§ 2455. Conduct of business

(a) A personal information protection company may:

(1) operate through remote interaction with the individuals entrusting personal information to the company, and there shall be no requirement of Vermont residency or other contact for any such individual to establish such a relationship with the company; and

(2) subject to applicable fiduciary duties, the terms of any agreement with the individual involved, and any applicable statutory or regulatory provision:

(A) provide elements of personal information to third parties with which the individual seeks to have a transaction, a service relationship, or other particular purpose interaction;

(B) provide certification or validation concerning personal information;

(C) receive compensation for acting in these capacities.

(b) An authorization to provide personal information may be either particular or general, provided it meets the terms of any agreement with the individual involved and any rules adopted by the Department of Financial Regulation. (Added 2017, No. 205 (Adj. Sess.), § 2.)