Vermont committee hears evidence for H.2 11 to register data brokers, require breach notices and offer deletion requests

The Senate Economic Development, Housing & General Affairs committee considered H.2 11 on Wednesday, a bill that would expand Vermont's data‑broker registry, require breach notifications by brokers and create a process for consumers to request deletion of brokered data.

Todd Davis of the Attorney General's Office told the committee the office supports the bill "where H 2 11 is right now" and described three core elements: extending breach notification rules to data brokers, broadening registration requirements and giving consumers the ability in appropriate circumstances to request deletion of their information. Davis said brokers "aggregate, they analyze, and they sell products around consumer data," and argued the bill helps correct a transparency imbalance between consumers and third‑party brokers.

Lauren Hibbert, deputy secretary of state, said the bill shortens the current statutory window so a data broker must register "not more than 30 days after meeting the definition" and establishes an annual renewal on July 1. The bill would raise the broker registration fee from $100 to $900, Hibbert said, and would require the secretary of state to collect many more data points about brokers and make opt‑out and deletion information available to consumers. She estimated the initial IT build at about $120,000 and said increased fees are intended to cover the ongoing maintenance of that system.

Hibbert also described a study and reporting component: the office is requesting a $50,000 allocation to hire a consultant to assess options for a universal "delete me" portal and to advise on secure implementation. She warned that building an interface that handles sensitive data would change the secretary of state's current public business services system and stressed the need for security and clear communication with brokers.

On enforcement, Davis said the AG's office would use a stepped administrative approach. The bill includes a bond requirement and related administrative remedies intended to let the state recover costs and to avoid filing full litigation in routine cases; Davis described that mechanism as a practical way to enforce registration and to streamline recouping penalties from out‑of‑state registrants.

Committee members pressed both witnesses on capacity and timing. Davis acknowledged the AG's consumer unit is modest in size and said the office would prioritize enforcement work; Hibbert said the office has been coordinating with the AG's office and other stakeholders and prefers a careful implementation timeline.

The committee recessed and planned further testimony following the break.