Regulon — VT-HB-262 · VT HB 262 (Employee Monitoring & Automated Decision Systems)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Enforcement through the existing remedies under 21 V.S.A. § 495b, which provides for complaints to the Attorney General or the Human Rights Commission and civil actions. The retaliation provisions of 21 V.S.A. § 495(a)(8) also apply.

Private Right of Action

Penalties

Remedies are those available under 21 V.S.A. § 495b, Vermont's existing fair employment practices enforcement provision, which includes compensatory damages, injunctive relief, and other equitable remedies. The bill itself does not specify separate statutory damages, punitive damages, or attorney fees provisions.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

21 V.S.A. § 495q(a)

Definitions

(a)(1)–(10) "Algorithm" means a computerized procedure consisting of a set of steps used to accomplish a determined task. (2) "Automated decision system" means an algorithm or computational process that is used to make or assist in making employment-related decisions, judgments, or conclusions. The term "automated decision system" includes algorithms and computational processes that are derived from machine learning, statistics, data processing, or artificial intelligence. (3) "Automated decision system output" means information, data, assumptions, predictions, scoring, recommendations, decisions, or conclusions generated by an automated decision system. (4) "Data" means information obtained by any means that, directly or indirectly, identifies, relates to, describes, may reasonably be associated with, or could reasonably be linked to an employee, including: (A) personal identifying information; (B) biometric information; (C) health, medical, lifestyle, and wellness information; (D) information related to workplace activities; (E) human resources information and personnel files; and (F) information related to the employee's internet and digital activities, including electronic communications, private social media activity, and personal internet protocol address. (5) "Electronic monitoring" means the collection of information concerning employee activities or communication by any means other than direct, in-person observation, including through the use of a digital device; computer; telephone; wire; radio; camera; or electromagnetic, photoelectronic, or photo-optical system. (6) "Employee" means an individual who in consideration of direct or indirect gain or profit is employed by an employer. As used in this section, "employee" includes job applicants and independent contractors providing services, directly or indirectly, to an employer. (7) "Employer" means a person who directly or indirectly employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms and conditions of employment of an employee. For purposes of this section, "employer" includes the employer's agents, labor contractors, or other affiliates or subcontractors through which individuals perform work on behalf of the employer or otherwise provide services that are integrated into the employer's business operations. (8) "Employment-related decision" means any decision made by an employer that: (A) affects an employee's compensation, benefits, or terms and conditions of employment; (B) relates to the discipline, evaluation, promotion, or termination of an employee; or (C) relates to the hiring of an individual or employee for a position or job. (9) "Essential job function" means a fundamental duty of a job or position that an employee with that job or position must be able to perform, as revealed by objective evidence, such as the amount of time an employee spends performing a function, the terms of any applicable collective bargaining agreement, the employee's past and present work experiences, and the employee's performance in the position. The employer's reasonable, nondiscriminatory judgment as to which job functions are essential may be relevant evidence but not the sole basis for a determination as to which functions are essential, the determination of which requires consideration of objective evidence. (10) "Periodic assessment of an employee's performance" means the assessment of an employee's performance over the course of units of time equal to or greater than one calendar day.

Subsection (a) defines the key terms used throughout the section. The definitions are broadly drawn — the definition of employee includes job applicants and independent contractors, and employer includes agents, labor contractors, and affiliates. The definition of automated decision system encompasses any algorithm or computational process used to make or assist in employment-related decisions, including those derived from machine learning, statistics, data processing, or AI.

21 V.S.A. § 495q(b)

Employee monitoring restricted

Deployer

(b)(1)–(5) 1 Employee monitoring restricted. An employer shall not engage in electronic monitoring of an employee unless all of the following requirements are met: (1) the employer's purpose in utilizing the electronic monitoring is to: (A) assist or allow the employee to accomplish an essential job function; (B) monitor production processes or quality; (C) ensure compliance with applicable employment or labor laws; (D) protect the health, safety, or security of the employee, clients, or the public; (E) secure the employer's physical or digital property; (F) conduct periodic assessment of employee performance; or (G) track time worked or production output for purposes of determining the employee's compensation; (2) the specific form of electronic monitoring is necessary to accomplish the purpose identified pursuant to subdivision (1) of this subsection and is used exclusively to accomplish that purpose; (3) the specific form of electronic monitoring is the least invasive means, with respect to the employee, of accomplishing the purpose identified pursuant to subdivision (1) of this subsection; (4) the specific form of electronic monitoring is used with the smallest number of employees, collects the smallest amount of data necessary to accomplish the purpose identified pursuant to subdivision (1) of this subsection, and is collected not more frequently than necessary to accomplish that purpose; and (5) the employer ensures that only authorized persons have access to any data produced through the electronic monitoring and that the data is only used for the purpose and duration that the employee has been notified of pursuant to subsection (c) of this section.

Subsection (b) establishes a restrictive framework for employer electronic monitoring. Employers may only engage in electronic monitoring for one of seven enumerated purposes (assisting essential job functions, monitoring production, ensuring legal compliance, protecting health/safety/security, securing property, conducting periodic performance assessments, or tracking time/output for compensation). Even where a permissible purpose exists, the monitoring must be necessary, the least invasive means available, applied to the smallest number of employees with the smallest amount of data, and collected no more frequently than necessary. Access to monitoring data must be restricted to authorized persons and used only for the noticed purpose.

Compliance actions 1 item

Employers must not engage in electronic monitoring of employees unless the monitoring serves one of seven enumerated purposes (assisting essential job functions, monitoring production, ensuring legal compliance, protecting health/safety/security, securing property, periodic performance assessment, or tracking time/output for compensation). The specific monitoring form must be necessary and used exclusively for the stated purpose, must be the least invasive means available, must be applied to the smallest number of employees and collect the smallest amount of data no more frequently than necessary, and must be restricted so that only authorized persons access the data and use it only for the noticed purpose and duration.

D-01.4

21 V.S.A. § 495q(c)

Required notice for employee monitoring

Deployer

(c)(1)(A)–(N) 2 Required notice for employee monitoring. (1) At least 15 calendar days prior to commencing any form of electronic monitoring, an employer shall provide notice of the electronic monitoring to each employee who will be subject to it. The notice shall, at a minimum, include the following information: (A) the specific form of electronic monitoring; (B) a description of the intended purpose of the electronic monitoring and why the electronic monitoring is necessary to accomplish that purpose; (C) a description of how any data generated by the electronic monitoring will be used, including whether and how the data generated by the electronic monitoring will be used to inform employment-related decisions; (D) a description of the technologies that will be used to conduct the electronic monitoring; (E) a description of the specific activities, locations, communications, and job roles that will be electronically monitored; (F) the name of any person conducting electronic monitoring on the employer's behalf and any associated contract language related to the monitoring; (G) the name of any person, apart from the employer, who will have access to any data generated by the electronic monitoring and the reason why the person will have access to the data; (H) the positions within the employer that will have access to any data generated by the electronic monitoring; (I) when, where, and how frequently monitoring will occur; (J) the period of time for which any data generated by the electronic monitoring will be retained by the employer or another person and when that data will be destroyed; (K) notice of how an employee may access the data generated by the electronic monitoring and the process to correct any errors in the data; (L) a cover sheet that concisely summarizes the details contained in the notice; (M) notice of an employee's rights pursuant to this section and the judicial and administrative remedies available for redressing the wrongful use of electronic monitoring; and (N) instructions on how an employee can file a complaint against an employer for violations of this section.

(c)(2)(A)–(C) 2 If an employer uses electronic monitoring to track employee productivity or performance, the employer shall include the following information in the notice required by subdivision (1) of this subsection: (A) the performance or productivity standards by which employees will be assessed and how employees will be measured against those standards; (B) how performance or productivity data will be monitored and collected, including the identity of the employees subject to such monitoring and when, where, and how the monitoring and data collection will occur; and (C) any adverse consequences for failing to meet a performance or productivity standard and whether there is any bonus or incentive program associated with meeting or exceeding each standard.

(c)(3)(A)–(B) 2 Notice of electronic monitoring provided pursuant to this section shall be written in plain, clear, and concise language and provided to each employee in the employee's primary language. (B) An employer shall provide a new, updated notice to employees if it makes any significant changes to the manner of electronic monitoring or to the way that the employer utilizes the electronic monitoring or any data generated by it.

(c)(4)(A)–(B) 2 Notwithstanding subdivisions (1) and (2) of this subsection, prior notice of electronic monitoring shall not be required if: (A) the employer has reasonable grounds to believe that the employee is engaged in conduct that: (i) is illegal; (ii) violates the legal rights of the employer or another employee; or (iii) creates a hostile work environment; and (B) the electronic monitoring is reasonably likely to produce evidence of the conduct, is otherwise conducted in compliance with the previsions of this section, and is narrowly tailored to the purpose of identifying the conduct.

(c)(5)(A)–(B) 3 An employer that utilizes electronic monitoring shall annually provide each of its employees with a list of all electronic monitoring systems currently in use by the employer in relation to that employee. The list shall be provided in the primary language of the employee. (B) As used in this subdivision (5), "currently in use" means that the employer: (i) is currently using the system in relation to the employee; (ii) used the electronic monitoring system in relation to the employee within the past 90 days; or (iii) intends to use the electronic monitoring system in relation to the employee within the next 30 days.

Subsection (c) imposes detailed advance notice requirements on employers before commencing electronic monitoring. Employers must provide written notice at least 15 calendar days before monitoring begins, covering 14 enumerated disclosure elements including the monitoring form, purpose, data use, technologies, scope, third-party access, retention periods, employee access/correction rights, and complaint instructions. Additional disclosures apply when monitoring tracks productivity or performance. Notice must be in plain language in the employee's primary language. An exception to advance notice exists for investigation of suspected illegal conduct, rights violations, or hostile work environment — but the monitoring must still be narrowly tailored. Employers must also provide an annual list of all monitoring systems currently in use.

Compliance actions 2 items

Employers must provide written notice to each employee at least 15 calendar days before commencing any form of electronic monitoring. The notice must be in plain, clear, and concise language in the employee's primary language and must include at minimum 14 enumerated items: the form of monitoring; its purpose and necessity; how data will be used including for employment decisions; the technologies used; the activities, locations, communications, and job roles monitored; any third-party monitors and contract terms; any non-employer data recipients and reasons; internal positions with data access; monitoring frequency, timing, and location; data retention periods and destruction schedules; how employees can access and correct data; a cover sheet summary; employee rights and available remedies; and complaint instructions. When monitoring tracks productivity or performance, additional disclosures of standards, measurement methods, and consequences are required. Updated notice must be provided for any significant changes. An exception to advance notice applies only when the employer has reasonable grounds to believe an employee is engaged in illegal conduct, rights violations, or creating a hostile work environment — and the monitoring must be narrowly tailored and otherwise compliant.

D-01.1

Employers must annually provide each employee with a list of all electronic monitoring systems currently in use in relation to that employee. The list must be in the employee's primary language. A system is considered currently in use if the employer is currently using it, used it within the past 90 days, or intends to use it within the next 30 days.

D-01.1

21 V.S.A. § 495q(d)

Prohibitions on employee monitoring

Deployer

(d)(1)–(9) 4 Prohibitions on employee monitoring. Notwithstanding the purposes for electronic monitoring set forth in subdivision (b)(1) of this section, electronic monitoring shall not be used: (1) in any manner that violates State or federal labor, employment, civil rights, or human rights laws; (2) in relation to employees who are off-duty and not performing work-related tasks, including employees on-call; (3) to identify, punish, or obtain information about employees exercising legal rights, including rights guaranteed by labor and employment laws; (4) for audio-visual monitoring of bathrooms, locker rooms, changing areas, breakrooms, smoking areas, areas designated for the expression of breast milk, employee cafeterias, lounges, or other similarly private areas; (5) to determine the frequency with which employees visit or use bathrooms, locker rooms, changing areas, breakrooms, smoking areas, employee cafeterias, lounges, or other similarly private areas; (6) for monitoring, including audio-visual monitoring, of any space within an employee's residence or personal vehicle, or a property owned or rented by the employee, unless the monitoring is necessary to ensure the employee's health and safety or to verify the security of employer or client data; (7) to obtain information about an employee's actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, pursuit or receipt of reproductive health care, sex, sexual orientation, gender identity or expression, marital status, family responsibilities, personal appearance, immigration status, political affiliation or association, neurodiversity, veteran status, or other classification protected under State or federal law; (8) to take adverse employment action against an employee on the basis of data collected via continuous incremental time-tracking tools; or (9) in a manner that harms health or safety or violates the legal rights of any employee.

Subsection (d) establishes nine categorical prohibitions on electronic monitoring. These go beyond limiting monitoring to permissible purposes — they are absolute bars. Employers may not use monitoring in violation of labor, civil rights, or human rights laws; may not monitor off-duty employees; may not surveil employees exercising legal rights; may not conduct audio-visual monitoring of private areas; may not track frequency of use of private areas; may not monitor employee residences or personal vehicles (with narrow health/safety exceptions); may not use monitoring to obtain information about protected characteristics; may not take adverse action based on continuous incremental time-tracking data; and may not monitor in a manner that harms health, safety, or legal rights.

Compliance actions 1 item

Employers must not use electronic monitoring: (1) in any manner violating state or federal labor, employment, civil rights, or human rights laws; (2) in relation to off-duty employees not performing work-related tasks; (3) to identify, punish, or gather information about employees exercising legal rights; (4) for audio-visual monitoring of bathrooms, locker rooms, breakrooms, changing areas, lactation rooms, cafeterias, lounges, or similarly private areas; (5) to determine employee usage frequency of such private areas; (6) to monitor any space within an employee's residence, personal vehicle, or owned/rented property (unless necessary for health/safety or employer/client data security); (7) to obtain information about protected characteristics including age, race, disability, sex, sexual orientation, gender identity, religion, national origin, immigration status, political affiliation, neurodiversity, veteran status, or other state/federally protected classifications; (8) to take adverse employment action based on data from continuous incremental time-tracking tools; or (9) in a manner that harms health, safety, or legal rights of any employee.

D-01.5

21 V.S.A. § 495q(e)

Restriction of employee monitoring through personal devices

Deployer

(e)(1)–(3) 5 Restriction of employee monitoring through personal devices. (1) An employer shall not require an employee to install an application on a personal device for purposes of electronic monitoring or to wear a device or attach, embed, or physically implant a device on the employee's clothing that can be used for electronic monitoring, unless the electronic monitoring is: (A) necessary to accomplish the employee's essential job function; and (B) limited to only the times and activities necessary to accomplish the essential job functions. (2) Any location tracking function of an application or device shall be disabled outside of the times when the employee is engaged in activities necessary to accomplish essential job functions. (3) An employer shall not require an employee to physically implant a device on the employee's body for purposes of employee monitoring.

Subsection (e) restricts monitoring through personal devices. Employers may not require employees to install monitoring applications on personal devices or wear/attach/embed monitoring devices unless necessary for essential job functions and limited to the times and activities required. Location tracking must be disabled outside work-related activity times. A categorical prohibition bars employers from requiring employees to physically implant any device on their body for monitoring purposes.

Compliance actions 1 item

Employers must not require employees to install monitoring applications on personal devices or wear/attach/embed monitoring devices on clothing unless the monitoring is necessary for the employee's essential job function and limited to the times and activities necessary for those functions. Location tracking must be disabled outside essential-job-function activity times. Employers must not under any circumstances require an employee to physically implant a device on the employee's body for monitoring purposes.

D-01.4

21 V.S.A. § 495q(f)

Restrictions on use of automated decision systems

Deployer

(f)(1)(A)–(E) 6 Restrictions on use of automated decision systems. (1) An employer shall not use an automated decision system in a manner that: (A) violates or results in a violation of State or federal law; (B) makes predictions about an employee's behavior that are unrelated to the employee's essential job functions; (C) identifies, profiles, or predicts the likelihood that an employee will exercise the employee's legal rights; (D) makes predictions about an employee's emotions, personality, or other sentiments; or (E) use customer or client data, including customer or client reviews and feedback, as an input of the automated decision system.

(f)(2)(A)–(B) 7 An employer shall not solely rely on outputs from an automated decision system when making employment-related decisions. (B) An employer may utilize an automated decision system in making employment-related decisions if: (i) the automated decision system outputs considered in making the employment-related decision are corroborated by human oversight of the employee, including supervisory or managerial observations and documentation of the employee's work, personnel records, and consultations with the employee's coworkers; (ii) the employer has conducted an impact assessment of the automated decision system pursuant to subsection (g) of this section; and (iii) the employer is in compliance with the notice requirements of subdivision (4) of this subsection (f).

(f)(3) 8 An employer shall not use any automated decision system outputs regarding an employee's physical or mental health in relation to an employment-related decision.

(f)(4)(A)–(J) 9 Prior to using an automated decision system to make an employment-related decision about an employee, the employer must provide the employee with a notice that complies with subdivision (c)(3)(A) of this section and, at a minimum, contains the following information: (A) a plain language explanation of the nature, purpose, and scope for which the automated decision system will be used, including the specific employment-related decisions potentially affected; (B) the logic used in the automated decision system, including the key parameters that affect the output of the automated decision system; (C) the specific category and sources of employee input data that the automated decision system will use, including a specific description of any data collected through electronic monitoring; (D) any performance metrics the employer will consider using with the automated decision system; (E) the type of outputs the automated decision system will produce; (F) the individuals or entities that developed the automated decision system; (G) the individual or entities that will operate, monitor, and interpret the results of the automated decision system; (H) information about how an employee can access the results of the most recent impact assessment of the automated decision system; (I) a description of an employee's rights, pursuant to subsection (j) of this section, to access information about the employer's use of the automated decision system and to correct data used by the automated decision system; and (J) a statement that employees are protected from retaliation for exercising the rights described in the notice.

Subsection (f) imposes five categorical restrictions on ADS use, a human-oversight requirement, a health-data prohibition, and a detailed pre-use notice obligation. Employers may not use ADS in a manner that violates law, makes predictions unrelated to essential job functions, profiles likelihood of exercising legal rights, predicts emotions or personality, or uses customer/client data as input. Employers may not solely rely on ADS outputs — human oversight corroborating the output is required, along with a completed impact assessment and proper notice. The notice must include 10 enumerated disclosures covering purpose, logic, data inputs, performance metrics, output types, developer and operator identity, impact assessment access, employee rights, and anti-retaliation statement.

Compliance actions 4 items

Employers must not use an automated decision system in any manner that: (1) violates or results in a violation of state or federal law; (2) makes predictions about employee behavior unrelated to essential job functions; (3) identifies, profiles, or predicts the likelihood that an employee will exercise legal rights; (4) makes predictions about an employee's emotions, personality, or other sentiments; or (5) uses customer or client data, including customer or client reviews and feedback, as an input.

S-02

Employers must not solely rely on automated decision system outputs when making employment-related decisions. An employer may use an ADS in employment-related decisions only if all three conditions are met: (1) the ADS outputs are corroborated by human oversight of the employee, including supervisory or managerial observations, work documentation, personnel records, and consultations with coworkers; (2) the employer has conducted an impact assessment of the ADS under subsection (g); and (3) the employer has provided the required notice under subsection (f)(4).

H-01.6

Employers must not use any automated decision system outputs regarding an employee's physical or mental health in relation to an employment-related decision.

D-01.5

Employers must provide employees with written notice in plain, clear, and concise language before using an automated decision system to make an employment-related decision. The notice must include at minimum: (1) a plain language explanation of the ADS's nature, purpose, and scope, including specific employment decisions potentially affected; (2) the logic and key parameters affecting output; (3) the specific categories and sources of employee input data, including any data from electronic monitoring; (4) performance metrics the employer will use with the ADS; (5) the types of outputs the ADS will produce; (6) the developer(s) of the ADS; (7) the operator(s), monitor(s), and interpreter(s) of ADS results; (8) how to access the most recent impact assessment; (9) a description of the employee's rights to access and correct data under subsection (j); and (10) a statement that employees are protected from retaliation.

H-01.1

21 V.S.A. § 495q(g)

Impact assessment of automated decision systems

Deployer

(g)(1)(A)–(H) 10 Impact assessment of automated decision systems. (1) Prior to utilizing an automated decision system, an employer shall create a written impact assessment of the system that includes, at a minimum: (A) a detailed description of the automated decision system and its purpose; (B) a description of the data utilized by the system; (C) a description of the outputs produced by the system and the types of employment-related decisions in which those outputs may be utilized; (D) an assessment of the necessity for the system, including reasons for utilizing the system to supplement nonautomated means of decision making; (E) a detailed assessment of the system's validity and reliability in accordance with contemporary social science standards and a description of any metrics used to evaluate the performance and known limitations of the automated decision system; (F) a detailed assessment of the potential risks of utilizing the system, including the risk of: (i) discrimination against employees on the basis of race, color, religion, national origin, sex, sexual orientation, gender identity, ancestry, place of birth, age, crime victim status, or physical or mental condition; (ii) violating employees' legal rights or chilling employees' exercise of legal rights; (iii) directly or indirectly harming employees' physical health, mental health, safety, sense of well-being, dignity, or autonomy; (iv) harm to employee privacy, including through potential security breaches or inadvertent disclosure of information; and (v) negative economic and material impacts to employees, including potential effects on compensation, benefits, work conditions, evaluations, advancement, and work opportunities; (G) a detailed summary of measures taken by the employer to address or mitigate the risks identified pursuant to subdivision (E) of this subdivision (1); and (H) a description of any methodology used in preparing the assessment.

(g)(2)–(4) 11 An employer shall provide a copy of the assessment prepared pursuant to subdivision (1) of this subsection to an employee upon request. (3) An employer shall update the assessment required pursuant to this subsection any time a significant change or update is made to the automated decision system. (4) A single impact assessment may address a comparable set of automated decision systems deployed by an employer.

Subsection (g) requires employers to create a written impact assessment before utilizing any automated decision system. The assessment must cover eight elements: system description and purpose, data used, outputs and decision types, necessity assessment, validity and reliability evaluation against social science standards, a detailed risk assessment (covering discrimination, legal rights, health/safety/dignity, privacy, and economic impacts), mitigation measures, and assessment methodology. Employers must provide assessments to employees upon request, update them upon significant system changes, and may address comparable ADS deployments in a single assessment.

Compliance actions 2 items

Employers must create a written impact assessment before utilizing any automated decision system. The assessment must include at minimum: (1) a detailed description of the ADS and its purpose; (2) a description of data used; (3) outputs produced and the types of employment decisions those outputs may inform; (4) an assessment of necessity including reasons for supplementing nonautomated decision-making; (5) a validity and reliability assessment per contemporary social science standards, including performance metrics and known limitations; (6) a detailed risk assessment covering discrimination across protected classes, chilling effects on legal rights, harms to health/safety/dignity/autonomy, privacy risks including data breaches, and negative economic/material impacts to employees; (7) a summary of risk mitigation measures; and (8) a description of the assessment methodology.

H-02.3

Employers must provide a copy of the impact assessment to any employee upon request. Employers must update the assessment any time a significant change or update is made to the automated decision system. A single impact assessment may address a comparable set of ADS deployed by the employer.

H-02.5

21 V.S.A. § 495q(h)

Prohibitions on facial, gait, voice, and emotion recognition technology

Deployer

(h) 12 Prohibitions on facial, gait, voice, and emotion recognition technology. Electronic monitoring and automated decision systems shall not incorporate any form of facial, gait, voice, or emotion recognition technology.

Subsection (h) categorically prohibits the use of facial, gait, voice, or emotion recognition technology in both electronic monitoring and automated decision systems. This is an absolute bar — no purpose-based exception applies.

Compliance actions 1 item

Employers must not incorporate any form of facial, gait, voice, or emotion recognition technology in electronic monitoring or automated decision systems.

S-02.2

21 V.S.A. § 495q(i)

Protection of employee privacy

DeployerDeveloper

(i)(1) 13 Protection of employee privacy. (1) An employer; any person that develops, operates, or maintains electronic monitoring or an automated decision system on behalf of an employer; and any person who collects, stores, analyzes, interprets, disseminates, or otherwise uses data produced or utilized by electronic monitoring or an automated decision system shall implement reasonable security procedures and practices appropriate to the nature of the data to protect employees' personal information from unauthorized or illegal access, destruction, use, modification, or disclosure.

(i)(2)(A)–(B) 14 Any person that develops, operates, or maintains electronic monitoring or an automated decision system on behalf of an employer and any person who collects, stores, analyzes, interprets, disseminates, or otherwise uses data produced or utilized by electronic monitoring or an automated decision system shall, upon termination of the contract with the employer: (A) return all data and automated decision system outputs to the employer; and (B) destroy all data and automated decision system outputs in the person's possession.

Subsection (i) imposes data security and data disposition obligations on employers and any third party that develops, operates, or maintains electronic monitoring or ADS on behalf of an employer. All such parties must implement reasonable security procedures to protect employee data. Upon contract termination, third parties must return all data and ADS outputs to the employer and destroy all copies in their possession.

Compliance actions 2 items

Employers, any person that develops, operates, or maintains electronic monitoring or an ADS on an employer's behalf, and any person who collects, stores, analyzes, interprets, disseminates, or otherwise uses monitoring or ADS data must implement reasonable security procedures and practices appropriate to the nature of the data to protect employees' personal information from unauthorized or illegal access, destruction, use, modification, or disclosure.

D-01.4

Any person that develops, operates, or maintains electronic monitoring or an ADS on an employer's behalf, and any person who collects, stores, analyzes, or uses monitoring or ADS data, must upon termination of the contract with the employer: (1) return all data and ADS outputs to the employer, and (2) destroy all data and ADS outputs in the person's possession.

D-01.4

21 V.S.A. § 495q(j)

Employee right to access and correct data

Deployer

(j)(1) 15 Employee right to access and correct data. (1) Within seven days of receiving a request, an employer shall provide an employee with access to any data that relates to the employee that was produced or utilized by electronic monitoring or an automated decision system used by the employer.

(j)(2)(A)–(B) 16 Within seven days of receiving a request to correct potential errors identified by an employee, an employer shall: (A) correct the erroneous information or data and provide the employee with a notice that complies with subdivision (c)(3)(A) of this section, explaining the steps taken by the employer; or (B) provide the employee with a notice explaining that the employer has not corrected the information or data and describing the steps the employer has taken to verify the accuracy of the disputed information or data.

Subsection (j) grants employees the right to access and correct data related to them that was produced or utilized by electronic monitoring or ADS. Employers must respond within seven days of a request. For correction requests, the employer must either correct the data and explain the steps taken, or explain why the data was not corrected and describe the verification steps taken.

Compliance actions 2 items

Employers must, within seven days of receiving a request, provide an employee with access to any data relating to that employee that was produced or utilized by electronic monitoring or an automated decision system used by the employer.

D-01.1

Employers must, within seven days of receiving an employee's request to correct potential errors, either: (1) correct the erroneous data and provide the employee with a plain-language notice explaining the correction steps taken, or (2) provide the employee with a notice explaining that the data was not corrected and describing the verification steps taken to assess accuracy.

D-01.2

21 V.S.A. § 495q(k)

Retaliation prohibited

Deployer

(k) 17 Retaliation prohibited. An employer shall not discharge or in any other manner retaliate against an employee who exercises or attempts to exercise the employee's rights under this section. The provisions against retaliation set forth in subdivision 495(a)(8) of this subchapter shall apply to this section.

Subsection (k) prohibits employers from discharging or retaliating against employees who exercise or attempt to exercise their rights under the section. It incorporates by reference the existing anti-retaliation provisions of 21 V.S.A. § 495(a)(8).

Compliance actions 1 item

Employers must not discharge or in any other manner retaliate against an employee who exercises or attempts to exercise their rights under this section, including rights to notice, data access, data correction, and complaint filing. The existing anti-retaliation provisions of 21 V.S.A. § 495(a)(8) apply.

G-03.3

21 V.S.A. § 495q(l)

Enforcement

(l) Enforcement. The provisions of section 495b of this subchapter shall apply to this section.

Subsection (l) incorporates by reference the enforcement provisions of 21 V.S.A. § 495b, which governs enforcement of Vermont's fair employment practices. This provides the bill's enforcement mechanism, including the ability to file complaints and bring civil actions.

Sec. 2

Effective date

This act shall take effect on July 1, 2025.

Section 2 sets the effective date for the act as July 1, 2025.

Safety Harmful content prevention · self-harm escalation

2 items

S-02

S-02.2

Employers must not incorporate any form of facial, gait, voice, or emotion recognition technology in electronic monitoring or automated decision systems.

Data Controls Data sale restrictions · deidentification

10 items

D-01.4

D-01.1

D-01.5

D-01.4

D-01.5

Employers must not use any automated decision system outputs regarding an employee's physical or mental health in relation to an employment-related decision.

D-01.4