Governor Vetoes Vermont Privacy Bill

Governor Phil Scott vetoed the Vermont Data Privacy Act, writing in a letter to the state’s General Assembly that the “Bill creates an unnecessary and avoidable level of risk.”

The Vermont bill was unique from laws passed in other states because it included a private right of action that would have allowed consumers to sue companies that violate their privacy rights. If the bill was signed into law, Vermont would have been the only state with a broad private right of action. The California Consumer Privacy Act contains a private right of action for data breaches, but not general privacy violations.

In his veto letter, Governor Scott expressed his concerns about the private right of action, saying, “One area of risk comes from the bill’s ‘private right of action,’ which would make Vermont a national outlier, and more hostile than any other state to many businesses and non-profits – a reputation we already hold in a number of other areas. I appreciate this provision is narrow in its impact, but it will still negatively impact mid-sized employers, and is generating significant fear and concern among many small businesses.”

The Governor also called out the risk created by the privacy requirements on online services minors could use. In his letter to lawmakers, he said, “While this is an important goal we can all support, similar legislation in California has already been stopped by the courts for likely First Amendment violations. We should await the decision in that case to craft a bill that addresses known legal pitfalls before charging ahead with policy likely to trigger high-risk and expensive lawsuits.”

Governor Scott encouraged state lawmakers to keep working on a data privacy law. He recommended passing a law similar to Connecticut’s and New Hampshire’s, saying regional consistency would benefit consumers and the economy.

CompliancePoint has a team of experienced privacy professionals available to help your organization comply with GDPR, CCPA, and all other state privacy laws. Reach out to us at connect@compliancepoint.com to learn more.