Vermont committee advances amended H.211 that tightens data‑broker rules, converts universal deletion to study

The Vermont House Committee on Commerce & Economic Development on Jan. 28 examined draft 2.2 of H.211, a bill that revises the state’s data‑broker registry, tightens registration timing and adds new verification, bonding and deletion provisions for entities that buy and sell personal information.

The committee’s legislative counsel reviewed key changes: data brokers would be required to maintain procedures ensuring brokered personal information is disclosed only for a legitimate, legal purpose; brokers must verify prospective users and certified purposes before furnishing data; and registration would be required within 30 days of meeting the broker definition and then annually by July 1. The draft adds a proposed $20,000 bond requirement and shows a registration fee at a higher statutory level than current law.

Why it matters: supporters and privacy groups say modern data brokers collect and resell highly granular dossiers — including location traces and sensitive inferences — that can harm consumers, enable scams and raise safety risks. Supporters urged a centralized deletion option to give Vermonters a realistic way to opt out of widespread commercial profiling.

Consumer Reports policy analyst Matt Schwartz testified in support, saying, “Data brokers are increasingly weaponizing people’s personal data against them in ways that are impossible to anticipate and leave consumers very little recourse.” He praised the bill’s updated definitions and the deletion right and said the earlier draft’s centralized deletion platform (modeled on California) is the most effective option for consumers.

Industry testimony urged caution on scope and implementation. An industry witness identified as Steve, with decades in data products, said some types of data “don’t need to be monetized” (citing precise geolocation and children’s data) and recommended a broad statutory definition of broker to avoid circumvention. He also advised that deletion is practically a removal from production rather than a literal permanent erasure.

Privacy advocates pressed the committee to restore a universal accessible deletion mechanism rather than the broker‑by‑broker process now in the draft. John Davison of the Electronic Privacy Information Center said downgrading the deletion platform to a study was a missed opportunity and cited California’s analogous platform enrollment as evidence of consumer demand.

Key provisions and implementation details in the amendment - Verification and legitimate‑use requirement: Data brokers must verify and document prospective users and certify that disclosed brokered personal information will be used only for legitimate, legal purposes. - Registration timing and content: Brokers must register within 30 days of qualifying as a broker and then annually on or before July 1; registration would include an uploaded electronic copy of any bond certificate and the broker’s privacy policy, and a link to the broker’s consumer deletion/opt‑out page. - Financial safeguards and penalties: The draft proposes a $20,000 bond (modeled on charitable solicitation law) and shows increased statutory fee language; penalties in the draft include $200 per day for failing to register and $1,000 per day for failing to update required information after notice. The draft also references a high penalty for materially incorrect information as in earlier language. - Right to delete with narrow exceptions: Consumers would have the right to request deletion of their brokered personal information, but brokers may deny requests when retention is required by law or to comply with legal or regulatory processes, or when the data is used by consumer reporting agencies. - Central deletion mechanism converted to study: The draft removes the automated statewide deletion mechanism and directs the Secretary of State to study feasibility, funding (including a possible registry fund), and technical approaches, and to report by Dec. 1, 2027. In the interim the Secretary of State would host a downloadable registry and links/best‑practice guidance to each broker’s opt‑out page.

Committee members pressed witnesses on exemptions for banks, insurers and fraud prevention, the practicalities of an interim broker‑by‑broker opt‑out, and whether deletion could degrade data relied upon by regulated industry. Witnesses supported narrowly defined exemptions (for narrowly defined fraud prevention and statutorily covered activities like FCRA/GLBA uses) rather than broad entity‑level carveouts.

What happens next: the committee paused for a brief recess and indicated it will continue deliberations on the amendment language and potential edits. No formal motion or vote on H.211 occurred during this hearing.

Reporting note: the amendment reviewed by the committee sets an effective date of July 1, 2026, and a Secretary of State report deadline of Dec. 1, 2027, for the feasibility study on a centralized deletion mechanism.