Industry witnesses tell Commerce & Economic Development committee S.71 risks overbroad compliance and constitutional questions

The Commerce & Economic Development committee on May 20 took testimony on S.71, a proposed Vermont consumer data privacy statute, hearing from financial-industry, business and technology trade groups that urged narrowing several definitions and adding implementation safeguards.

Andrew Guggenheim, managing director and associate general counsel for the Securities Industry and Financial Markets Association (CFMA), told the committee the draft’s financial-sector exemption should be narrowly tailored to entities already regulated and examined for consumer data protections. He cited the Gramm–Leach–Bliley Act and SEC Regulation S‑P, and said securities firms in Vermont are covered by federal and state oversight. Guggenheim also supplied Vermont-specific figures, saying nearly 8,500 people work in the state’s financial services sector, with three broker‑dealer main offices and 578 financial advisers.

Representatives for the Vermont Chamber of Commerce pressed for regional alignment of definitions in draft 4.2. Joshua Dimon, speaking on the chamber’s behalf, flagged language around biometric data, the new use of the term “household” in the definition of personal data, and departures in the bill’s deidentification and publicly available information provisions. Dimon and other chamber witnesses said the draft’s “one‑and‑done” applicability—where a single sale or handling of sensitive data can trigger coverage—could pull small for‑profit firms and nonprofits into obligations they are not resourced to meet. They pointed to neighboring-state thresholds (Rhode Island 35,000; New Hampshire 25,000; Connecticut 100,000, which the witnesses said will fall to 35,000 on July 1) as examples of differing regional approaches.

Committee members pressed for concrete examples of routine business activity that could be affected. Witnesses cited human‑resources uses (DEI and board demographic reporting), small tax preparers and home‑based providers who retain limited client records, and nonprofits that collect demographic information for grant reporting. Chamber witnesses suggested technical assistance from trusted in‑state advisers (for example, the Small Business Development Center and law‑school clinics) and endorsed a notice‑and‑cure approach: the Senate draft’s 18‑month cure period for attorney‑general enforcement was offered as a model to ease the transition for smaller entities.

Members also debated S.71’s language excluding some publicly available information, and whether the bill should treat the sale or aggregation of public records as regulated conduct. Joshua Dimon argued that if information is legitimately public, regulating its resale or derived inferences can raise First Amendment questions: “If it’s public, it’s public,” he said, urging caution. Other witnesses and committee members said the bill’s goal is to address large‑scale aggregation and commercial profiling that create consumer harm, not ordinary public‑records access.

Dylan, representing the Vermont Technology Alliance, told the committee many growing Vermont tech firms lack in‑house counsel and that compliance costs can be substantial; one company told him its initial cost after CCPA was roughly $50,000. He urged the committee to consider phased thresholds, longer runways to compliance, or targeted technical assistance for small firms.

No formal votes were taken. Committee members asked industry groups to provide written testimony and examples of specific business types that would be affected so staff can propose clearer drafting options. The committee paused for floor business and asked panels to return after the floor session.

The committee’s next procedural step is to collect the witnesses’ written submissions and use them to refine definitions and thresholds in subsequent deliberations on S.71.