Can I use third-party file sharing tools that collect personal information in Vermont? What are the requirements?

Yes, you can use third-party file sharing tools that collect personal information in Vermont, but you must comply with certain requirements.

Requirements for Using Third-Party File Sharing Tools in Vermont

According to the Vermont Consumer Protection Rule (VTCR) 13-000-002 § 4.1 and 4.2, if you are using third-party file sharing tools that collect personal information in Vermont, you must obtain informed permission or authorization from the consumer before sharing or disclosing their individually identifiable information. The permission or authorization must be in a language and format understandable to the consumer, and reasonable accommodations must be made for special needs. You must inform the consumer that granting permission or authorization is not a prerequisite for receiving services that they are entitled to and for which they have applied, although refusal to give permission or authorization may limit your ability to provide the best quality services. You must also explain the process and benefits of service coordination, and provide the consumer with a copy of the most current agency confidentiality guidelines and relevant permission or authorization form, as well as any other information required by state or federal law.

According to VTCR 13-000-002 § 4.2, the permission or authorization for the sharing or disclosure of individually identifiable information shall ordinarily be in writing. If an emergency situation requires granting of verbal permission or authorization, such verbal permission or authorization will be documented as soon as possible thereafter. The permission or authorization shall contain specific elements, including the name of the consumer who is permitting or authorizing to have his or her individually identifiable information shared or disclosed, a list or description of the kinds of information to be shared or disclosed, an explanation of the purpose for which the permission or authorization is given, a list or description of those authorized to receive the information, a statement that the permission or authorization may be revoked in writing at any time except to the extent that the permission or authorization has already been acted or relied upon, the date, event, or condition upon which the permission or authorization will expire if not revoked earlier, the signature of the consumer granting permission or authorization, or the name and signature of the person with authority to do so and the date, the signature of the individual explaining the permission or authorization process with his or her position, job title, and date, a space to provide individualized instructions, and a statement that the information will not be disclosed further unless such disclosure is required or allowed by law. A copy of the permission or authorization shall be provided to all signatories.

If you are sharing nonpublic personal information for service providers and joint marketing, you must comply with VTCR 21-010-016 § 14. According to VTCR 21-010-016 § 14, the opt-in requirements do not apply when a financial institution provides nonpublic personal information to a nonaffiliated third party to perform services for the financial institution or functions on the financial institution’s behalf, if the financial institution provides the initial notice in accordance with Section 5, enters into a contractual agreement with the third party that prohibits the nonaffiliated third party from disclosing or using the information other than to carry out the purposes for which the financial institution disclosed the information, including use under an exception in Sections 15 or 16 in the ordinary course of business to carry out those purposes, and for joint agreements for marketing, provides only the consumer’s name, contact information and own transaction and experience information within the meaning of the federal Fair Credit Reporting Act, 15 U.S.C. § 1681a (d)(2)(A)(i) and the Vermont Fair Credit Reporting Act, 9 V.S.A. § 2480a (2)(A).

If you are disclosing nonpublic personal financial information to a nonaffiliated third party, you must comply with VTCR 21-010-016 § 12. According to VTCR 21-010-016 § 12, the financial institution’s disclosure and use of that information is limited, and the third party may disclose and use that information only as specified in the regulation.

However, if the third-party file sharing tool is used for educational purposes, you may use or disclose covered information of a student under certain circumstances as specified in 9 VTST 2443c.

Conclusion

In summary, if you are using third-party file sharing tools that collect personal information in Vermont, you must comply with the Vermont Consumer Protection Rule (VTCR) 13-000-002 § 4.1 and 4.2, VTCR 21-010-016 § 14, and VTCR 21-010-016 § 12. If the third-party file sharing tool is used for educational purposes, you may use or disclose covered information of a student under certain circumstances as specified in 9 VTST 2443c.

Jurisdiction

Vermont

• Privacy