Legislators are working to strengthen Vermont’s consumer privacy law.
A House bill would give Vermonters the option to request that their data not be tracked by data brokers, and would create a registry of Vermonters who do not allow their data to be tracked. It also would allow Vermonters to request deletion of any data that had already been collected.
The bill would protect biometric data, such as fingerprints, prohibiting businesses from collecting or retaining such data without a person’s consent. Businesses would not be able to pass along biometric data without a court order or warrant.
Vermont Attorney General Charity Clark supports the bill.
The Attorney General’s Office is suing Clearview AI, a facial recognition company headquartered in New York, alleging consumer fraud. The suit alleges the company has collected billions of people’s images without their consent, and makes them available to customers using facial recognition technology.
“If you are downstairs talking to the sergeant-(at)-arms and a tour is going by and they snap a picture of Governor Kunin’s portrait and you happen to be standing there and they put it on whatever internet site they put it on, your face will be screen-scraped,” Clark told the House Committee on Commerce and Economic Development in a hearing Thursday. “You’ll have no idea a photograph was taken and now you’re in their database. It’s really disturbing.”
“We respect the Vermont AG, however we strongly disagree with the premise of the lawsuit,” said Tristram Coffin, who’s the former U.S. Attorney for Vermont and is now an attorney representing Clearview AI. In a statement emailed to VTDigger, Coffin said, “We look forward to making our case. Clearview AI only collects public information from the internet, like any other search engine, including Google.”
Clearview is registered in Vermont’s data broker registry. Vermont law defines a data broker as a business that knowingly collects and sells or licenses to third parties personal information of consumers with whom it has no direct relationship.
Rep. Michael Marcotte, R-Coventry, chair of the House Committee on Commerce and Economic Development and sponsor of the bill, said financial and health care institutions have asked to be exempted from the bill because they must already adhere to strict federal laws governing how they handle customers’ and patients’ data.
Vermont was the first state to require data brokers to register.
The Vermont Attorney General’s Office’s website posts a list of security breaches in which consumer personal data has been exposed. Such breaches occur on a nearly daily basis.
The bill also would allow Vermonters to sue data brokers privately.
“We see that private-action section of the bill as a crucial component to giving individual Vermonters recourse,” Assistant Attorney General Sarah Aceves said in testimony before the committee. “You can go out and sue them.”
Andrew Kingman — testifying on behalf of the State Privacy & Security Coalition, an organization representing some 30 businesses that range from Google to Meta, Facebook and Instagram’s parent company — said the right for consumers to file private lawsuits has driven businesses out of Illinois and predicted it would drive businesses out of Vermont.
Kingman said his group also opposes singling out data brokers and the requirement that they obtain consent from consumers before disclosing their private data because, he said, those providers do not have a direct relationship with the consumer.
Kingman also said the group opposes giving Vermonters a right to opt out of all collection of their personal information.
