To date, there is no comprehensive Vermont privacy law in effect.
Vermont Consumer Privacy Act Vetoed
On June 14, 2024, Vermont Governor Phil Scott vetoed a comprehensive data privacy bill that aimed to be one of the strongest in the nation. Governor Scott described the bill’s provisions as presenting an “unnecessary and avoidable level of risk.”
Scott elaborated that the private right of action, which allowed individuals to sue companies for privacy violations, could create a highly litigious environment, particularly for mid-sized and small businesses. This would significantly increase legal costs and potentially drive businesses out of the state, creating an economic risk that Scott deemed unnecessary.
Additionally, the kid’s code provision, with its stringent privacy requirements for online services used by minors, was seen as overly complex and costly to implement. The broad definitions and high compliance costs associated with these provisions could lead to frequent legal challenges and deter economic growth and innovation in Vermont.
Scott also emphasized the need for regional consistency, suggesting that Vermont adopt a privacy law more aligned with those in neighboring states like Connecticut and New Hampshire to avoid a patchwork of differing regulations that companies would struggle to navigate.
Summary of the Proposed Law
The vetoed bill included several key features designed to protect consumer data and privacy:
- Private Right of Action:
- Allowed individuals to sue companies for privacy violations without relying on state authorities.
- Applied to any business processing more than 100,000 consumer records.
- Data Minimization Requirements:
- Restricted the amount of personal data companies could collect and use.
- Prohibited the sale of sensitive consumer data.
- Kids Code Provision:
- Introduced privacy requirements for online services used by minors, including age-gates.
- Aimed to protect children’s data but was seen as complex and potentially costly.
- Civil Rights Safeguards:
- Established protections to prevent discrimination based on collected data.
- Geolocation Data Restrictions:
- Limited how companies could use consumers’ geolocation data.
Background and Reaction
The vetoed bill was intended to provide Vermont residents with some of the strongest data privacy protections in the nation. It included provisions to limit data collection and use, safeguard sensitive data, and offer consumers a private right of action to sue companies directly for violations. Advocates for the bill argued that such measures were necessary to protect consumers in an increasingly data-driven world.
Advocacy groups expressed disappointment with the governor’s decision, emphasizing the need for robust consumer protections against data abuses by large technology companies. Matt Schwartz, a policy analyst at Consumer Reports, highlighted that the private right of action was a crucial tool for consumers to defend their rights and hold companies accountable for data abuses.
Despite the veto, the state legislature could override it, adding Vermont to the list of states with comprehensive data privacy laws. The ongoing debate reflects the broader national conversation about data privacy, consumer rights, and the balance between regulation and economic growth.
Centraleyes will keep you updated on the status of Vermont’s data privacy law, as well as other state privacy laws.
