Committee reviews draft requiring Attorney General notice form for data-broker disclosures

The Vermont House Committee on Commerce and Economic Development on March 27 reviewed a revised draft of legislation that would require the attorney general to create a standardized written notice for individuals to send to data brokers seeking cessation of specific disclosures.

Legislative counsel Rick Seigel described the change as a standardized form and said, “This is the notice that the AG will produce for people to use to send to data brokers.” The draft (referred to in the meeting as draft 3.2/3.3) adds a new subdivision that would require a covered person, or an agent acting for a covered person, to include the covered person’s full name and the specific protected information being disclosed when submitting that notice.

Why it matters: the provision creates a single, AG-provided notice form intended to make it easier for individuals to tell data brokers which specific items of personal data to stop disclosing. Committee members emphasized the measure is reactionary — it applies after data are already being disclosed — and flagged limits and potential unintended consequences, including interactions with public records and private enforcement.

Key provisions discussed - AG form and timeline: The committee recorded that the attorney general would have 90 days from July 1 to finalize and publish the standardized form (a timeline given in the draft that would make the form available between July 1 and Sept. 1). - Required content of notice: The draft requires the notice to identify whether the sender is the covered person or an authorized agent, provide the covered person’s full name and identify the specific protected information the sender alleges is being disclosed, and reference the statute cited in the draft (identified in the discussion as “statute 9 BSA 2,448”). - Follow-up reporting to the AG: The bill text reviewed includes a form a covered person would use to notify the AG if a data broker continued to disclose information after 15 days; that form would require the name of the data broker and the specific protected information alleged to remain disclosed. - Study and AG role: The draft was revised to list the attorney general as a consultant to a study included in the bill; committee staff confirmed the AG’s office had offered to support the study.

Committee concerns and discussion Committee members repeatedly noted that the proposal is a limited, targeted response to disclosures already in circulation rather than a preventative block on data sharing. Several members said they view the bill as a “start” but expressed doubts about how effective it will be against determined bad actors or in cases where information appears in public records.

Members also raised concern about private enforcement. One member said privately litigating over disclosures could create a market for opportunistic lawsuits or demand letters, and several members said they wanted to avoid creating unanticipated liability or incentives for abuse. Other concerns focused on whether the requirement to identify the precise piece of protected information in a notice would be a fatal technicality if senders failed to locate every instance of that information across multiple brokers.

Process and next steps Committee members discussed turning the draft into a floor amendment on third reading (a strike-all amendment), and several members said they would vote yes in a forthcoming straw poll to bring the amendment forward. Staff explained that, because the committee report has been adopted and the bill is on third reading, the change would be submitted as an individual floor amendment that can carry multiple names. Committee members were asked whether they wanted their names placed on the amendment.

What the draft does not do The committee noted multiple times that the bill is not written to remove all personal data from the internet or to prevent initial disclosures; it addresses redisclosure by data brokers when a covered person identifies specific items to be stopped. Members emphasized that other companies or repositories could continue to disclose information not covered by an individual notice and that additional notices could be required to cover multiple items or multiple brokers.

Next steps: committee staff said they would give members time to review the updated draft and determine whether to put their names on the floor amendment. No formal vote or final committee action on the amendment was recorded in the transcript.