Vermont’s landmark privacy bill killed as legislature fails to override veto

The Vermont Senate on Monday voted to sustain the Republican state governor’s veto of a groundbreaking comprehensive state data privacy bill with a 15-14 vote which effectively kills the legislation.

The state’s House of Representatives overwhelmingly supported overriding the veto in a 128-17 vote, but the bill’s supporters needed two-thirds of both state General Assembly chambers to overcome the veto. 

Had it passed, the bill would have been one of the strongest of 18 state privacy laws now enacted nationwide. Most notably, the legislation would have given individuals the right to sue companies violating a broad swath of data privacy protections, an unprecedented provision at the state and federal level.

According to the bill's sponsor, Democratic Rep. Monique Priestley, the bill died because of a “massive lobbying campaign to deny Vermonters their right to strong privacy protections.”

She vowed to fight on. 

“No dust is settling on this effort,” Priestley told Recorded Future News. “This bill provided a masterclass on what we’re up against and we are already coordinating next steps.” 

Priestley worked hard to spotlight an aggressive big tech lobbying effort to weaken the bill. In April she invited Montana, Maryland, Vermont, Oklahoma, Kentucky and Maine lawmakers who sponsored their own privacy legislation to testify about the intense lobbying pressure they also faced from the tech industry.

Gov. Phil Scott said he vetoed the bill last Thursday in part because of its first-in-the-nation private right of action, which he called a “risk” that would make Vermont “more hostile than any other state to many businesses and nonprofits.”

The Vermont law’s private right of action would have applied to companies violating the confidentiality of consumers’ health data, processing sensitive data without consent and selling sensitive data.

Illinois gives its citizens a private right of action, but it only applies to biometric data.

If the Vermont legislation had passed, the private right of action provision would have expired in January 2029.

In addition to the private right of action and a provision involving regulation of internet content directed toward children, Scott said he vetoed the bill due to its “unique expansive definitions and provisions [which] create big and expensive new burdens and competitive disadvantages for the small and mid-sized businesses Vermont communities rely on.”

The consumer advocacy group Consumer Reports highlighted the bill’s provision giving individuals the right to access, delete, and stop the sale of their personal information as well as its data minimization standards.

“Ultimately, industry feared this legislation and worked so hard to kill it because it had real teeth to prevent their harmful data practices,” Consumer Reports policy analyst Matt Schwartz said in a statement.