Vermont governor vetoes data privacy bill

Vermont’s governor has vetoed a broad data privacy bill that would have been one of the strongest in the country to crack down on companies’ use of online personal data by letting consumers file civil lawsuits against companies that break certain privacy rules.

Republican Gov. Phil Scott said in his veto message late Thursday that the legislation would have made Vermont “a national outlier and more hostile than any other state to many businesses and non-profits."

“I appreciate this provision is narrow in its impact, but it will still negatively impact mid-sized employers, and is generating significant fear and concern among many small businesses,” he wrote.

The legislation would have prohibited the sale of sensitive data, such as social security and driver’s license numbers, as well as financial information and health data. It also would have set meaningful limits on the amount of personal data that companies can collect and use, according to the nonprofit Electronic Privacy Information Center based in Washington, D.C.

The Democrat-controlled Legislature plans to override the governor's veto when it meets for a special session on Monday. The bill passed 139-3 in the House and a flurry of amendments were made in the final days of the session.

“Our collective efforts brought forth legislation that not only reflects our commitment to consumer protection from scams and identity theft but also sets a standard for the nation,” House Speaker Jill Krowinski, a Democrat, said in a statement. “It is unfortunate that so much misinformation has been spread about this bill, but we know that Big Tech and their deep pockets are fearful of no longer having unrestricted access to Vermonters’ personal information.”

More than a dozen states have comprehensive data privacy laws. When the Vermont legislature passed the bill, Caitriona Fitzgerald, deputy director of EPIC, said the legislation was "among the strongest, if not the strongest” in the country. EPIC is urging the Legislature to override the governor's veto.

“The Vermont Data Privacy Act would have provided Vermonters with meaningful privacy rights that are lacking from other state laws, and would have rightly provided them with the opportunity to enforce those rights," Fitzgerald said in a statement.

Scott said he also had concerns about the provision aimed at protecting children, saying that similar legislation in California “has already been stopped by the courts for likely First Amendment violations" and the state should await the outcome of that case.

The Vermont Kids Code Coalition said the legislation is different than California’s and is constitutionally sound.

Much of the legislation would have gone into effect in 2025. The ability for consumers to sue would have happened in 2027 and expired in 2029, with a study to look at its effectiveness and risks.