Senate committee hears divided views on H.211 data-broker bill; staff propose compromise amendment

The Senate Economic Development, Housing & General Affairs committee heard testimony on H.211, a data-broker bill that would expand registration requirements, raise penalties for noncompliance, provide consumers a deletion (opt‑out) pathway, and fund a study to evaluate how Vermont might implement a centralized deletion mechanism.

David Hall of the Secretary of State's office told the committee the bill touches two primary functions for his office: strengthening the data-broker registration process (the office currently shows roughly 300 registered data brokers) and conducting a study to evaluate whether Vermont can build or should leverage an external deletion/"drop" system like California's. Hall said his office can collect and publish registry data but is not a policing body and lacks the capacity to validate every registrant. He cautioned that building a deletion system can be costly and operationally complex: "California... cost them over $4 million to build the drop system," Hall said, and Vermont would have to decide whether to piggyback, outsource, or build an in‑state system.

Privacy expert Richard Varn warned the committee that H.211's current definitions risk treating "publicly available information" as deletable brokered personal information, which could hollow out public records and raise First Amendment concerns. Varn illustrated the risk by noting that information made available for sale or used to make inferences from public sources might be removed under the bill’s deletion provisions, creating holes in datasets used for accountability and research. "Publicly available information that's made available for sale doesn't become private because it's made for sale," he said.

Legislative counsel presented a committee amendment (draft 1.2) to the deletion-exemptions section C3B that moves several entity-level exemptions to data-level exemptions, references federal regimes (e.g., Title V/VI/FCRA as drawn in the draft), clarifies exemptions for government contracts and direct business‑consumer relationships, and creates a narrowly framed nonprofit education data exemption. Industry witnesses (S&P Global and the Consumer Data Industry Association) asked for explicit alignment to federal exemptions such as the Drivers Privacy Protection Act (18 U.S.C. §2721–2725) and for consistent treatment with S.71; consumer advocates supported the bill with caveats about added exemptions. The attorney general’s office said existing enforcement tools (breach notification and registration enforcement) provide a basis for action but recognized the challenge of reaching extraterritorial actors and the benefit of multi‑state coordination.

Committee members expressed concern that passing a deletion regime before a comprehensive privacy law (S.71) could create a patchwork of conflicting exemptions and compliance obligations across statutes and states. The chair said the amendment reflects compromise language but noted the bill is not yet ready for final action; the committee did not vote and will continue work to reconcile H.211 with other privacy bills and stakeholder concerns.

Next steps: committee staff will circulate amendment draft 1.2 and solicit further input from the Attorney General's Office, Secretary of State’s Office, ADS (digital services), and stakeholders; the committee signaled it would not finalize H.211 today.