Republican Gov. Phil Scott has vetoed legislation that would allow Vermonters to sue large data brokers that misuse their sensitive personal information.
Scott said the bill, known as H.121, has elicited unusual levels of opposition in Vermont’s business community.
“We’re receiving an enormous amount of concern from small businesses throughout the state, and that’s elevated over the last two or three days,” Scott said on Wednesday.
He said the “private right of action” contained in the bill could subject businesses to frivolous lawsuits from unscrupulous lawyers. And he said novel data privacy provisions that depart from practices in other states could create burdensome compliance costs for small and mid-size businesses.
“These businesses are already poised to absorb an onslaught of new pressures passed by the Legislature over the last two years, including a payroll tax, a Clean Heat Standard, a possible Renewable Energy Standard … not to mention significant property tax increases,” Scott wrote in his veto message to lawmakers Thursday.
Data privacy advocates have hailed Vermont’s bill as among the strongest in the nation when it comes to protecting consumer data. Bradford Rep. Monique Priestley, a Democrat who worked with national experts to craft the legislation, said the bill would prohibit companies from profiting off the sale of Vermonters’ personal data. She said other consumer protections in the legislation provide a key safeguard against the intensifying dangers of the digital age.
“The more of our data that is scraped and sold to entities across the world and then breached and things like that, the more we are open to scams, identity theft,” Priestley said.
Priestley said concerns about the legislation posing a threat to businesses in Vermont are being sown by Big Tech lobbyists that want to squelch a state-level bill that could become a national model.
“There was a major misinformation and fearmongering campaign that happened with information that was just not factually correct,” she said.
Priestley said the proposed private right of action is narrowly focused on large data brokers handling the most sensitive personal information, such as social security numbers, DNA and fingerprints.
“Things that the average mom and pop in Vermont is not handling,” Priestley said.
Attorney General Charity Clark, a Democrat, said in a statement Friday that she was “extremely disappointed” in Scott’s veto. She said she’s “genuinely perplexed” by Scott’s claims that the bill will hurt small businesses.
“The bill applies only to businesses holding the data of 25,000 or more consumers,” Clark said. “This bill simply does not apply to mom-and-pop shops.”
Megan Sullivan, vice president of government affairs at the Vermont Chamber of Commerce, said targeted online advertising has become an imperative for locally owned businesses. And she said many of those companies could easily come under the jurisdiction of the proposed legislation.
“When you have a novel law that has different definitions than we see in any other state, all those businesses now need to hire their own programmer and lawyer to say, ‘How do I comply with this law for Vermonters?’” Sullivan said in an interview.
Sullivan noted that the bill has drawn opposition from some of Vermont’s anchor employers, including the Vermont Country Store, Orvis, King Arthur Flour and Burton.
Sonya Sibold, vice president and general counsel at Burton, sent an email to Chittenden County legislators on Tuesday raising “significant concerns” with H.121.
“We are a long-standing Vermont company that frequently engages in digital marketing to grow our business and that generally retains large amounts of customer information in our databases,” Sibold said. “This bill will make it very difficult for us to continue to reach our customers and frankly to do business in Vermont and elsewhere.”
Sullivan said the fact that lawmakers have exempted utilities and medical institutions from the legislation demonstrates the potential downside risk associated with compliance and enforcement.
She said Vermont’s business community isn’t opposed to strengthening data privacy protections.
“(Businesses) are asking for a consumer-friendly, consumer-first bill that holds bad actors accountable and brings Vermont businesses along to understand compliance in a reasonable way, and still allow them to do marketing in the digital world,” Sullivan said.
The legislation also contains provisions that would force social media companies to make their platforms less addictive to children. Scott said he opposed those measures too, since they’ve faced well-funded legal challenges in other jurisdictions, such as California, that have instituted similar measures.
“We should await the decision in that case to craft a bill that addresses known legal pitfalls before charging ahead with policy likely to trigger high-risk and expensive lawsuits,” Scott said.
Chittenden County Sen. Kesha Ram Hinsdale, a Democrat whose committee spent weeks crafting the portion of the bill that relates to social media protections for kids, said she plans to vote to override Scott’s veto next week.
But Ram Hinsdale said concerns from businesses are in some cases founded.
“I am not going to give people false information that Vermont businesses are immune from harm because of the final compromise,” she said. “We have a lot of businesses sharing real concerns … and we have to recognize that if we take some of these tools away from online sales platforms that come from Vermont … that actually helps Amazon.”
Democratic lawmakers will attempt to override Scott’s veto of the data privacy bill, and several other vetoed bills, when they convene in Montpelier on Monday.
This year's full list: Here are the bills vetoed by Gov. Phil Scott
Have questions, comments or tips? Send us a message.
