Senate Institutions hears split testimony on S.71 privacy bill over private suits, definitions and business burden

Montpelier — The Senate Institutions Committee on Tuesday, March 11, heard more than two hours of testimony on S.71, legislation that would set statewide rules for consumer data privacy, online surveillance and targeted advertising.

The attorney general’s office, privacy advocates and digital-ad watchdogs testified in favor of strong data-minimization rules and consumer remedies; business groups and the Vermont Chamber of Commerce urged a different approach — a regionally aligned bill (S.93), narrower definitions, and limiting private lawsuits to avoid what they said would be costly litigation and compliance burdens for small businesses.

The attorney general’s office told the committee the intersection of data privacy and consumer protection motivates its involvement. The office noted the state’s long-running Consumer Assistance Program (CAP) at the University of Vermont and the frequency of breach notifications: “At least every day, there is a data breach,” the attorney general’s representative said, adding that the office receives “600, 800 notifications a year, depending on the year.” The representative urged codifying data-minimization practices to limit unnecessary collection and described a role for private remedies tied to actual damages, not statutory penalties.

Katrina Fitzgerald, deputy director of the Electronic Privacy Information Center (EPIC), told senators S.71 builds on other states’ laws and adds a “data minimization” rule tying data collection to the product or service a consumer requests. “It says…entities can only collect and use personal data that’s reasonably necessary for the product or service I’m asking for as a consumer,” Fitzgerald said, and argued the change would curb pervasive cross-site tracking and the most intrusive forms of behavioral advertising.

Ariel Garcia, chief operating officer at Check My Ads Institute, described the ad-technology supply chain and told the committee programmatic advertising extracts large sums while returning a small share to publishers. “Out of every dollar spent on programmatic advertising, only 36¢ makes it to the publisher,” Garcia said, and argued that low-quality brokered data both invades privacy and performs poorly for advertisers.

Small-business testimony came in two strains. Melanie Ensign, founder and CEO of Discernible Inc., said many small firms lack in-house IT or legal teams and face a market that offers few privacy-respecting vendor options. Ensign praised the bill’s phased implementation and data-minimization provisions as helpful but urged policymakers to consider regulating by data sensitivity and to include technical and financial support for small entities.

By contrast, Megan Feldman, vice president of government affairs for the Vermont Chamber of Commerce, and Joshua Diamond, special counsel for business groups, said they support comprehensive privacy law but prefer S.93, a regionally compatible model that would omit a private right of action and give the attorney general primary enforcement responsibility. Diamond warned S.71’s definitions and new terms could create uncertainty and compliance costs for small and mid-sized businesses, and he highlighted provisions he said allowed liquidated and punitive damages in private suits similar to Illinois’ law.

Chamber witnesses pressed concerns about several S.71 provisions that differ from other states’ statutes: the bill’s lower numeric threshold for applicability (6,250 consumers under S.71 versus 100,000 in the regional model cited by witnesses), broad definitions of “sensitive data,” and new phrasing for “minimization” that they said could be ambiguous in practice.

Committee members asked about the proposal’s cure period and private right of action. The attorney general’s witness said the bill’s 60-day cure period (a chance for a controller to fix a violation before the attorney general brings an enforcement action) raised worries in extreme cases, but the office nonetheless supports the bill overall and advocated for the availability of private suits for actual damages. Business witnesses argued that private suits — and the liquidated damages language they read into draft text — would invite nuisance litigation and shift enforcement from state authorities to plaintiffs’ firms.

No committee vote or formal action appears in the transcript. Senators and witnesses frequently cited other laws and models in the record — the state’s Data Security Notification Act, Connecticut’s data-privacy law, and Illinois’ Biometric Information Privacy Act — as points of comparison.

The hearing combined technical discussion of definitions and enforcement mechanics with broader policy questions: how to balance consumer remedies, how to reduce tracking that fuels targeted advertising, and how to limit costs and uncertainty for Vermont businesses and nonprofits. Committee members asked witnesses for written materials and examples they could use to refine language and identify implementation timelines.

The committee took testimony; the record does not show a vote or amendment on S.71 during the hearing.