Top Democrats in the Vermont House and Senate joined with Democratic Attorney General T.J. Donovan to promise action in light of data breaches such as the one revealed this summer by credit rating agency Equifax.
The officials said they are in the process of gathering information about data security issues, possible legislative remedies, and the lines between state and federal authority. The goal, said House Speaker Mitzi Johnson (D-South Hero) is to draft legislation for "immediate action in January."
One starting point: a series of public hearings to be held by the House Commerce and Economic Development Committee beginning next week to gather public testimony on the impact of the Equifax breach and other data-security issues.
"Consumers deserve control over their personal information," Donovan said. "We have an obligation to protect Vermonters."
"Vermonters shouldn't have to lift a finger to keep their personal information safe," said Johnson. "You shouldn't have to pay $10 per person to four separate agencies to freeze your information."
Sen. Michael Sirotkin (D-Chittenden), vice chair of the Senate Economic Development, Housing and General Affairs Committee, is working on a bill that would address four areas of the issue. It would prohibit credit rating agencies from imposing fees on consumers to fix problems created by the agencies themselves; establish a comprehensive information security program; expand the power of the Attorney General and individual consumers to bring civil suits to recoup costs incurred due to data breaches; and establish a data security chief position in the AG's office to coordinate state efforts on "enforcement, education and prevention."
Sirotkin said the bill is a work in progress, and has yet to be published. A key goal, he added, is that companies handling personal information "must take reasonable steps to meet minimum standards" for preventing breaches. Those standards would provide "grounds for legal action when there's a breach."
While every speaker vowed strong action, one included a cautionary note. "Access to credit is incredibly important," said Rep. Bill Botzow (D-Pownal), chair of the House Commerce and Economic Development Committee. "If we overreach, we could take away access to credit. We have to consider these issues judiciously."
Botzow's committee will convene four public hearings on data security over the next two weeks. On Thursday, November 9, there will be a hearing at 12:30 p.m. at the Springfield Town Offices and at 5:30 p.m. in the Barton Village Office. Then on Tuesday, November 14, hearings are set for 12:30 p.m. in the Manchester Community Library and at 6:00 p.m. in Burlington at the Department of Health offices, 108 Cherry St.