House committee walks through H.208 privacy bill, highlighting sensitive-data rules and exemptions

The Vermont House Committee on Commerce & Economic Development on May 1 heard a technical walk‑through of H.208, a 65‑page consumer data privacy and online surveillance bill, with legislative counsel Rick Segal of the Office of Legislative Council explaining definitions, exemptions and how H.208 compares to companion senate measures.

Segal, the legislative counsel leading the session, told the committee, “It is a 65 page bill. I am not gonna read it word for word,” and focused on key definitions and carve‑outs that would determine who and what the law covers.

Why it matters: H.208 would define the categories of data that receive special protection (so‑called sensitive data), set rights for consumers such as access or deletion, and create business obligations and exceptions. The committee’s examination focused on wording—how terms are defined and where federal law or existing state statutes affect application—rather than on policy questions reserved for witnesses.

The bill treats biometric and other categories as sensitive. As Segal explained, biometric data includes “data generated from the technological processing of an individual's unique biological, physical, or physiological characteristics that allow or confirm the unique identification of the consumer, including iris or retina scans, fingerprints, facial or hand mapping, geometry or templates, vein patterns, voiceprints or vocal biomarkers, and gait or other personally identifying physical movement or patterns.” The bill also explicitly excludes photographs or recordings from the biometric definition unless those files are processed to identify a specific individual.

H.208’s sensitive‑data definition spans multiple pages and covers items the bill would restrict more tightly: government‑issued identifiers (for example, Social Security numbers), health and genetic data, sexual orientation and gender identity information, neural data, precise geolocation, and online activity tracked across devices and services. Segal summarized that “sensitive data is treated very, very carefully in this bill” and that processing or sale of that data is heavily restricted.

The committee discussed several numeric and threshold clarifications included in the language. For example, the bill defines a “large data holder” as an entity that processed personal data for at least 100,000 consumers in the preceding calendar year; precise geolocation is defined as location information accurate to within a radius of 1,850 feet; and the bill treats a facility as a mental‑health or reproductive‑health facility if at least 70% of its services are in those categories.

Segal walked members through a set of exemptions in the bill. Major exemptions include federal, state, tribal and local government entities engaged in ordinary course operations; protected health information governed by HIPAA; information covered by the Children’s Online Privacy Protection Act (COPPA) for parental‑consent requirements; and data subject to several federal statutes such as the Fair Credit Reporting Act, the Driver’s Privacy Protection Act, FERPA, the Airline Deregulation Act and the Gramm‑Leach‑Bliley Act. Segal underscored that some exemptions exist to avoid conflict or preemption with federal law and that the exact scope may need further clarification from witnesses.

Committee members asked clarifying questions about how several terms would operate in practice. One member asked how broadly the bill’s definition of “decisions that produce legal or similarly significant effects” should be read; Segal said the definition is lengthy and recommended revisiting its use in the bill’s later sections. Members also asked whether the bill’s publicly‑available information carve‑outs could be read to allow sale of data publicly posted by consumers; Segal said the phrase gives controllers some discretion but that courts would ultimately interpret contested uses.

Segal noted H.208 includes a limited private right of action, a feature that differs from many state laws. He also pointed members to comparative materials from the International Association of Privacy Professionals to view how other states’ approaches compare; Segal said he would provide the committee with that material.

What the meeting did not do: The session was a legal and drafting walkthrough rather than a policy debate. Segal repeatedly directed members that language questions were appropriate for this meeting, while policy or advocacy questions should be raised with witnesses (including staff the committee plans to call later) or the bill sponsor. The committee did not take any votes or make formal changes during the session.

Looking ahead: Committee members indicated they will follow up with witnesses and staff for policy context, federal‑law preemption questions, and to resolve specific drafting choices (for example, the geolocation radius and the scope of exemptions). The walkthrough ended with the committee taking a scheduled break, with no formal action taken on H.208 during the meeting.