Vermont Data Privacy and Online Surveillance Act 2415f-d: 9 V.S.A. § 2415f(c) and (d) Role follows conduct: a processor that departs from instructions is a controller

Whether a person is a controller or processor is a fact-based determination; a person not limited by, or not following, a controller's instructions is a controller for that processing, and a processor that begins to determine purposes and means becomes a controller subject to enforcement; neither party is relieved of the liability its role carries.