Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the H211 Data Brokers topic
No spam. Unsubscribe anytime.
Committee reviews H.211 to require data-broker registration, deletion rights and breach notices
Summary
The panel reviewed H.211, which would require data brokers to register within 30 days, disclose the categories of brokered personal information they collect, give consumers a deletion mechanism with a 30-day deadline, raise registration fees and penalties, and obligate brokers to notify the AG and consumers of breaches; the bill also commissions a two-year study with a requested $50,000 appropriation.
The Committee on Economic Development, Housing & General Affairs examined H.211 on Thursday, a bill that would create a new Vermont data-broker regulatory framework requiring prompt registration, expanded disclosures, deletion rights and tailored breach-notification obligations.
The bill would add a new data-broker security-breach notice section and strengthen an existing security-breach notice act to require data brokers to notify the Attorney General within 14 days and affected consumers within 45 days when unencrypted brokered personal information is compromised. It would also require data brokers to verify prospective users’ identities and stated purposes before disclosing brokered personal information and to withhold disclosures when there are reasonable grounds to believe misuse is likely.
Legislative counsel told members the draft creates several consumer-facing mechanisms. Data brokers would have to register within 30 days of operating in Vermont and then annually by July 1; the draft raises the registration fee from $100 to $900 and requires a $20,000 bond to run to the state. Registrations must list whether the broker collects categories such as precise geolocation, reproductive-health data, biometric data, immigration status, sexual orientation, names, dates of birth, contact details and other commonly used identifiers, and must publish the URL where consumers can request deletion.
Under the bill, brokers must host a conspicuous deletion page and delete a consumer’s brokered personal information within 30 days of a valid request, notify the consumer within five days of deletion, and provide an appeal process: consumers would have 45 days to initiate an appeal and brokers must decide appeals within 45 days. The bill enumerates exceptions to deletion (for example, where retention is required by law, to comply with subpoenas or for certain consumer-reporting uses) and imposes segregation and retention restrictions on broker-held data that is subject to deletion.
The draft tightens telephone-notice requirements for breaches by requiring a minimum of five live-attempts to directly contact consumers before leaving voicemail and clarifies that HIPAA-covered entities may rely on federal notification timing only if they certify HIPAA compliance to the AG or DFR. The bill also proposes changing DFR enforcement language to cover entities "regulated by DFR," closing an enforcement gap for some out-of-state firms.
Committee members and staff discussed enforcement and penalties: the draft replaces the previous $50-per-day registration penalty with an administrative fine of $200 per day for failing to register, plus fees due and investigative costs, and allows civil penalties up to $25,000 for materially incorrect registrations. Counsel said those higher penalties are the reason for the proposed $20,000 bond requirement.
The draft also requires the Secretary of State to create and maintain a public consumer-rights webpage with a downloadable spreadsheet of registered data brokers and the URLs consumers should use to request deletion or opt out. The bill directs the Secretary of State to study whether the state should implement a centralized deletion mechanism; the draft sets an interim report due Dec. 1, 2027, a final report due Dec. 1, 2028, and requests a $50,000 appropriation for a consultant to support the study. Parts of the bill would take effect Jan. 1, 2027 to allow system updates.
Kevin McGreal, who identified himself as working for the Vermont Legislative Council service and as an intern, told the committee, "our personal data is really important and we should have control over that as consumers," and raised location tracking as a primary concern.
Committee staff said roughly 290 brokers are currently registered in Vermont but estimated hundreds more may be operating without registration, highlighting the administrative burden on consumers who would otherwise have to contact many separate firms to exercise deletion rights. Members said an easier, centralized deletion mechanism could help consumers across dozens or hundreds of brokers.
The committee did not take a final vote on H.211 during the session. Members agreed to continue the discussion next week; staff said House Appropriations had room in its budget for the requested $50,000 appropriation for the study.
