Committee debates notice form, enforcement timeline in data-broker bill

The Vermont House Committee on Commerce & Economic Development continued work on draft 3.8242 on March 27, discussing how covered Vermonters must notify data brokers and when enforcement can begin. Committee members focused on the Attorney General’s role in creating a standardized notice form, the 90-day deadline for publishing that form, and a private right of action scheduled to begin Jan. 1, 2026.

The bill would require the attorney general to publish a notice form within 90 days of July 1, and make that form the required means for covered persons to notify data brokers after that window. A staff member from the Office of Legislative Counsel told the committee, “The form must be provided by the AG 90 days from July 1.” The draft also sets Jan. 1, 2026, as the earliest date an individual may bring a private suit; as the counsel summarized, “You cannot file a suit against a data broker until 01/01/2026.” The attorney general’s office may pursue other enforcement actions earlier, under the bill’s delegation of rulemaking authority.

Members pressed for clarity on what identifying information must be included in a notice so data brokers can match requests to the correct records. Representative Cooper asked whether the form must show “what’s still out there” — meaning an element of the person’s data that the requester says was disclosed — to help verify a claim. Committee members and counsel repeatedly discussed requiring a person’s name plus at least one element of protected information (for example, a phone number, email address or postal address) that would allow a data broker to locate matching records.

Several lawmakers flagged practical problems with common names and with data brokers who store only one type of identifier. One member warned that a data broker could respond to a very common name by removing every matching record to avoid liability, or conversely might be unable to match a requester who provides only an identifier the broker does not hold. Committee members suggested the notice form could prompt requesters to provide “the more information you give us, the more likely the data brokers will be able to match you,” and delegated specifics to the attorney general’s rulemaking process.

The group also discussed a provision that would allow covered persons to use their own written notice before the AG’s form is published. Counsel and several members said that allowing ad hoc forms during the interim raises potential litigation risk for individuals and uncertainty for data brokers; the committee agreed to keep the 90‑day publication window while staff work on clearer language about what interim notices must include.

Members noted other procedural items in the draft, including which state agencies will participate in a mandated study (references to ADS, AOA and the Vermont League of Cities and Towns, VLCT) and whether the bill can compel associations such as VLCT or clerks and treasurers to provide input. Committee discussion emphasized delegation to state agencies and the attorney general for technical implementation and rulemaking.

No final committee vote or formal adoption was recorded in the transcript. Members asked staff to refine wording around the notice requirements, the interim-use period for non-AG forms, and the list of identifying elements a covered person must provide so the attorney general’s form and subsequent rules minimize mismatches and potential frivolous suits.

Looking ahead, committee members said staff will redraft the sections discussed and return with language that specifies minimum identifying information, clarifies the 90-day and Jan. 1, 2026 dates in the text, and addresses remaining enforcement questions such as jurisdiction over out-of-state data brokers.