Vermont committee debates safe-harbor alternative for H.342 to protect public servants' personal information

The Vermont House Committee on Commerce & Economic Development on March 25 reviewed a revised amendment to H.342, a bill intended to protect the personal information of certain public servants, and agreed to delay action for two legislative days to allow further conversations with the administration, the attorney general's office and other stakeholders.

The amendment, explained to the committee by Rick Segal, legislative counsel, would keep a private right of action for covered persons but add a limited safe harbor for data brokers that cure after being served in a civil suit. Segal told the committee that relying solely on injunctive relief would likely leave covered people without effective remedies because injunctions can be costly to pursue, difficult to win and unattractive for private counsel. "For an injunction, the standard is you must be harmed in a way that money can't help you," Segal said, adding that the cost of filing an injunction (about $700) and the difficulty of proving irreparable harm make injunctions a weak sole remedy.

The amendment would require a data broker that receives a notice from a covered person to stop disclosing protected information within 15 days. If the broker continues to disclose after that notice period, the covered person could bring a civil action in Superior Court seeking damages, injunctive relief, reasonable attorney's fees and court costs. The amendment creates a narrow safe harbor: if a data broker ceases disclosure within 15 days after being served with process in a civil suit, the broker would be liable only for reasonable attorney's fees and court costs and not for additional damages.

Committee members questioned whether replacing liquidated damages with a damages-based model would make it harder for victims to obtain lawyers and to vindicate their rights. One member noted that proving damages for information being online can be difficult and often fact-dependent: absent an overt harm such as harassment or physical harm, monetary damages can be nominal or zero. Members also raised the practical difficulty that a person may need to send notices to and, in some cases, sue many different entities to remove the same information from multiple sites.

The committee discussed alternative enforcement models, including a fines-based enforcement by the attorney general's office with escalating daily penalties, but members said that would require input from the attorney general about capacity and how fines would be collected. Segal said the committee commonly uses statutes that authorize both individual private rights and parallel authority for the attorney general; he recommended consulting the attorney general's office before choosing a final enforcement mechanism.

The draft amendment also clarifies the definition of "covered person." It restructures the list to apply "currently or formerly" to most listed positions (judges, law-enforcement officers and others) while treating "immediate family" separately so that current-or-former language does not apply to family members. Members asked whether investigators who work for public defenders are covered; Segal said those roles are addressed elsewhere in the bill and that contractors are covered when the text specifically includes employees and contract workers.

The committee debated exceptions for "legitimate business transactions." Members proposed narrowing such an exception to explicitly allow fraud-prevention or verification processes tied to a transaction or to standing contractual authorization (for example, a bank's fraud checks that a customer agreed to in account terms), rather than a broad "legitimate business transaction" carve-out. One committee member said replacing "express authorization" with a standard such as "standing authorization" in account agreements might address legitimate verification needs without a broad exemption.

The amendment includes several provisions meant to limit gaming and delay: a broker that, after receiving notice, discloses additional protected information would lose safe-harbor eligibility; redisclosure after receiving notice would likewise disqualify the broker. The amendment retains ordinary negligence as the liability standard and preserves limitations and other baseline provisions in the underlying bill.

Separately, the amendment moves a temporary administrative requirement into session law. It directs the Secretary of State to provide a notice form (the committee set a deadline of 90 days after July 1, 2025, for the office to issue the form) but allows covered persons to use their own forms until the official one is published.

The amendment also creates a new study provision requiring the Agency of Administration, in consultation with the Agency of Digital Services and the Secretary of State, to evaluate how public agencies would be affected if required to comply with the bill's disclosure rules. The study — which the amendment says should include testimony from stakeholders including the Vermont League of Cities and Towns and the Vermont Municipal Clerks and Treasurers Association — must assess current agency capacity to accommodate requests, staffing and training needs, how other states have implemented similar rules, and the feasibility of a centralized state office to manage requests. The agencies would deliver recommendations and a suggested implementation timeline in a report due Dec. 1, 2025.

After discussion, the committee chair said the panel would pause action on the amendment for two legislative days to allow additional consultations with the attorney general's office, the Secretary of State, Agency of Administration and other stakeholders. The chair also said the committee would seek to hear from Judge Beaumont and representatives of the attorney general's office in a later session.

Votes and formal final actions on H.342 were not taken at the March 25 meeting; the amendment discussion will continue after the scheduled consultations.