Vermont committee debates enforcement options for H.342 privacy bill

Members of the Vermont Economic Development committee continued a multi-hour discussion on H.342 on March 25, focused on how the bill would be enforced if it becomes law.

The committee heard from Chief Superior Judge Tom Zona, who described how the bill’s current enforcement language — draft 1.3 — would rely on traditional civil remedies and the courts. "The current enforcement mechanism that draft 1.3... provides for damages as well as injunctive relief," Zona said, noting injunctive relief could trigger temporary restraining orders and multiple hearings. "A temporary restraining order is issued before there's a notice and opportunity for the party...to be able to respond," he said, describing Rule 65 standards and the need to show "immediate and irreparable injury" for emergency relief.

The judge told the committee he could not predict how many suits the statute would generate, but cautioned that private litigation could strain judicial resources if claims proliferated. Zona pointed to New Jersey’s version of similar legislation — referenced in testimony as "Daniel’s law" — which includes a $1,000 damages provision, and said that difference in remedies affects how readily lawyers and plaintiffs might pursue cases.

David Hall, director of the Business Services Division in the Office of the Secretary of State, told the committee his office could publish a standard notice form for covered persons seeking removal of their information and could email registered data brokers if the law passed. "We have about 300, in this latest round of registrations," Hall said when asked how many data brokers are registered with the state. He cautioned that the office’s registration snapshot is retrospective and that a published form could be misunderstood as state verification of a requester’s identity.

Josh Hanford, director of intergovernmental relations at the Vermont League of Cities and Towns, urged a study of how the bill would affect public records obligations and local governments’ operations. "There isn't current sort of exemptions for that. It may conflict with some other Title 24 requirements," Hanford said, adding that municipalities collect and sometimes publish home addresses, email addresses and phone numbers that could be affected.

Committee members raised multiple enforcement options. Some members said injunctive relief tied to irreparable-harm standards could be difficult for plaintiffs to prove. Others proposed a fines-based enforcement approach, an escalating penalty schedule, or a hybrid model in which the attorney general can enforce the law while individuals retain a private right of action. Participants suggested options such as a safe-harbor compliance path for businesses that promptly remove data, liquidated damages or tiered fines that scale with culpability or company size, and directing fines to a victims fund or the general fund.

Several lawmakers urged additional testimony and technical work. The panel agreed to hear further briefings the next day from the Agency of Administration, Department of Disabilities, Aging and Independent Living or the equivalent (referred to in discussion as "dental services"), and the attorney general’s office, and to refine statutory language on remedies, safe harbor and notice procedures. The committee also discussed adding a study of public-agency compliance and how municipal records practices would interact with the bill.

Committee members emphasized competing policy goals: protecting covered individuals from harms caused by widely available personal data, while keeping remedies practical and not creating excessive litigation or administrative burdens. As one member put it, lawmakers want "both a really clear safe harbor and a really clear method of enforcement that will work in Vermont."