Attorney General’s office backs H.342 privacy bill, urges dual enforcement and $10,000 penalty cap

The Bramale House Committee on Commerce & Economic Development heard testimony Feb. 27 from the Attorney General's office that it supports the goals of H.342 and the committee's draft 2.2 while urging specific drafting clarifications.

"The attorney general supports the goals of s 3 42, and we are comfortable with draft 2.2," said Todd Delos, a representative of the Attorney General's Office. Delos said the office supports a private right of action and asked the committee to preserve the AG's separate enforcement authority so both an individual and the AG can pursue remedies concurrently.

Committee members and the AG's representative discussed several technical provisions in draft 2.2, including the cross-reference to Chapter 63 of Title IX (the Consumer Protection Act), the AG's rulemaking and investigatory authority under the bill's proposed section C1(b), and the statutory damages language in C2 that would create liquidated or statutory damages. Delos described the AG's enforcement language as "fairly standard" and said it "largely tracks the language in the Consumer Protection Act."

Why it matters: committee members pressed on how enforcement and remedies would operate if both private litigants and the AG could bring actions. The committee is weighing policy trade-offs between individual access to court remedies and preserving state-level enforcement power to address patterns of harm across many residents.

Delos told the panel the AG's office typically brings enforcement actions when there is a broad pattern or significant harm affecting Vermonters, rather than pursuing isolated individual claims. He said the office wants to avoid being foreclosed from proceeding simply because a private suit is already filed: "We would just want to be sure that the AG's authority is not circumscribed by an individual's choice and application of the law." He added that the office views its suits as actions "on behalf of the people of the state" and often focus on patterns and practices rather than single-person disputes.

On penalties, the draft includes a $10,000-per-violation ceiling consistent with consumer-protection statutes. Delos explained that figure is used as a statutory ceiling in other consumer-protection work and that the office evaluates penalties case by case, considering mitigation and ability to pay. He also described the typical budgeting treatment: penalties collected are paid into the general fund, with the AG's regular budget unaffected by collections.

Committee members raised legal and policy questions during the discussion, including whether the bill's focus on "covered person" versus the Consumer Protection Act's definition of "consumer" affects characterization of the law, and how courts might treat concurrent private and AG enforcement. Delos said the cross-reference to Chapter 63 is primarily a drafting tool to clarify the source and limits of AG authority.

Members discussed operational tools in the draft intended to help the AG detect problems: a process by which a covered person can notify the AG if a data broker has not complied within a 15-day window, producing complaint-driven information that the AG can use to prioritize investigations. Delos confirmed the office's enforcement is largely complaint-driven.

No formal vote was taken on H.342 during the session. The committee paused its discussion to attend other scheduled business and planned to reconvene later to continue work on drafting language and related procedural items.