Senate committee hears broad support for S.71 privacy bill; debate centers on private suits and financial-industry exemptions

Montpelier — The Senate Institutions Committee on March 12 heard more than two hours of testimony on S.71, the proposed Vermont Data Privacy and Online Surveillance Act, with witnesses praising the bill’s data-minimization and sensitive-data protections while disputing the scope of a private right of action and urging narrower exemptions for the financial sector.

The hearing drew policy analysts, civil-liberties advocates, state consumer advocates, banking representatives and privacy consultants. Consumer Reports policy analyst Matt Schwartz told the committee, “We strongly support S‑seventy 1,” and highlighted the bill’s provisions to limit unnecessary collection and use of personal data. Cody Venske, senior policy counsel with the American Civil Liberties Union (ACLU) and the ACLU of Vermont, said the measure would “help ensure that the Fourth Amendment retains meaning in the digital age” and urged universal opt‑out, robust data minimization and anti‑discrimination guardrails. VPIRG consumer‑protection advocate Zachary Tominelli also testified in strong support, emphasizing data minimization, a ban on sale of sensitive data and a narrowly circumscribed private enforcement option.

Why it matters: Testimony framed S.71 as affecting everyday Vermonters’ exposure to intrusive profiling, the privacy of health and reproductive‑care information, the safety of minors and the ability of government or private actors to track undocumented people. Witnesses argued the bill would reduce the volume of sensitive personal information available to data brokers and government contractors, and supporters said that would help prevent identity theft, targeted harassment and warrantless government surveillance.

What witnesses said

- Matt Schwartz, policy analyst, Consumer Reports (Washington, D.C.): Schwartz praised S.71’s “data minimization” requirement that companies collect only information necessary to provide a requested service and said the bill’s ban on selling sensitive data (including precise cell‑phone location, political and religious beliefs, and data about minors) would constrain an industry of data brokers that aggregates detailed profiles on individuals. He supported a private right of action as one enforcement tool and said reliance solely on attorney‑general enforcement has produced few public enforcement actions nationwide.

- Cody Venske, senior policy counsel, ACLU / ACLU of Vermont: Venske said S.71 includes universal opt‑out mechanisms, stronger data‑minimization language than some other states’ laws, and algorithmic nondiscrimination measures. He warned that data from apps and data brokers has been used to identify visits to abortion clinics and health facilities and could be used to target or punish people seeking reproductive or gender‑affirming care.

- Zachary Tominelli, consumer protection advocate, VPIRG (Vermont Public Interest Research Group): Tominelli reiterated support for S.71’s meaningful data‑minimization standard, the ban on sales of sensitive data, and a private cause of action limited to certain large data holders and data brokers after Attorney General review to screen frivolous claims.

- Chris Delia, president, Vermont Bankers Association: Delia said Vermont’s banks already operate under federal and state privacy and record‑retention rules, including the Bank Secrecy Act and the Gramm‑Leach‑Bliley Act, and a 2018 Vermont privacy regulation administered by the Department of Financial Regulation. He asked for technical fixes and clearer exemptions for banking activities to avoid conflicts with existing federal and state supervisory requirements and retention schedules (for example, Social Security numbers and certain records retained under federal rules).

- Christina Glabas, owner and founder, Gazelle Consulting: Glabas, who has advised on state privacy work in Oregon, urged the committee to prioritize children’s safety online, citing a recent global incident on a video platform that exposed minors to traumatic content. She also supported a private right of action to provide consumer feedback and accountability when the Attorney General’s office cannot bring every enforcement matter.

- Jim Hall, president and CEO, The Vermont Country Store (written testimony read into the record): Hall’s written testimony expressed concern that S.71’s private right of action and ambiguous language could invite opportunistic out‑of‑state lawsuits and legal costs that would disproportionately harm small, Vermont‑based businesses that depend on digital advertising and online sales.

Key areas of disagreement

- Private right of action: Supporters (Consumer Reports, ACLU, VPIRG, Gazelle Consulting) argued a narrow private right of action complements Attorney General enforcement and increases compliance, especially where the Attorney General’s office has limited resources. Opponents — including testimony from The Vermont Country Store and questions from committee members — warned a private private cause of action could invite meritless suits and out‑of‑state plaintiffs seeking settlements. Several witnesses noted S.71’s drafts include limits intended to minimize frivolous litigation (for example, pre‑conditions such as Attorney General review for certain claims).

- Financial‑industry exemptions and regulatory overlap: The Vermont Bankers Association urged explicit, technically correct exemptions so that banks’ obligations under federal laws (such as Gramm‑Leach‑Bliley Act requirements and customer‑identification rules under the Bank Secrecy Act), existing Vermont financial‑regulation privacy rules and federal record‑retention requirements are not upended or duplicated by the new statute.

Other context offered to the committee

- Existing Vermont laws: Multiple witnesses referred to Vermont’s 2018 data broker registry law and the 2020 Student Online Privacy law (signed March 5, 2020). Witnesses contrasted S.71 with the Connecticut‑style model (referenced in S.93), and with other state approaches such as California, Maryland and Virginia when discussing data‑minimization and enforcement options.

- Law enforcement and national actors: Testimony included examples of federal and private buyers of commercial data (references to data brokers, Palantir’s contracts with immigration enforcement, and purchases by agencies described by witnesses), and warned that private sector holdings can be repurposed to track movement and sensitive behavior without judicial process.

Committee process and next steps

Committee members asked witnesses for written testimony and supporting reports and discussed retrieving S.93 for joint consideration. Witnesses promised to supply written materials and technical corrections; banking representatives said they would send proposed wording fixes and correct statutory citations (for example, a cited federal provision identified in testimony as 12 U.S.C. 1843(k)). The committee did not vote on S.71 at the hearing.

What was not decided

The committee did not adopt bill language, make formal amendments, or take a vote. No formal enforcement choice was made on the record; details such as dollar remedies, private‑suit thresholds, or an exact list of entity exemptions remain subject to amendment and legislative drafting.

Ending

Witnesses and committee members agreed to submit written testimony and suggested edits; the committee indicated it will continue working on S.71 alongside S.93. The hearing closed with plans to reconvene with additional materials and proposed technical changes.