Committee report outlines Vermont data privacy bill S.71; Priestley details rights, scope and enforcement

Representative Priestley, speaking for the House Commerce and Economic Development Committee, delivered the second reading and a floor report on Senate Bill 71, the proposed Vermont Data Privacy and Online Surveillance Act.

"There is a transaction happening right now at scale, involving every single person in this chamber and every person who sent us here," Priestley told members, describing widespread data collection and commercial profiling. He argued the bill establishes consumer rights — the right to know what data companies collect, the right to correct inaccuracies, the right to delete personal data, the right to obtain a copy of data, and the right to opt out of targeted advertising — and sets duties for businesses that collect, process and sell personal data.

Priestley said the bill contains roughly 50 definitions that shape its scope and protections, including biometric data, personal data, sensitive data (examples given: religious beliefs, immigration status, health data, precise geolocation, neural data, financial account information), de-identified data, and profiling. Applicability thresholds in Section 2415B limit coverage to controllers that process the data of more than 35,000 Vermonters, or that collect or process sensitive data or sell personal data for more than 3,000 Vermonters, which Priestley said excludes most small local businesses and nonprofits.

The bill lists exemptions that reference existing federal and state frameworks; Priestley named exemptions for state and local governments, healthcare data governed by HIPAA, the Fair Credit Reporting Act (FCRA), the Driver Privacy Protection Act, the Gramm-Leach-Bliley Act (GLBA), and other federal laws that already provide consumer privacy protections. Priestley emphasized that enforcement would be handled by the Attorney General under the Consumer Protection Act and that the statute, as drafted, does not create a private right of action. The act would take effect Jan. 1, 2028, with an 18-month cure period during which the Attorney General would issue notices of violation and allow businesses the opportunity to cure (through July 1, 2029).

The committee recommended that the House propose an amendment to the Senate's bill as printed on the calendar and listed a broad set of witnesses and organizations that provided testimony during the bill's committee process. Priestley asked members to support the committee amendment when the House takes action on the measure.

The House had earlier suspended rules to take up S.71 for immediate consideration; the session recessed for dinner after Priestley's presentation.