Vermont just passed one of the strongest privacy bills nationwide, Gov. Scott considering a veto

What you can do: If you’re a Vermonter, tell Gov. Scott to sign H121, the Vermont Data Privacy Act. Call and leave a message at 802-828-3333, or use the Governor’s online contact form. 

Last week, in the final hours of the legislative session, the Vermont legislature passed H121, a data privacy bill sponsored by Rep. Monique Priestly that would put strict limits on how companies can collect and use data. If signed, it will be one of the strongest privacy laws in the nation, joining Maryland – which enacted its privacy law last week – in raising the bar for privacy protections nationally. 

Despite the legislature passing H121 with strong bipartisan support, Gov. Scott is reportedly considering a veto, particularly over the bill’s inclusion of a private right of action –  the ability for consumers to hold large companies that violate the law accountable in court. For years tech industry lobbyists have successfully killed legislation  including the ability to sue. Privacy advocates argue that laws with private rights of action are often more effective at changing corporate behavior, than relying on government agencies with limited resources to identify violations and issue fines.

The private right of action in Vermont’s legislation only applies to larger companies that collect the data of more than 100,000 people a year, a compromise that was made during the negotiation process. Smaller, Vermont-based businesses will instead work with the state’s Attorney General to come into compliance. 

Vermont’s passage of H121 comes on the heels of Maryland’s governor signing the Maryland Online Data Privacy Act last week. Maryland and Vermont’s bill have many similar provisions, including strict limits on the collection of unnecessary data and banning the sale of sensitive data – such as health information – outright. Only Vermont’s contains the private right of action. 

The bills in both of these states are a reversal of a years-long trend of heavy lobbying by the tech industry successfully watering down consumer privacy bills. A scorecard report from earlier this year gave nearly half of state privacy laws an “F” grade for how well they actually protect people’s privacy and security.