Vermont Data Privacy and Online Surveillance Act 2415i-f: 9 V.S.A. § 2415i(f) Processing under an exemption must be necessary, proportionate, secured and proven

Personal data processed under a section 2415i purpose may be processed only as reasonably necessary and proportionate and adequate, relevant and limited to the specific purpose; data kept for internal uses must reflect the nature and purpose of that use and be protected by reasonable measures that secure it and reduce foreseeable harm; a controller relying on an exemption bears the burden of showing it qualifies and complies.