House committee reviews draft amendment to limit data-broker disclosures, weigh AG enforcement and study of government records

House members considered draft 2.2 of an amendment to a data-broker bill Thursday, focusing on how covered people would notify data brokers, which state office would host the notice form, enforcement paths and a planned study on whether state and municipal records should be included.

The committee discussed two enforcement tracks: the Attorney General could investigate and assess civil penalties of up to $10,000 per violation, and individual “covered persons” could pursue a private right of action that provides actual damages or a statutory award of $1,000 per violation (whichever is greater), plus attorney fees and other equitable relief. Committee staff described a 15-day compliance window after a broker receives notice; if a broker removes the information within that window and is later sued, the broker would be limited to paying only reasonable attorney fees and court costs rather than statutory damages. The draft delays private lawsuits until Jan. 1, 2026, while giving the AG authority to begin enforcement on July 1, 2025.

Why it matters: the amendment would give Vermonters defined remedies when companies that assemble and sell personal data fail to stop redisclosure after being formally notified. Committee members pressed staff and agency witnesses on how the law would work in practice, how verification should be handled, where fines would be deposited, and whether including state and local government records in the law could produce unintended conflicts with existing public-records and licensing statutes.

Key details and debate

Committee staff told members that the amendment moves the notice form from the Secretary of State to the Attorney General’s office. The draft creates two penalty tracks: (1) AG enforcement with rulemaking and civil-investigation authority under Chapter 63 (consumer-protection authority was cited by staff as the statutory basis); and (2) a private right of action that allows a covered person to sue a data broker that continues to disclose covered information after the statutorily required period. The draft specifies a 15-day period for brokers to comply after receiving notice; committee members asked whether the 15 days should be measured as calendar days or business days (some members proposed returning to 10 business days).

The proposed remedies and safe harbor

- Civil penalty: up to $10,000 per violation if the Attorney General pursues enforcement. The AG would also have authority to adopt rules to implement the section and to conduct civil investigations. - Private damages: either actual damages or $1,000 per violation, whichever is greater; punitive damages only upon proof of willful or reckless disregard; reasonable attorney’s fees and costs; injunctive or other equitable relief possible. - Safe harbor: if a data broker removes the covered person’s information within 15 days of receiving notice, the broker is shielded from the statutory or liquidated damages in a subsequent lawsuit and would be liable only for attorney fees and court costs. The draft removes that safe harbor if the broker retaliates by disclosing additional information or redisclosing after receiving notice. - Timing: AG enforcement could begin July 1, 2025; private suits are delayed until Jan. 1, 2026 (covered persons could send notices earlier but could not sue until the effective private-action date). Committee staff explained that the staggered start is intended to give brokers time to comply while letting the AG begin oversight earlier.

Verification, notice form and process questions

Committee members raised verification concerns: the draft prohibits requiring proof of identity for a notice, which staff said allows an individual to send a removal notice without documentary proof. Members worried about impersonation and whether requiring verification would force disclosure of more personal data. One committee member proposed that the notice form include a clear disclaimer telling people that the process may not remove their information from all public-facing databases (for example, grand lists or tax rolls) so that requesters are not given a false sense of security.

Members also asked whether the covered person should copy the AG after the 15-day period so the AG can detect patterns of noncompliance; staff and witnesses supported an ongoing copying mechanism so the AG could see when multiple notices accumulate.

Study of state and municipal data and implementation concerns

The draft contains a separate study provision (sponsored in amendment language attributed to Representative Harvey) to analyze including state and municipal government records in the law. Denise Riley Hughes, secretary for the Agency of Digital Services, told the committee: "I'm the secretary for the Agency of Digital Services, also the state's chief information officer," and said ADS supports a study but not immediate statutory inclusion of state or local government without further work. Josiah Raisham introduced himself as "the state's chief data and AI officer." Sean Brown, deputy secretary of the Agency of Administration, described resource constraints at AOA and cautioned that the administration could be exposed to fines if broad statutory obligations were applied to existing licensing and public-records databases without careful study.

Witnesses highlighted practical obstacles: many public data sources (for example, licensing databases) are intentionally public to allow consumers to confirm professional credentials; some employee information is already statutorily protected and cannot be easily redacted; and municipalities vary widely in technical capacity. Agency witnesses said internal policy work (AOA/ADS) and targeted statutory fixes may cover much of the executive-branch exposure, and recommended that the study identify where legislative changes would be necessary versus where an executive-branch policy could address issues.

Scope of data brokers, registration and enforcement reach

Agency witnesses and staff noted the limits of state registration: state registration lists far fewer brokers than independent studies estimate exist. Witnesses cited several counts mentioned in the meeting: 426 registered in Vermont at the most recent look, roughly 300 earlier, while outside reports list several hundred to thousands of brokers (examples cited: 1,711 in one study; 540 in a 2024 PrivacyRights.org estimate). The committee discussed expanding the statutory definition of “data broker” to capture more entities, and staff clarified that notices in the draft could be sent to brokers whether or not they were registered in Vermont.

Unresolved issues and next steps

Committee members asked for language edits and additional clarifications: add the disclaimer about public databases to the notice form; decide whether the compliance window is calendar or business days; specify the minimum personal data elements that trigger removal requests; and require a copy of the notice to the AG after the 15-day window. Staff agreed to circulate updated draft language and to work with Rick Segal (committee counsel) and the Attorney General’s office. Agency witnesses agreed to participate in the study if resourced; Agency of Digital Services said it would work with AOA and the AG’s office on a study scope and initial timelines and aim to provide proposed study language to committee counsel promptly.

Ending

Committee members directed staff to redraft with the clarifications discussed and to return language for consideration before the bill reaches the floor. No formal vote or final action on the amendment occurred during this meeting; the committee agreed to continue work and to involve ADS, AOA and the Attorney General’s office in the study and implementation planning.