Vermont committee reviews bill to tighten data-broker rules with new breach notices, deletion tool and audits

Unidentified Speaker 2, legislative counsel, told the Vermont House Committee on Commerce & Economic Development on Jan. 8 that the bill would amend Title 9, Chapter 62 (protection of personal information) to expand definitions, strengthen breach reporting and create a single deletion mechanism for consumers. “Vermont, as I said last year, was the first state to regulate data brokers,” Unidentified Speaker 2 said, citing California’s Delete Act as a point of comparison.

The bill would add or clarify definitions — including an expanded biometric-data definition that lists iris and retina scans, fingerprints, facial-mapping, gait and other templates — and add phone numbers to the list of brokered personal information. It also proposes a five‑year lookback to determine when a business has a direct relationship with a consumer and therefore is excluded from the data-broker definition.

A new Data Broker Security Breach Notice Act (identified in the bill as a separate section) would require a data broker, after discovery or notification of a breach affecting a Vermont consumer, to notify the consumer "in the most expedient time possible and without delay, but not later than 45 days," subject to limited law‑enforcement delay. The same section…