Lawmakers press Vermont digital services chief on who receives, resells driver and criminal records

Members of the Vermont House Committee on Energy and Digital Infrastructure pressed Denise Riley Hughes, secretary of the Agency of Digital Services (ADS) and state chief information officer, on May 15 about how the state shares and, in some cases, receives revenue for Vermonters’ driver-history and limited criminal-history records.

The committee focused on two primary channels by which personally identifying records are distributed: driver history records governed by the federal Driver Privacy Protection Act (DPPA) and limited criminal-history files used for background checks. ADS and the Department of Motor Vehicles route many such transactions through the state's web portal and vendor-hosted services; ADS told the committee the state pays about $3,600,000 annually for the web interface and that “it is less than 2% of that number that comes from a 2 processes that are actually required by law,” referring to revenue associated with those legally required disclosures.

Why it matters: committee members said aggregated, bulk access and downstream resale or retention of individual records raise privacy and security risks. Lawmakers pressed whether recipients — for example, insurance companies that receive DPPA-authorized driver records — may later resell or retain the data and whether the state can require limits on resale or retention.

ADS’s explanation and scope

Secretary Denise Riley Hughes told lawmakers that driver-history records are provided to authorized subscribers under federal law (DPPA) and that a separate category of limited criminal-history records (treated as public-safety records) is provided for background checks. She said those flows are automated through the web portal vendor and that the vendor retains transactional fees rather than the underlying records, and that contract language explicitly restricts vendor retention in many cases.

Hughes summarized the state’s immediate visibility as limited: ADS is aware of two concrete places where data flows out in bulk under legal requirements — DMV driver-history records and limited criminal-history requests — but she said ADS is assembling a comprehensive data-sharing inventory to identify other interfaces, automated feeds, one-off reports or legacy contracts that could move data outside ADS’s current visibility.

Committee concerns and follow-up steps

Members repeatedly asked how the state can prevent authorized recipients from reselling data, how long recipients may retain information, whether foreign entities can request the same public records, and where statutory authority to limit resale or retention would sit. Hughes recommended starting with Vermont’s Public Records Act and related statutes rather than trying to place broad data-definition language into ADS’s enabling statute. She also said ADS will deliver more targeted report language and work with both House and Senate committees to avoid conflicting definitions with a separate data-privacy bill (S.71).

The committee and secretary discussed using H.458 as a vehicle for a session-law requirement that ADS produce a focused report or deliverable this year while ADS continues building the broader inventory. Hughes also proposed executive-session briefings (via a secure forum referenced as JaiTalk in committee discussion) so committee members can see restricted inventory details without increasing cyber risk.

What was not decided

No formal vote or statutory change occurred at the hearing. Committee members said they want to move with urgency, but they also acknowledged definitions in S.71 may conflict with any language tucked into H.458. Hughes agreed to prepare suggested language and share it with the committee and to provide the inventory work products and briefings to inform legislative next steps.

Ending

Lawmakers left the hearing with clearer detail about the two known bulk flows (driver-history and limited criminal-history records), the role of the web portal vendor and the statutory touchpoints (DPPA and state public-records law). ADS committed to produce suggested session-law language for H.458 and to continue the agency’s inventory and security validations so the Legislature can consider statutory or policy guardrails before the next session.