Vermont governor vetoes data privacy bill
Vermont’s governor vetoed one broad data privacy law that would have been one of the strongest in the country to crack down on companies’ use of personal online data by letting consumers file civil lawsuits against companies that violate certain privacy rules.
Republican Gov. Phil Scott said in his veto message late Thursday that the legislation would have made Vermont “a national outlier and more hostile than any other state toward many businesses and nonprofits.”
“I appreciate that this provision has a limited impact, but it will still have a negative impact on mid-sized employers and cause significant fear and anxiety for many small businesses,” he wrote.
The legislation would have banned the sale of sensitive data such as Social Security numbers and driver’s license numbers, as well as financial information and health data. It would also have placed meaningful limits on the amount of personal data companies can collect and use, according to the nonprofit Electronic Privacy Information Center based in Washington, DC.
The Democratic-controlled Legislature plans to override the governor’s veto during a special session on Monday. The bill passed the House of Representatives by a vote of 139 to 3, with a slew of amendments introduced in the final days of the session.
“Our collective efforts have produced legislation that not only reflects our commitment to protecting consumers from scams and identity theft, but also sets a standard for the nation,” House Speaker Jill Krowinski, a Democrat, said in a statement . “It’s unfortunate that so much misinformation has spread about this bill, but we know that Big Tech and their deep pockets are afraid of no longer having unfettered access to Vermonters’ personal information.”
More than a dozen states have comprehensive data privacy laws. When the Vermont Legislature passed the bill, EPIC Deputy Director Caitriona Fitzgerald said the legislation was “one of the strongest, if not the strongest” in the country. EPIC urges the Legislature to override the Governor’s veto.
“The Vermont Data Privacy Act would have given Vermonters meaningful privacy rights lacking in other state laws, and would rightly have given them the ability to enforce those rights,” Fitzgerald said in a statement.
Scott said he also had concerns about the provision aimed at protecting children, saying that similar legislation in California “has already been halted by the courts for likely violations of the First Amendment” and that the state should determine the outcome of that matter must wait.
The Vermont Kids Code Coalition said the legislation is different than California’s and constitutionally sound.
Much of the legislation would have come into effect in 2025. The opportunity for consumers to sue would have happened in 2027 and expired in 2029, with a study into its effectiveness and risks.