Vermont Gov. Phil Scott vetoes intensive data privacy bill, citing high ‘level of risk’

Vermont Gov. Phil Scott on Thursday vetoed the state’s comprehensive data privacy bill, citing the “unnecessary and avoidable level of risk” it would have incurred.

He urged the state legislature to instead craft a law similar to other privacy laws in the region, such as those enacted in Connecticut or New Hampshire. Scott said regional consistency would be “good for both consumers and the economy.”

Vermont’s bill would have made the state one of just a few in the nation to offer its residents a private right of action, a legal mechanism that allows individuals to bring civil suits against companies that violate the law. In a letter to the state’s General Assembly, Scott said the private right of action would have made Vermont hostile to businesses and nonprofits, “a reputation we already hold in a number of other areas.”

“I appreciate this provision is narrow in its impact, but it will still negatively impact mid-sized employers, and is generating significant fear and concern among many small businesses,” Scott wrote.

Other risks Scott cited included the bill’s “kids code” provision, which would have put new privacy requirements on any online service that could be used by minors, including age-gates. Scott said the kids code provision, and the bill’s expansive definitions and complexity, would have created many costly legal pitfalls.

Just a handful of other states offer a legal private right of action on the basis of violating data privacy. California’s Consumer Privacy Act offers consumers a limited private right of action, and in Illinois, the state’s Biometric Information Privacy Act offers a private right of action, but it only extends to biometric data.

Other states have attempted to pass comprehensive data privacy laws that include private rights of action, but they usually fail. In the nearby state of Maine, a lawmaker this year proposed a bill that would have become the strongest in the nation, but in April it failed in the state’s Senate.

A report published in February by the Electronic Privacy Information Center and the U.S. PIRG Education Fund found that most states’ privacy laws offer limited protections for consumers, partially because they usually lack private rights of action, which privacy experts say is the most effective way to deter companies from violating the regulations.

The groups evaluated 14 data privacy laws for their strengths and weaknesses — the highest scoring law, the California Consumer Protection Act, earned a “B+”. The Connecticut Data Privacy Act earned a “D”.

The advocacy arm of Consumer Reports released a statement in response to the governor’s veto Thursday, expressing disappointment in Scott’s decisions after working with state lawmakers on the bill and advocating for the inclusion of a private right of action.

“Vermont consumers deserve the protections in this bill, especially the ability to hold big tech companies accountable when they misuse their most sensitive information. We remain hopeful that the legislature will override this veto with the support of the overwhelming majority of lawmakers that originally passed it,” Matt Schwartz, policy analyst at Consumer Reports, said in the statement.

Despite the governor’s objections, the state’s legislature could still override the veto and add Vermont to the growing list of states with comprehensive data privacy laws on the books, which currently totals 18.

“The bottom line is, we have simply accumulated too much risk,” Scott said. “However, if the underlying goals are consumer data privacy and child protection, there is a path forward.”