Committee weighs H.458 reporting on state agencies' sale of data; ADS urges narrower approach

House Committee on Institutions members discussed H.458 on April 30 and a proposed amendment that would ask the Agency of Digital Services (ADS) to report on state agencies' sale of personal data.

Denise Rotherbius, secretary for the Agency of Digital Services and the state's chief information officer, told the committee ADS is comfortable meeting the bill as introduced but raised concerns about a separate amendment that would add data definitions and a one‑time report. "They would need to put in some data sharing guidance and an approvals process, and that doesn't exist today," she said.

The committee discussed whether ADS should produce a comprehensive list of instances in which state data is sold and recommended the inventory include the type of relationship people have with the state and the kinds of data being sold. A committee member urged the list be “as comprehensive as possible,” explicitly citing incarcerated people and other populations the committee wants included.

Rotherbius said some categories of information currently sold are treated as public records under federal or state law. She cited the federal Driver's Privacy Protection Act (DPPA) and limited criminal history records as examples of records that are distributed to authorized recipients under existing law. She also described the state's long‑running web portal arrangement, in which a private partner handles many online transactions under vermont.gov and retains a share of transaction fees to offset hosting and compliance costs.

On the potential conflict between bills, Rotherbius said the data definitions in a separate bill described to the committee as S.71 differ from the definitions in the amendment proposed for H.458. "If there are varying degrees of definitions, we would now have conflict in statute," she said, and recommended the committee wait until S.71 is resolved before legislating overlapping definitions.

Rotherbius described internal ADS work underway that she said will support any reporting: a consolidated data team (including data, AI and privacy staff) is generating a comprehensive data‑sharing inventory, drafting data governance guidance, and developing records‑retention and privileged‑access controls. "We're the custodians, but we are not the owners of the data," she said, describing ADS's role in managing digital systems on behalf of agencies.

Committee members asked for more detail and a path forward. Rotherbius offered to provide suggested alternatives and a memo describing how data‑definition and reporting requests might be handled outside of H.458 so the bill can proceed without introducing conflicting statutory language. A committee member said they had not previously discussed the amendment and asked for a clearer statement of intent; another asked ADS to help coordinate a request for information from agencies so the committee could get an initial list of what is known.

No formal motion or vote on the amendment was recorded in the transcript of this meeting.