Lexus Nexus official urges H.211 to preserve fraud-prevention exemptions, warns of business and public-safety impacts

Rick Gardner, global data protection officer for Lexus Nexus Resolutions Companies, told the Vermont House Committee on Commerce & Economic Development on March 19 that the committee's draft of H.211 should preserve exemptions used for fraud prevention and identity verification.

"My name is Rick Gardner, global data protection officer for Lexus Nexus Resolutions Companies," Gardner said in his opening remarks and described the company as "a duly registered data broker" in Vermont and other states. He said Lexus Nexus serves banks, insurers and government agencies and has participated in developing state privacy statutes.

Gardner outlined how the company organizes data and limits access: regulated datasets (he cited FCRA/GLBA-style data) are segmented, credentialed and stored separately; customers must pass vetting and agree by contract to permitted uses; and Lexus Nexus audits customer use to ensure compliance. "We require any customer who's going to access that data is going to go through a review process," he said.

Committee members pressed Gardner about whether H.211's proposed restrictions on combining publicly available data with regulated datasets would hinder legitimate fraud-prevention uses. Gardner said many state privacy laws include narrowly drawn exceptions for fraud prevention and for data covered by federal sectoral law, and he urged that Vermont's approach be consistent with those models to avoid operational conflicts. He referenced the California Delete Act timeline as an example of phased implementation and cross-jurisdictional complexity.

Members repeatedly raised concerns about the scope of an exemption that would cover brokers who provide data to financial institutions. Several legislators warned that an entity-level exemption for any broker supplying GLBA-type information could remove deletion, correction and access rights for consumers in ways that would create loopholes for non-reputable sources.

Gardner acknowledged the risk but said Lexus Nexus practices active vetting and will not buy data sources that raise red flags. "We vet all of our data sources," he said. "If we've come across a source that does not meet our checks, we won't utilize that source." He offered to work with the committee on drafting language to protect legitimate fraud-prevention functions while minimizing openings for bad actors.

The committee also explored technical distinctions in the bill between processors and controllers. Gardner said Lexus Nexus sometimes processes customer-provided data on behalf of a financial institution, which would fit a processor exemption, but the company also maintains proprietary datasets it acquired and licenses to multiple customers. He argued that those proprietary assets fall outside a narrow processor carve-out and may require explicit treatment in statutory language.

Legislators raised scenarios where deletion requests might cascade and create operational problems for banks and insurers that rely on associational or relationship data for identity verification (for example, locating a designated account contact whose name has changed). Gardner said the company seeks to keep records current and acknowledged such trade-offs between consumer rights and transactional integrity.

The exchange highlighted two drafting priorities for members: (1) distinguish reputable, credentialed brokers and narrowly tailor exemptions for fraud prevention and other legally mandated uses; and (2) define processor/processor-like functions and permissible uses precisely so that protections are not inadvertently extended to actors the committee does not intend to shield.

Gardner said Lexus Nexus is open to reviewing proposed amendment language and to providing technical follow-up materials. The committee ended by scheduling further work on H.211 and other privacy items.

The committee did not take a vote on H.211 at the March 19 session; members asked staff and stakeholders for additional drafting options and follow-up materials.