Privacy and Data Security

Personal information such as Social Security Numbers and credit and debit card numbers must be kept confidential and secure under Vermont law. This page describes how businesses and state agencies must protect consumers’ personal information and notify consumers in the event of a data security breach.

More information about how consumers and businesses can protect personal information is available under the list of Additional Resources below. If you are concerned that someone is using your personal information to commit identity theft, please refer to our information on Identity Theft.

Duty to Notify Vermont Consumers of a Security Breach

Vermont’s Security Breach Notice Act requires businesses and state agencies to notify consumers in the event a business or state agency suffers a “security breach.” A security breach is defined as the “unauthorized acquisition or access of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the [business or state agency].” 9 V.S.A. § 2430(8).

Information on what to do in the event of a security breach is available in the Vermont Attorney General’s Security Breach Notification Guidance.

Security Breach Notices

The Attorney General maintains a list of notice letters received by the Office concerning incidents that may have compromised the personal information of Vermont residents

If you are concerned that someone is using your personal information to commit identity theft, please refer to our information on Identity Theft.

Use of Social Security Numbers

Vermont’s Social Security Number Protection Act requires businesses and state agencies to limit the use of Social Security Numbers and protect their confidentiality.

In addition, any person has the right to request that a town clerk or clerk of court remove from a record placed on a town’s or court’s public website the person’s Social Security Number, employer taxpayer identification number, driver’s license number, state identification number, passport number, checking account number, savings account number, credit card or debit card number, or personal identification number (PIN) or password. 9 V.S.A. § 2440(f).

Businesses must safely destroy records that contain Social Security Numbers and other personal information. 9 V.S.A. § 2445.

State agencies and political subdivisions must take all reasonable steps to redact Social Security Numbers from a document before posting it in a public place. 9 V.S.A. § 2480m.

More information about all of these laws and recommended practices for protecting the confidentiality of Social Security Numbers is available in the Vermont Attorney General’s Guidance Concerning the Protection of Social Security Numbers.

Additional Resources

Tips for Protecting Your Personal Information
Protecting Personal Information: A Guide for Business