House Commerce panel posts S.71 amendment resetting privacy bill, tightening data-broker and threshold language

MONTPELIER, Vt. — The Vermont House Committee on Commerce & Economic Development circulated a committee amendment to S.71 on May 30 that largely restores the bill to the text of H.208 while changing several key thresholds and clarifying how data-broker and ‘‘direct relationship’’ rules apply.

The amendment "resets to where 71 started when it was in the senate," said Praneeth, legislative staff, describing the package to the committee. He said the change was intended to make the bill closer to H.208 so interested parties would be more willing to testify.

The amendment keeps a fixed applicability threshold of 25,000 consumer data points per year rather than the phased step-down previously proposed. It raises the private right of action threshold for ‘‘large data holders’’ from an earlier 100,000 Vermonters per year to 200,000 Vermonters per year, and it increases an annual revenue exemption from $25,000,000 to $500,000,000.

Praneeth also told the committee the amendment restores language from H.208 clarifying how data minimization interacts with advertising provisions and carries forward the private right of action.

The draft adds two notable clarifications to the law’s definitions: it expands the existing data-broker language to include "individuals" as well as business entities, and it provides a more detailed definition of a "direct relationship" between a consumer and a business. Under the new text, a direct relationship requires an intentional interaction by the consumer for accessing, purchasing, using, requesting, or obtaining information about a business’s products or services. The amendment also enumerates situations that do not create a direct relationship, including when a consumer exercises privacy rights (for example, an opt-out under the bill’s consumer-rights section) or when a business collects information from a consumer without an intentional interaction.

"You can decide not to [be treated as a direct relationship]," Praneeth said, explaining examples already in statute such as past or present customers, clients, subscribers and users.

Committee members and staff discussed that the data-broker definition has not been substantially updated since Vermont created a registry and that other states have continued to refine their approaches. Rick, a staff member present to answer fiscal questions, confirmed technical drafting changes and responded to procedural queries.

Committee members were invited to submit feedback; Praneeth said the amendment is posted on the committee webpage and that he will circulate it to an existing listserv and encouraged emails and redline exchanges over the summer. The committee signaled intent to continue working on the data-broker chapters (noted in the draft as separate bill language) through the summer and into future sessions.

No formal vote on the amendment was recorded during the session; the item was presented for review and public comment.

What the committee changed

- Applicability threshold: The amendment retains a single threshold of 25,000 consumer records per year rather than the previously proposed multi-year step down (25,000 → 12,500 → 6,250). - Private right of action: The population threshold defining "large data holders" was increased from 100,000 to 200,000 Vermonters per year. - Revenue exemption: The revenue-based exemption rose from $25,000,000 to $500,000,000 in annual revenue. - Data-broker language: The draft explicitly adds "individual" to the entities covered by the data-broker definition and adds a clarified definition of "direct relationship," with enumerated exceptions (including exercising privacy rights and verification of identity). - Data minimization and advertising: Restored clarifying language from H.208 on how data minimization obligations interact with targeted-advertising provisions.

Why it matters

The changes narrow how broadly the law would apply to small processors by keeping the 25,000 fixed threshold and increase the size of entities that will be subject to the private right of action and other obligations by raising population and revenue cutoffs. The explicit inclusion of individuals in the data-broker definition would allow enforcement and registration requirements to reach single-person operators who buy, sell or broker personal data.

Next steps

The committee made the proposed amendment available on its webpage and asked interested parties to provide comments this summer. Staff said they expect to continue refining data-broker language and related chapters and to consider separate bills or follow-up amendments later in the year.