Committee reviews S.71/S.93 data privacy bill: consumer rights, controller duties and AG enforcement outlined

Legislative counsel and committee members reviewed S.71 (with S.93 language) in a detailed briefing that covered definitions, applicability thresholds, exemptions, consumers’ rights, duties for controllers and processors, data protection assessments and the Attorney General’s enforcement role.

"Consent means a clear affirmative act signifying the consumer's freely given, specific, informed, and unambiguous agreement to allow the processing of personal data," the legislative counsel said while reviewing the bill’s definitions and consent standard.

What the bill would do - Definitions and sensitive categories: Counsel walked through key definitions — biometric data, consumer health data, sensitive personal data (race, religion, health, sexual orientation, precise geolocation), de‑identified data and publicly available information — that shape the bill’s scope. - Applicability thresholds: The bill would generally apply to controllers that during the preceding calendar year processed the personal data of 100,000 Vermont residents or processed the data of at least 25,000 residents and derived more than 25% of gross revenue from selling personal data. The consumer‑health data controller category was described as having a…