Under the bill, companies would be barred from the sale, lease, or disclosure of people’s biometric identification unless necessary for the service or the person consents

By Brooke Burns

Vermont does not currently have a comprehensive data protection law. But with the help of Harvard Law School students, House lawmakers passed a bill that would give Vermonters more data protections.

Rep. Michael Marcotte, R–Coventry, introduced H.121 to the Committee on Housing and General Affairs last May, but lawmakers shelved it until this year. This session, it was referred to the Committee on Commerce and Economic Development and passed unanimously out of the House March 22.

The bill seeks to add to the existing data privacy protections for Vermonters to include the regulation of biometric identifiers —  data gathered from the measure of biological characteristics, like fingerprints or retina and iris images.  

Current data privacy protections in the state cover other kinds of personal data, like date of birth, address, place of birth, name and more. There are only 13 states that protect biometric identifiers. Marcotte wants to add Vermont to the list.

“Prior to the pandemic, we were looking at some of the issues that are coming up for more consumer privacy in the internet world, in the virtual world,” Marcotte told lawmakers in May. “And the Attorney General’s office had done a study, I think it was 2020, 2021, and came back with a report last year, asking David to turn it into a bill.”

David Hall, legislative counsel, has worked on creating a data protection bill with lawmakers since 2022, tailoring the language to Vermont’s needs.

Under the bill, companies would be barred from the sale, lease, or disclosure of people’s biometric identification unless it is necessary for the service or the person gives consent. 

Companies that process and collect biometric identifiers would have to  ask consumers’ permission. They would also need to provide users with a way to indicate their data cannot be used outside of what they’ve consented to. 

Lawmakers worked with students in the Cyberlaw Clinic at Harvard Law School — an in-house law firm that second and third year law students work in — to draft the bill. The clinic offers free legal services to clients that need help with internet, technology or intellectual property issues, according to the website.

Harvard law students submitted three separate reports to lawmakers on existing data protection practices in the United States and European Union. One report analyzed data privacy law in other states and recommended Vermont use a model similar to Connecticut’s. 

H.121 includes a set of data privacy rights mirroring Connecticut’s law — specifically a provision that gives people the right to receive notice when their data is being collected. 

Another report, drafted by Ellen Teuscher, a second year law student who spoke to representatives in a Feb. 1 meeting, focuses on the ability for a consumer affected by a data breach to seek damages. The Vermont bill includes one, though it can be controversial with some courts. 

“A lot of courts are not fully on board with the idea that data leaks and the release of personal data is actually a harm if no true financial harm (occurred), or a hacker didn’t take your data, or you didn’t experience things like identity theft as a result,” said Teuscher. “So making sure to explicitly spell out what damages and what the intent of it is, is really important here.”

The last report examined four of the 13 states that define and regulate biometric identifiers. The definition used in H.121 pulls from Connecticut and Washington law, the two states that don’t consider audio and video recordings as biometric identifiers — meaning neither would be protected under the bill.  

The bill is being considered in the Senate Committee on Economic Development, Housing and General Affairs.

The Community News Service is a program in which University of Vermont students work with professional editors to provide content for local news outlets at no cost.