging data privacy and consumer protection law goes into effect today.

This VPIRG-supported law contains a number of key provisions that safeguard Vermont students’ privacy, better informs all Vermonters when their data has been compromised and keeps Vermonters out of unwanted ‘zombie contacts.’

VPIRG members and advocates supported Act 89 during its long and somewhat complicated journey to enactment. The law that was ultimately enacted and goes into effect today contains several important consumer protections. Specifically, this law:

– Institutes data protections for Vermont students: Modeled on California’s Student Online Personal Information Protection Act – this section of the law prevents educational technology companies from using information collected about students for non-educational purposes. The enactment of these protections have taken on a new importance as students engage in remote learning and make even more use of the type of educational software covered by this law.

– Brings transparency to the state of Vermont’s data practices: Act 89 requires the State of Vermont itself to undertake a privacy inventory and report on what personal information the state is currently collecting, storing and, in some cases, disseminating to third parties. This report could lead to further legislation to reform how the state itself collects and distributes data.

– Modernizes Vermont’s data breach notification law: The section expands the types of data breaches that companies are required to notify consumers about to include things like username/password breaches and biometric data breaches, which were not previously required under Vermont law. Act 89 also puts stronger requirements in place for when companies must give consumers direct notice of breached information.

Improves on Vermont’s nation-best automatic contract renewal law: Not only did consumer protection advocates succeed in removing the language in Act 89 that would have partially repealed Vermont’s law preventing unwanted automatic contract renewals. Ultimately, Act 89 improved upon that law by strengthening the requirement for how companies must notify consumers of impending renewals and by making it easier for consumers to opt out of those renewals if they choose (i.e. by requiring companies to allow consumer to cancel online if they were able to sign up for the service online). This mean companies can no longer allow users to sign-up for an automatic renewal contract online, but force them to jump through hoops and make multiple phone calls to cancel that service.

Act 89’s implementation marks a big win for Vermont consumers and those who fought for its passage deserve thanks – in particular the Attorney General’s office and the legislation’s sponsors:
Senators Michael Sirotkin, Becca Balint, Philip Baruth, Alison Clarkson and Ruth Hardy

Photo Credit: Aleksandra Suzi via Adobe Stock