Vermont committee debates cure period, private lawsuits in proposed genetic‑data privacy bill

The Vermont House Committee on Commerce & Economic Development spent most of its Feb. 11 meeting debating H.639, a bill that would extend consumer protections to genetic data and create mechanisms for enforcement under the Vermont Consumer Protection Act.

Legislative counsel presented draft 2.1 and flagged a new enforcement subsection that would allow a limited cure period before a consumer could pursue a civil action for certain alleged violations. The draft would permit a consumer who believes a company failed to provide required privacy terms, violated a narrowly defined marketing rule, or engaged in certain discrimination to send a written notice and give the company 15 days to remedy the issue before suing. Counsel emphasized that other provisions — notably revocation of consent, data security obligations and contracts between consumer‑facing companies and service providers — would not be subject to the cure period.

The proposal prompted detailed drafting and policy questions from committee members. Several legislators asked whether the bill’s language should refer to an "alleged violation" or simply a "violation," and whether consumers could realistically prove that a privacy banner or disclosure did not appear. Committee members also worried about the volume of demand or "dunning" letters that can accompany private rights of action under consumer‑protection statutes.

Richie Englehart, head of government affairs at Ancestry, told the committee that Ancestry requires a valid judicial warrant or court order before it would consider disclosing genetic data to law enforcement and that the company had never disclosed genetic data to law enforcement in 14 years of offering direct‑to‑consumer testing. Englehart said three firms — Ancestry, 23andMe and MyHeritage — account for more than 90% of direct‑to‑consumer tests, but warned that many small startups and data brokers operate in the space. He urged the committee to extend the proposed cure period to 30 days, saying shorter windows could be impractical for smaller companies and that technical glitches can be fixed before any privacy harm occurs.

Todd Dalos, assistant attorney general, said a cure period of this type would be novel under Vermont’s Consumer Protection Act and could have implications beyond narrow technical fixes. Dalos explained how private suits under the statute require a showing of reliance and damages, and described how the Attorney General’s office often operates informally in a cure/compliance mode when investigating compliance‑oriented violations.

Members pressed for more concrete examples of harms unique to genetic data, such as employer discrimination tied to predictive markers, and asked how the bill’s restrictions would interact with law‑enforcement requests. Counsel and witnesses said the bill would require judicial process for disclosures and that some harms are future‑looking but could materially affect employment or marketplace outcomes.

The committee did not take a vote. The chair asked legislative counsel to revise the draft to address wording and consistency concerns and scheduled further consideration for the next committee meeting.