The Democrat-controlled Vermont legislature has recently passed a comprehensive data privacy bill, which is considered one of the strongest in the country. The legislation aims to crack down on companies’ use of online personal data and would allow consumers to file civil lawsuits against companies that violate certain privacy rules. However, Republican Gov. Phil Scott is concerned about how the legislation could impact small businesses. He will review the bill before making a final decision on whether to sign it into law.
The bill prohibits the sale of sensitive data such as social security and driver’s license numbers, financial or health information, and sets limits on the amount of personal data that companies can collect and use. The legislation also includes measures to protect children’s privacy online. State Rep. Monique Priestley, a Democrat who sponsored the bill, emphasized the importance of comprehensive data privacy measures in an era where personal information is monetized in a surveillance economy. The bill also allows consumers to sue companies for privacy violations, which is seen as an effective way to ensure compliance with privacy laws.
Critics of the legislation, including the Vermont Chamber of Commerce, have expressed concerns about the private right of action included in the bill. They believe that allowing consumers to sue companies could make it harder and more expensive for Vermont businesses to compete. To address these concerns, legislators decided to limit the private right of action to violations by data brokers and large data holders. They believe that these companies are better equipped to comply with data privacy regulations than smaller businesses.
The bill includes provisions that will go into effect gradually, with much of the legislation set to take effect in 2025. The ability for consumers to sue companies for privacy violations will not come into effect until 2026 and will sunset in 2028, pending a study to assess its effectiveness and risks. The legislation was passed shortly after Maryland signed two data privacy bills into law aimed at protecting personal data online and creating consumer protections and rights related to online personal data.
Overall, Vermont’s data privacy legislation is seen as a significant step towards protecting individuals’ privacy rights in an increasingly digital world. If signed into law by Gov. Phil Scott, the bill would offer consumers more control over their personal data and hold companies accountable for privacy violations. While concerns have been raised about the impact of the legislation on small businesses, proponents believe that the measures are necessary to address the growing threats to data privacy in the digital age.
