Vermont House amends and passes bill to curb online exposure of certain public servants' personal information

The Vermont House on March 31 amended and passed H.342, an act relating to protecting the personal information of certain public servants, after debating changes to enforcement mechanisms and a private right of action.

The committee amendment adopted by the House gives the state Attorney General explicit enforcement authority, including a civil penalty of up to $10,000 per violation, creates a 15‑day safe harbor for data brokers after service of notice, and directs the Agency of Digital Services to study public‑agency disclosure practices and report back by Dec. 1, 2026. The amendment was approved by roll call, 106–38; the bill was later passed on the floor by voice vote.

Supporters said the amended bill balances protection for covered public servants with practical enforcement tools. Representative Marcotte, speaking for the House Committee on Commerce and Economic Development, described several substantive changes in the committee amendment: removal of an explicit assignment right for covered persons, clarified notice requirements to ensure data brokers know what to redact, the addition of Attorney General rulemaking and civil penalty authority, and a requirement that the Attorney General post a web form to receive notices from covered persons or their authorized agents.

"We created a safe harbor, and we also have made sure that this doesn't— that their ability to sue doesn't go into effect until January. However, the penalties and the Attorney General's office would take effect in July," Marcotte said, explaining the committee's approach to phased implementation.

Opponents raised procedural and policy objections, particularly to the retained private right of action. The member from Castleton, who introduced an earlier amendment and then spoke against the committee change, called the reinstated private right of action "a litigation pipeline" and said legislative counsel testified some damages language was written to attract private attorneys. "Is this bill really about protecting covered individuals or enriching bad actors?" the member from Castleton asked.

Other members who spoke described significant implementation concerns raised during testimony. The member from Castleton said the Agency of Digital Services and the Agency of Administration had objected in committee testimony and that the committee did not hear from data brokers themselves during recent hearings.

The committee also added a study provision asking the Agency of Digital Services, in consultation with the Agency of Administration, Secretary of State, Attorney General and others, to determine the impacts of requiring public agencies to limit display of covered information—specifically fiscal and staffing impacts, statutes or policies that would need amendment, and recommendations for legislative action.

Committee support was reported as a straw vote of 11; the committee urged the full House to adopt the amendment. After the amendment passed on a roll call (106–38), the House ordered third reading and later passed H.342 by voice vote.

The bill as amended: gives the Attorney General authority to assess civil penalties up to $10,000 per violation, allows the Attorney General to adopt implementing rules, requires a 15‑day period after proper service for data brokers to redact specified protected information to qualify for a limited safe harbor (attorneys' fees and costs only), and preserves a private right of action that opponents said could invite litigation.

The bill also creates a study and report on public agency compliance with the disclosure limitations, to be delivered to the House Committee on Government Operations and Military Affairs and the Senate counterpart by Dec. 1, 2026.

The House action concluded with passage of H.342. Implementation details—such as the Attorney General's forthcoming rules and the content and timing of the notice form—remain to be determined and may affect how broadly the protections operate in practice.