MONTPELIER, Vermont: Aimed at cracking down on companies’ use of online personal data, the Democrat-controlled Vermont legislature passed one of the strongest data privacy measures in the U.S.
The new law will allow consumers to file civil lawsuits against companies that break certain privacy rules.
However, Republican Gov. Phil Scott said part of the legislation could affect small businesses, and he will decide once he has reviewed it, his spokesperson Jason Maulucci said this week.
According to the non-profit the Electronic Privacy Information Center based in Washington, D.C., the bill prohibits the sale of sensitive data, such as social security and drivers’ license numbers, financial or health information, as well as limits on the amount of personal data that companies can collect and use.
Caitriona Fitzgerald, deputy director of EPIC, said, “More than a dozen states have comprehensive data privacy laws. Vermont’s is ‘among the strongest, if not the strongest’ in the country.”
Late last week, Democrat State Rep. Monique Priestley, a sponsor of the bill, told colleagues that without thoughtful and comprehensive measures, gaps can be exploited, undermining the protections legislators were seeking.
“At a time when everything we do and everything, we are monetized in a surveillance economy, the urgency of this moment cannot be overstated,” she said.
Fitzgerald said that as state attorneys-general do not have the resources to enforce these privacy regulations, allowing customers to sue is the most effective way to ensure that companies comply with privacy laws.
Megan Sullivan, vice president for government affairs of the Vermont Chamber of Commerce, said that while the chamber shares the governor’s concerns, “ultimately, this will make it harder and more expensive for Vermont businesses to compete.”
Meanwhile, Priestley said that legislators decided to act against violations by data brokers, which are companies that make most of their revenue selling data, as well as large data holders, which are companies processing data from 100,000 Vermonters or more a year.
If signed by Scott, much of Vermont’s bill would come into force in 2025, but the ability for consumers to sue will not take effect until 2026 and sunset in 2028, she added.