House Law Committee debates biometric definition, data-for-sale carve-outs in H.71

The House Law Committee on Commerce & Economic Development on May 20 continued deliberations on H.71, the state data privacy bill, concentrating on how the statute should define biometric data and on whether data "made available for sale" should count as nonpublic.

The issue surfaced soon after the committee reconvened: members considered edits that would change phrasing from words like "allow" or "confirm" to language closer to Connecticut's 2025 text. One committee member read a proposed formulation: "Biometric data means data generated from the technological processing of an individual's unique biological, physical, or physiological characteristics that are used to identify a specific consumer." That language drew support as aligning with another state's recent statutory approach.

Why it matters: the precise wording will determine the law's scope — what kinds of biometric processing (for example, facial recognition, voiceprint matching or other AI-driven techniques) are covered — and how the statute treats technologies that can both identify and authenticate people. Members warned that small word changes ("identify" vs. "confirm" vs. "allow") could broaden or narrow coverage, with implications for fraud protection and other legitimate uses.

Committee debate centered on two linked questions. First, whether to adopt children's-code or other preexisting definitions wholesale: several members said testimony received this morning objected to importing the "kids' code" definitions into the general privacy bill. Second, how to treat information "made available for sale." Members used people-search sites (for example, Spokeo) as a concrete example of commercial services that compile profiles and sell access. One committee member noted that when commercial actors combine publicly available records with private files and then sell or surface inferred attributes, the resulting dataset can enable reidentification even if individual inputs were public.

"Biometric data means data generated from the technological processing of an individual's unique biological, physical, or physiological characteristics that are used to identify a specific consumer," a committee member said while reading the draft language aloud. Another member warned that reidentification is "very easy" when actors use AI to stitch together deidentified and public data, and urged caution before narrowing or loosening protections.

Members discussed three illustrative categories from the draft (publicly available sources, private files offered for sale by third parties, and inferred/aggregated data). Views diverged on whether the phrase "made available for sale" should exclude consumer-posted sales and whether sale by a third party should convert data from public to nonpublic. Several committee members suggested keeping distinct categories for (1) public records and people-search sites, (2) private files sold between data brokers, and (3) inferred data produced by combining sources. Other members proposed consolidating some items but asked for further legal and technical testimony to understand marketplace effects.

No formal motions or votes were taken. The committee agreed it needed more expert input before finalizing definitions and signaled reluctance to make Vermont the first state to adopt new standalone language that departs from neighboring states. The Chair asked members to review the written testimony (including a submission from "Dylan, representing Vermont Technology Alliance") and reconvene the next day to continue work on the section on publicly available information.

The committee paused its review and scheduled continuation of H.71 discussions for the following day; no vote was held on the draft during the May 20 session.