Senate committee hears competing approaches to Vermont consumer data privacy law

The Vermont Senate Committee on Institutions on March 13 heard testimony on two competing consumer data privacy bills — S71 and S93 — with business groups, health-care representatives and recreation industry leaders urging different approaches to exemptions, enforcement and definitions.

Supporters of the stricter S71 said the bill would create an essential framework to protect Vermont consumers and requested robust implementation support for small businesses. Health-care organizations and some industry groups urged the committee to adopt S93 instead, citing existing federal rules such as HIPAA, the administrative burden of S71’s thresholds and the risk that a private right of action would produce costly litigation.

Miyako Zeki, who identified herself as organizer of Vermont Womenpreneurs and owner of Radiant Studios, told the committee S71 “creates a necessary framework that protects consumer privacy while allowing Vermont businesses to operate effectively in today’s digital environment.” She said most Vermont firms would be exempt under S71’s thresholds — the bill applies only to businesses that process data on more than 25,000 consumers or that derive substantial revenue from selling consumer data, and it shields businesses with annual revenue under $25,000,000 from private lawsuits — and asked the Legislature to fund extended education, sector-specific guidance and compliance templates for small businesses.

“Proactive, clear communication about exemptions significantly reduced confusion and anxiety among business owners,” Zeki said, urging the attorney general’s office to publish plain-language guidance, provide a dedicated small-business liaison and use a phase-in enforcement approach prioritizing education.

Jessa Barnard, executive director of the Vermont Medical Society, representing a coalition of health-care organizations, urged an alternative approach. Barnard said health-care providers already operate under federal and state rules including HIPAA and 42 CFR Part 2 and that many health-care entities would hit S71’s record-retention and consumer-count thresholds because providers must keep longitudinal patient records for years. She warned that S71’s language could require providers to run a parallel compliance analysis against HIPAA, creating confusion and cost.

“Once information is part of a HIPAA-covered entity’s record — including social determinants of health such as transportation or food security — it is protected under HIPAA,” Barnard said, arguing that overlapping or uncertain state standards could produce litigation and compliance burdens. Barnard and the coalition support S93’s approach, which she said exempts HIPAA-covered entities and relies on enforcement by the attorney general rather than a private right of action.

Molly Lahar, president of the trade group Ski Vermont (testifying as Vermont Ski Areas Association), also urged adoption of S93. Lahar told senators she and her members back consumer protections but raised three specific concerns with S71: restrictions on first-party advertising when businesses use third-party CRM vendors, vague data-minimization language that could prohibit normal targeted marketing, and a private right of action that could invite class-action litigation. She said targeted advertising is useful to many consumers and that unclear terms such as “reasonably necessary and proportionate” could be litigated.

Committee chair and members asked clarifying questions about how exemptions would work, whether HIPAA is broadly understood among consumers and businesses, and which organizations can help with outreach. Witnesses pointed to prior outreach around the federal Beneficial Ownership Information (BOI) reporting requirements administered by FinCEN and recommended Vermont Law School and state business-resource organizations as partners for education.

No formal votes were taken at the March 13 hearing. Committee leadership said they plan to continue combining discussion of S71 and S93 in subsequent meetings.

The testimony shows the core choices before the Legislature: adopt S71’s broader private-right enforcement and narrower business exemptions, or follow S93’s model that exempts HIPAA-covered entities, omits a private right of action and places enforcement authority with the attorney general while relying on tested definitions used in other states. Lawmakers signaled interest in more information and implementation planning before moving to a final recommendation.