Vital changes were made by the Senate Economic Development, Housing, and General Affairs Committee before they unanimously passed the data privacy bill. The legislation is now a strong consumer privacy bill without placing an undue burden on Vermont businesses. In particular, the committee removed the controversial private right of action which would result in collateral damage of rampant litigation placing undue strain on businesses and non-profits of all sizes. It instead asks a technology-based state council under the purview of the Agency of Digital Services to look into a path forward. Additionally, the bill brings it back to a place of interoperability with other New England state data privacy laws. The bill will likely be on the Senate floor for a vote next week.

Businesses testified in the House Commerce and Economic Development Committee on the importance of the Senate changes. Jim Hall, CEO of the Vermont Country Store, stated that the House-passed version of the bill would effectively slow down the economy. We encourage more businesses to reach out to their House and Senate members and ask them to support that bill as it has been amended by the Senate Economic Development, Housing, and General Affairs Committee.

The Vermont Chamber and business leaders testified this week on the importance of balancing consumer protection with support for businesses. They emphasized the need for policymakers to ensure equitable and effective data privacy legislation by addressing the following areas of concern:

1. Private Right of Action: Jim Hall, President and CEO of The Vermont Country Store gave a first-hand account of how a private right of action in privacy laws can lead to frivolous lawsuits against small businesses. A shakedown lawsuit over a California law previously cost The Vermont Country Store $100,000 over $2,000 worth of product sold.
2. Regional Compatibility: If passed in its current form, the bill would make Vermont an outlier and complicate the ability of businesses to operate within its mandates.
3. Business Education: Vermont will require a robust education plan involving Vermont’s trusted technical assistance providers to adapt to a new law. Trusted technical assistance providers need the resources and time to assist businesses through this transition.

The Senate Economic Development, Housing, and General Affairs Committee has shown that they are open to addressing the concerns of Vermont businesses, and we encourage you to contact your Senators to help ensure that they amend the legislation to be more balanced. 

The Vermont Chamber will continue to advocate for:

Removal of the Private Right of Action – The inclusion of a specific private right of action for data privacy violations poses significant risks of increased litigation, straining businesses and potentially enabling opportunistic legal actions akin to patent trolling. Empowering and supporting the Attorney General to enforce data privacy laws directly offers a more efficient path to protecting consumer interests without the potential consequences associated with a broad private right of action provision. Last month, a coalition of fourteen Vermont businesses and non-profit organizations sent a letter expressing their concerns about the bill’s private right of action.

Regional Compatibility – The version of the bill passed by the House strayed from regional compatibility, which, if passed, would make Vermont an outlier and complicate the ability of businesses to operate within its mandates. The Information Technology and Innovation Foundation projects that the absence of federal privacy legislation would burden U.S. small businesses with a $20–23 billion annual cost.

A Robust Education Plan – A 2019 California Attorney General’s report estimated initial compliance costs for small businesses at $50,000 and for mid-sized businesses at $100,000, excluding ongoing costs, which may vary depending on interstate compatibility. Amid significant concerns regarding businesses’ ability to comprehend and navigate these complex requirements, Vermont will require a robust education plan involving Vermont’s trusted technical assistance providers.  

A bill that started as closely mirroring the existing data privacy laws of neighboring states has undergone several changes in recent weeks. These changes have sparked concerns regarding its jurisdiction and the potential of making Vermont an outlier rather than keeping it regionally aligned. The bill, which is expected to pass the House Commerce and Economic Development Committee this afternoon, includes a private right of action. The Vermont Chamber testified on the increased risk of litigation and the challenges Vermont businesses may face in understanding and implementing these new changes. The Vermont Chamber will continue our efforts to address these concerns for businesses throughout the session.

Before the Town Meeting Day break, a coalition of fourteen Vermont businesses and non-profit organizations sent a letter to the committee expressing their concerns about the bill’s private right of action. They suggested that alternative measures should be prioritized, focusing on prevention, remediation, and robust enforcement through mechanisms such as empowering the Attorney General’s Office. The Vermont Chamber will continue advocating for measures that prioritize prevention, and remediation, and ensure that businesses are informed and have access to technical assistance to comply with these significant regulations.

A coalition of Vermont businesses and non-profit organizations sent a letter to the House Commerce and Economic Development Committee to raise concerns over the private right of action included in a consumer privacy bill that the committee is focusing on this session. The Vermont Chamber continues to raise business concerns related to anticipated consequences that could come from the significant unfunded mandates on Vermont businesses and non-profits (notably, the state government is now exempted from these mandates). Specifically, concerns that privacy violation allegations may lead to increased litigation that strain businesses, especially smaller enterprises that are crucial to Vermont’s economy. 

The letter, sent on Monday, February 26, stated: 

Dear Chair Marcotte and House Commerce & Economic Development Committee Members, 

As we navigate the complexities of enhancing data privacy laws in Vermont, our organizations that represent Vermont businesses, non-profits, and trade associations, find ourselves at a pivotal juncture. The proposed data privacy bill, specifically its private right of action provisions, presents a significant concern that could inadvertently exacerbate the challenges facing our state’s economy and business and non-profit communities. 

The introduction of a specific private right of action for data privacy violations risks ushering in a new era of litigiousness that our state is ill-prepared to absorb. While well-intentioned in its aim to protect consumer rights, experience from other jurisdictions tells a cautionary tale: such provisions invariably lead to a surge in litigation, placing undue strain on businesses and non-profits of all sizes, but most acutely on the small enterprises that form the backbone of Vermont’s economy. 

These legal threats do not necessarily advance consumer protection. Instead, they divert critical resources away from innovation and growth, creating an environment of uncertainty that disproportionately challenges local businesses and non-profits. This is not merely a hypothetical scenario, it is a tangible risk that could undermine our collective efforts to foster a vibrant, innovative, economic landscape in Vermont that respects consumer rights. 

While we recognize the importance of providing businesses with an opportunity to rectify potential violations, and the committee’s attempts to do this through the proposed right-to-cure period, we believe that alternative mechanisms, such as enhanced enforcement measures through the Attorney General’s Office, may offer a more effective and efficient means of achieving the dual objectives of protecting consumer interests and supporting economic growth. 

In light of these considerations, we urge a recalibration of this proposed section of bill H.121 to focus on measures that prioritize prevention, remediation, and robust enforcement through our state’s legal frameworks and strengthening the Attorney General’s Office: Empowering the Attorney General’s Office to fulfill its mission as the State’s top law enforcement agency with enhanced resources to enforce data privacy laws effectively offers a more direct and efficient path to protecting consumer interests without the collateral damage of rampant litigation. 

The committee has done extensive and important work to create a data privacy bill that will make real progress on this issue. The undersigned organizations are ready to engage in meaningful dialogue and collaborate on provisions that genuinely serve the interests of Vermonters without imposing undue risk on the businesses and organizations that drive our state’s economy. 

We appreciate your commitment to this issue and look forward to working together towards solutions that safeguard data privacy while promoting economic health and innovation in Vermont. 

Thank you for your attention and consideration. 

Sincerely, 

Vermont Chamber of Commerce 

Vermont Technology Alliance 

Common Good Vermont 

Lake Champlain Chamber 

Vermont Lodging Association 

Vermont Independent Restaurants 

Vermont Retail and Grocers Association 

Heating and Cooling Contractors of Vermont 

Vermont Fuel Dealers Association 

Vermont Ski Areas Association 

Vermont Vehicle and Automotive Distributors Association 

Vermont Specialty Food Association 

Vermont Insurance Agents Association 

Associated General Contractors of Vermont 

The legislature has introduced a new version of a data privacy bill that was discussed last year, pulling from laws in Connecticut and Oregon. The bill contains a small business exemption that will support Vermont’s smallest businesses from undue burden, but it also contains a private right of action that could lead to costly lawsuits. In the absence of comprehensive federal data privacy law, state legislatures have been passing a patchwork of different, and sometimes conflicting, laws.

These laws regulate how companies control and process personal data in an economy that is relying on it more and more. They can be important consumer protection tools but also have the potential to create confusion and challenging burdens in the marketplace. Nationally, the Information Technology and Innovation Foundation has estimated that state privacy laws could impose costs of $98 billion and $112 billion annually. Over 10 years, these costs would exceed $1 trillion. The burden on small businesses would be substantial, with U.S. small businesses bearing $20–23 billion annually.