In this exclusive for The Privacy Advisor, Mintz Levin's Cynthia Larose, CIPP/US, and Amy Malone report on Vermont's updates to its data breach notification law, which became effective May 8. The biggest change is in the notification requirements, the report states, which now require consumers be notified of a breach incident no later than 45 days after its discovery and be informed of the date the breach occurred. The Vermont attorney general must be notified within 14 business days after a breach discovery or of consumer notice. Act 109 "also adopts the industry standard label of PII...and changes the definition of security breach," the report states. (Must be an IAPP member and logged in to view.)
Full Story