Committee reviews draft 3.1 adding Attorney General reporting form and notice changes for data-broker disclosures

The Vermont House Committee on Commerce and Economic Development on March 27 reviewed draft 3.1 of bill 342, which would add a mechanism for covered people to notify the attorney general when data brokers continue to disclose protected personal information and would expand the scope of a mandated study of state disclosure practices.

Committee members and legislative counsel discussed three principal changes in draft 3.1: (1) adding a disclaimer to the notice that a covered person uses to request removal from data brokers, warning that removal requests may complicate certain business transactions; (2) adding a new Attorney General enforcement subdivision that would require the attorney general to post a form on the office website so covered people or authorized agents can report data brokers that continue to disclose protected information more than 15 days after a removal notice; and (3) changing which state agency leads the required study and expanding the study’s required subjects.

Under the draft language described by Rick Segal of the Office of Legislative Council, the AG reporting form would be optional for covered people but, at a minimum, would require the name of the data broker and at least one element of the covered person’s protected information (for example, an address or phone number). Segal said the bill would make clear that "the cease and disclosure of a covered person's protected information may not result in the covered person's protected information being totally removed from the Internet." The draft also directs the attorney general to collect this information to help the office understand ongoing disclosures by data brokers.

Committee members also reviewed edits to the statutory study. The draft assigns the study to the Agency of Digital Services (ADS) rather than AOA and requires ADS to consult with the Office of the Attorney General, the secretary of state, and other state agencies as requested. The study language added consideration of "fiscal and resource impact on public agencies," the degree to which risk can be mitigated through state or local policy, and a requirement to identify "which statutes, regulations, and administrative policies require amending" to allow public agencies to cease disclosure of covered persons’ protected information. The draft also gives the study leeway to examine related topics beyond the enumerated list.

No formal committee vote or final action on the bill is recorded in the transcript excerpt. At the end of the discussion the chair said the committee needed to go to the floor for a vote and suggested returning to any remaining questions afterward.

The draft under discussion is identified in the meeting as draft 3.1 of bill 342; the committee and legislative counsel indicated additional edits from ADS and other stakeholders are reflected in the current draft.