Assistant Attorney General Todd Dayla backs S.71 data-privacy bill, flags enforcement and funding concerns

Assistant Attorney General Todd Dayla told the Vermont House Committee on Commerce & Economic Development on April 28 that the attorney general’s office supports S.71, a bill to strengthen data-privacy protections, while cautioning that enforcement may require additional resources.

"I think it's no surprise to this committee. We are in full support, increasing the data privacy and data protections," Dayla said, opening his testimony and describing the bill as "one of the forefronts of consumer protection law." He urged the committee to pursue consistent definitions and a meaningful data-minimization standard that could align with rules in other states to ease compliance for regulated entities.

Dayla illustrated privacy risks with two examples. He described a case in which a Vermonter seeking a high-interest home-equity loan began receiving competing calls after local lenders or brokers bought consumer data. "One of these entities said, 'oh, you can buy this stuff,'" Dayla said, using the anecdote to show how quickly personal information can circulate. He also pointed to a recent U.S. Supreme Court oral argument about law-enforcement use of geolocation data, saying the case underscores how government access to location information can implicate constitutional and privacy concerns.

On enforcement, Dayla said Vermont has a history of consumer-protection litigation but warned that assigning primary enforcement to the attorney general's office could be a "heavy lift" under current resources. "If it sits with the AGO, I think that's a very heavy lift for the existing resources," he said, adding that the office would likely seek more support if it were given primary responsibility for handling widespread violations.

Committee members questioned how the state might recover investigatory costs. One member cited market-capitalization figures for major tech firms and asked whether the state could bill regulated entities for pre-litigation investigation costs. Dayla said it would be appropriate for the state to consider cost-recovery from regulated industry in some cases but cautioned implementation would require administrative capacity; he also urged care to avoid charging a small Vermont company the same rates the state might charge a large multinational.

Dayla described a likely enforcement pathway: complaints would trigger civil investigative demands, vendors and contractors would be reviewed, and investigations could expand to related service providers if violations were found. He said enforcement would often focus on companies that hold large datasets, not necessarily small local vendors.

On rulemaking and reporting, a committee member asked whether the bill's annual reporting date (then listed as February) should move to the fall to fit legislative cycles. Dayla recommended an earlier (fall) report date and cited the state's recent experience with the Age-Appropriate Design Code, noting the committee had given 18 months for rules and that the office expected several months of active rule development in that example. He advised the committee could return with a more detailed timeline for implementing rules under S.71.

The committee did not take formal votes during this session. Chair members scheduled follow-up testimony and noted the committee would reconvene the next morning to continue consideration of S.71 and to receive an update on the EOI Trust Fund.

The committee adjourned after setting the schedule for further testimony.