Conference committee debates 'cure period' in genetic data privacy bill H639

A legislative conference committee discussed the genetic data privacy bill H639 and focused much of its time on whether to include a "cure period" that would give companies time to remedy alleged violations before private rights of action proceed.

Rick Sable of the Office of the Legislative Council walked members through section 2421B of the bill, including subdivision 1's privacy-notice and disclosure requirements and subdivision 2's requirement for "express, separate consent" for specific uses of genetic data, storage of biological samples and third-party transfers. Sable summarized the House-passed version and identified provisions the House suggested were "curable." (Rick Sable, Office of the Legislative Council)

Committee members sharply disagreed on the cure-period concept. One committee member, arguing the cure period is a common, reasonable mechanism, said, "this is what I would call curable," and urged that cure periods give businesses an opportunity to correct errors without stripping consumers of remedies at law. That member noted cure periods exist in other states and said they can speed resolution and reduce costly litigation.

Other members pushed back, saying some harms from genetic-data disclosures happen immediately and cannot be undone. One said selling genetic data to a bad actor or it appearing on the dark web "could be used to scam" vulnerable Vermonters or to affect insurance rates — consequences the member said there is "no cure for." That speaker asked how much additional damage would occur during a 60-day cure window and whether a cure period would simply give bad actors more opportunity to distribute data.

Members also questioned how a cure would work in practice for data sold on the dark web or to unknown actors: "How do we even cure it if it's sold 100 times?" a member asked, noting that some harms are not reversible even if a company later tries to retract or secure data.

The committee discussed enforcement and oversight. Several members proposed that any cure-request process be accompanied by confidential notice to the attorney general so the state could assess whether an individual complaint reflected a broader breach affecting many consumers. "If you give a cure period, what if you also included in that cure period a notice to the attorney general who would keep it confidential unless certain circumstances occur?" one member suggested.

Members asked for evidence about existing harms. One referenced a widely reported incident involving a consumer genetics company and said the proposed bill is narrowly targeted to genetic data and not analogous to broader liability laws such as Illinois' BIPA. Another member said the bill's narrowness and its basis on other-state law made it less likely to produce the kinds of sprawling litigation seen under some statutes.

Several members floated a sunset or phased-in approach to any cure-period provision to give companies time to comply while limiting the duration of special procedural relief. With some committee members needing to leave for other business, the group agreed to narrow the proposal further and resume the discussion at a later meeting. No formal motion or vote was taken during the session.

The committee did not reach a final decision on whether to include a cure period, how long it would be, how notice to the attorney general would operate, or whether any cure provision should include a sunset; members asked staff to draft narrower language for further consideration.