Vermont committee reviews H.639 genetic data privacy bill, debates consent, warrants and cure period

The Brown House Committee on Commerce & Economic Development on Thursday reviewed draft 1.1 of H.639, the genetic data privacy bill, and debated key definitions, consumer consent rules and enforcement mechanics. Rick Siegel of the Office of Legislative Council walked the committee through the posted amendment and highlighted points for further drafting.

The amendment tightens definitions and consent rules that would apply to direct‑to‑consumer genetic testing companies. Among the changes Siegel highlighted were an expanded definition of service provider (covering entities that collect, transport or analyze biological samples), a new explicit definition of biometric data (technical biometric identifiers such as fingerprints, iris scans and voiceprints), and language that dark patterns do not qualify as express consent. "Draft 1.1 of the committee amendment to 639, an act relating to genetic data privacy," Siegel said, introducing the posted changes and noting the amendment does not depart dramatically from the introduced bill.

Under the draft, companies would have to obtain separate, express consent for specific uses of genetic data — including storage, transfer to third parties and any uses beyond the primary testing service — and provide plain‑language privacy summaries. The amendment would require mechanisms to let consumers revoke consent "at least as easy as" the way it was given and would require companies to honor revocations "as soon as practicable, but not later than 30 days," including destroying biological samples tied to revoked consent within that 30‑day window.

Committee members pressed on limits of that revocation right when data had already been transferred. One member warned that data already passed to a third party may be "the cat's out of the bag," and asked how the bill would address affiliate companies or shell entities that receive transfers. Siegel said the contract section and the definitions of direct‑to‑consumer company and service provider were intended to capture affiliates and services that touch genetic data, but acknowledged the committee could add narrower affiliate or transfer parameters if members wanted.

The amendment would also bar discrimination and retaliation: businesses could not deny goods or services, charge different prices, or otherwise treat consumers differently for exercising rights under the subchapter. Siegel described that provision as preventing companies from punishing consumers who revoke consent or assert their rights, while other members asked whether operational impossibility (for example, inability to provide a particular feature that depends on having genetic data) would be a defense.

On enforcement, Siegel said the bill would rely on the Vermont Consumer Protection Act (cross‑referencing section 24‑53) to give the Attorney General civil authority and leave a private right of action for harmed consumers. The committee also asked whether law‑enforcement access to data by warrant should be carved out of the express‑consent rule. The Assistant Attorney General responding for the Attorney General's office said neither California nor Virginia includes a blanket warrant exclusion in their genetic privacy statutes, urged judicial checks on law‑enforcement access and warned against broad, unqualified access without a court order.

Tom Swise, a Flampillier resident and civil engineer who provided public comment, urged the committee not to create conflicting definitions across chapters. Swise recommended placing genetic data definitions in a consistent location to avoid future statutory divergence and loopholes.

Members devoted substantial time to whether to include a private‑right‑of‑action cure period — a short interval during which a company could correct a violation before a consumer suit may proceed. Views were split: some members and witnesses argued a brief cure window (several members suggested 24–48 hours) could reduce frivolous litigation and encourage businesses and regulators to resolve errors quickly, while others maintained that the irreversibility of genetic disclosure ("once the data is out, the data is out") made any cure period a poor fit for highly sensitive genetic information.

The committee did not resolve the cure‑period or warrant questions and asked staff and counsel to bring additional drafting and examples back for further consideration next week; the chair said the group would reconvene for continued drafting and then go to Room 270 for the legislative council meeting.

What’s next: The committee scheduled follow‑up drafting on the warrant carve‑out and the private‑action cure period and expects to take the revised amendment to legislative council for additional review.