Judiciary panel questions timeframe, scope and penalties in bill to limit online personal identifying information

Members of the Vermont Senate Judiciary Committee reviewed a draft privacy bill that would make it harder to obtain personal identifying information from the internet, focusing discussion on who would be covered, how quickly data must be removed and how civil penalties or criminal enforcement would operate.

Committee members said the draft needs clearer definitions about whether the law would reach internal, nonpublic databases as well as publicly searchable lists and whether contractors or third-party vendors should be included among covered actors. The committee discussed adding victim advocates, state’s attorney staff, court staff, mental health crisis workers embedded with state police and the attorney general’s office to the list of protected people.

Members said the bill’s 10-business-day removal timeframe raises practical and litigation concerns. Committee members noted data-broker operations and large datasets could make removal within 10 business days impracticable, especially when a covered person’s household members are included. Members pressed staff to consider alternative drafting that ties timeframes to the size or type of dataset or to a per-dataset, rather than per-line, standard.

The committee also debated how monetary penalties would work. The draft’s $1,000-per-item approach drew criticism for potentially producing very large, perpetual liabilities if disclosures persist or if datasets are large; members discussed whether violations should be measured as a single failure to remove data or as repeated disclosures. The committee questioned language that would remove a defendant’s ability to assert a defense when names were otherwise publicly available.

Members discussed punitive damages and attorneys’ fees language. Some members said punitive damages can already be imposed by courts and that explicit statutory punitive damages may be unnecessary; others said keeping punitive remedies could deter willful misconduct by large companies.

The panel considered whether to include criminal penalties. Several members said they had heard testimony arguing criminal enforcement is necessary to deter very large firms that might otherwise treat civil fines as a cost of doing business. Others warned that adding criminal liability would pull the bill back to the Judiciary Committee’s primary criminal jurisdiction and complicate a fast timetable for the bill to reach crossover.

Committee members repeatedly urged clear drafting on technical points raised by witnesses: whether “home telephone number” language should be updated to capture cell phone numbers; what “redisclosure” means when data segments are reassembled or augmented; and whether the statutory text should require deletion rather than merely ceasing to disclose.

Several members asked that the sponsor include a statutory or administrative mechanism to track whether the law is working. Witnesses and members referenced prior privacy bills that included reporting or metrics; the committee asked staff to add language or require a report so lawmakers can review completion rates, complaint volumes and other measures after implementation.

The committee said it will present the concerns to the bill sponsor and to witnesses at a forthcoming hearing before the Commerce Committee; the sponsor is expected to testify before crossover deadlines. No formal vote was recorded during the discussion.