This commentary is by Rep. Michael Marcotte, R-Coventry; Rep. Stephanie Jerome, D-Brandon and Rep. Monique Priestley, D-Bradford — chair, vice chair and clerk of the Vermont House Committee on Commerce & Economic Development.
Everything we do and say online is cataloged every moment of every day of our lives. Sometimes we know what’s being collected and tracked, but we decide to trade permission for convenience. Most of the time, we don’t even realize what is being collected, exchanged, or sold. Without thoughtful measures, we leave gaps that can be exploited, undermining the very protections we seek to establish. With a strong nonpartisan bill (H.121), Vermont has the opportunity to safeguard our personal freedoms and to secure a future where data privacy is not just a privilege, but a fundamental right.
We take consumer protection seriously, while also striking a balance with providing a supportive environment for businesses to thrive. In developing H.121, the legislature has worked closely with privacy experts across the country who helped inform our work. Because of the wide range of organizations collecting, using, sharing and selling people’s data, it was important to work with a variety of partners including businesses, non-profits, privacy experts, compliance consultants, law professors, attorneys general, privacy advocates, business advocates and legislators from states of all sizes.
Businesses interact with Vermonters on a constant basis, collecting thousands of data points daily. We listened to concerns voiced by businesses both operating in, as well as, based in Vermont. As a result, we built in provisions to help businesses follow proposed regulations geared toward responsible data collection and management. This includes educational resources that will be provided by the Attorney General’s office, a one-year delay on the bill’s effective date, and a threshold applying to businesses that process the data of 25,000 or more Vermonters annually.
Vermonters have a long-standing constitutional right to a private right of action (PRA), or a right to sue. We listened to the Vermont business community and crafted a PRA that fits Vermont businesses, limiting the scope to data brokers (businesses focused on selling your data) as well as organizations that process the data of 100,000 Vermonters or more annually. In addition, this right to sue will only apply to violations involving sensitive data (such as DNA, Social Security numbers, location, fingerprints, eye scans, consumer health information). We removed monetary damages, we delayed the PRA by two years, we added an expiration, and we committed to studying its effectiveness. In addition, organizations have a 60-day window in which to fix potential violations. We want businesses to succeed while respecting Vermonters’ personal data and their right to understand and control how it is used.
A business should only collect Vermonters’ data that’s needed to conduct its business. If a business collects Vermonters’ sensitive data, it needs to be held to higher standards. Our bill clearly puts responsible practice at the forefront of interactions with Vermonters while broadening the ways businesses may use data, once they have it, for activities such as advertising, email lists, and catalog mailings.
At a time when we are constantly connected, we must champion protections that keep Vermonters and their loved ones safe. Vermonters are currently not protected by a comprehensive data protection act of any kind. The Commerce Committee spent hundreds of hours working on a bill that balances strong consumer protection with business operations.
We listened to the concerns of the Vermont business community, such as the CEO of Vermont Country Store, who also serves as the Board Chair of the American Commerce Marketing Association. ACMA is a lobbyist organization aimed at stopping states from passing data privacy legislation and has a history of partnering with NetChoice, a lobbying organization that represents members such as Amazon, Google and Meta. NetChoice recently wrote a letter to the governor urging him to veto H.121. Despite responsible changes made to respond to and accommodate the business community, we continue to face opposition to our common-sense consumer protections for Vermonters.
We have never seen such a strong national lobbying effort in our statehouse – all working against our basic consumer protections and constitutional rights. Despite intense lobbying efforts to water down our data privacy and childrens’ online safety act, H.121 passed out of the Vermont House of Representatives (139-0) with overwhelming support amongst Republicans, Democrats, Progressives and Independents. It represents a thorough compromise that protects Vermonters, holds businesses to responsible data practices over time and provides a mechanism to keep large businesses accountable if they violate Vermonters’ rights.
We are confident that Gov. Scott will recognize the manipulation of national misinformation campaigns and see that we have provided a strong balance between protecting Vermonters and addressing the needs of Vermont’s business community.
Read the story on VTDigger here: Reps. Michael Marcotte, Stephanie Jerome and Monique Priestley: The Data Privacy Act balances Vermonters’ personal privacy with business operations.