An act relating to the disclosure of transactions involving personally identifiable information

2025-2026 Regular Session Introduced by Monique Priestley

The bill requires disclosure and notification about transactions involving personally identifiable information to individuals, regulators, or designated parties to increase transpa

Read first time and referred to the Committee on Commerce and Economic Development

Bill Summary: H 391 (2025-2026) – Vermont

Purpose and intent

This act addresses the disclosure of transactions involving personally identifiable information (PII).

The overarching goal is to increase transparency around how PII is exchanged, shared, or processed, and to establish requirements for notifying relevant parties or authorities when PII transactions occur.

Key provisions and changes

Disclosure Requirements: Establishes criteria for when transactions involving PII must be disclosed to specific stakeholders (e.g., individuals, regulators, or designated parties).

Definitions: Provides definitions for terms such as “personally identifiable information,” “transaction,” and related privacy terms to clarify when the law applies.

Notification Obligations: Specifies timing and content of disclosures or notices (e.g., when PII is shared with third parties, breach-like circumstances, or transfers across entities).

Compliance Standards: Sets standards or procedures for entities that handle PII to ensure proper documentation, recordkeeping, and auditability of disclosures.

Remedies and Enforcement: Outlines potential penalties, corrective actions, or oversight mechanisms for noncompliance.

Consumer Protections: Aims to empower individuals with information about who has access to their PII and under what circumstances, potentially including access rights or opt-out provisions.

Interaction with Other Laws: Indicates how this act interacts with existing Vermont privacy or consumer data laws, and whether it creates new preemption, overlap, or harmonization requirements.

Who/what is affected

Entities handling PII within Vermont (e.g., businesses, data processors, service providers, and possibly state agencies) would need to adhere to disclosure and notification requirements.

Individuals whose PII is involved would be affected through enhanced notification and transparency about disclosures.

Regulatory or oversight bodies may gain new authority or duties to monitor compliance and enforce provisions.

Procedural and timeline aspects

Status: Read first time and referred to the Committee on Commerce and Economic Development (as of 2025-02-26).

Sponsor: Co-sponsor Monique Priestley.

Next steps (typical for this stage): The bill would undergo committee review, potentially be revised, and then reported back with a recommendation. If advanced, it would proceed to floor debate, hearings, and possible amendments, followed by votes in the Vermont House and Senate, and ultimately any reconciliation process before potential enactment.

Potential impact and considerations

Enhanced transparency around PII transactions could increase consumer trust and accountability for entities handling sensitive data.

Businesses may incur compliance costs related to disclosure obligations, recordkeeping, and notification timelines.

The bill’s effectiveness would depend on specific definitions, scope, and enforcement mechanisms outlined in the final text.

Stakeholders may propose clarifications on scope (e.g., which entities are subject), remedies, and alignment with existing Vermont privacy laws.

If you’d like, I can refine this summary once the bill’s full text or committee amendments are available, to extract exact definitions, timelines, penalties, and operational requirements.