Business voices played a crucial role in ensuring an extreme data privacy bill, in its current form, did not become law. While businesses support comprehensive consumer data privacy legislation, H.121 was rife with provisions that lacked clarity and would have unintended consequences for businesses, consumers, and the Vermont economy. The Governor and Senators listened to their constituent businesses on this issue and voted accordingly so an improved bill can be passed in the next biennium.

Earlier this session, when Vermont businesses tried to provide input during the policymaking process, they were dismissed by some politicians as misinformed or as being influenced by big tech. However, a bipartisan group of fifteen Senators decisively rejected that misleading narrative and voted to uphold the veto, deciding to pump the breaks and return to the drawing board. See how your Senators voted, here and how your Representatives voted, here. On the floor, Senator Christopher Bray (D-Addison) stated, “The uniformity of the concerns that I heard from the business community made me re-read and ask questions…there is so much uncertainty in [H.121] that it has Vermont businesses deeply concerned about the consequences of enactment… there is wisdom in pausing when you find that the work you have done, no matter how well intention, may have negative consequences.” Senator Ann Cummings (D-Washington), who also voted to uphold the veto, stated, “We need to make sure the business community supports this… We need to make sure we get this right because it is a very serious issue.”

The outpouring of feedback from Vermont businesses in recent weeks no doubt played a key role in securing this result. The successful veto of H.121 means that a more balanced bill can now be crafted in a future session. The Vermont Chamber is committed to working with legislators in the next biennium to pass an improved bill that aligns with neighboring states via a process that respects all voices at the table.

H.121, a data privacy bill passed by the legislature and vetoed by Governor Scott, is a well-intentioned attempt to protect consumers’ personal data that misses the mark. In its current form, this bill will create major problems for Vermont’s businesses, consumers, and economy. Our organizations strongly support comprehensive data privacy legislation, but H.121 goes far beyond the measures adopted in neighboring states like Connecticut and New Hampshire, which we support as workable models. H.121 goes far beyond these measures and would make it harder for businesses to serve their Vermont customers than to serve those in other states. 

Unfortunately, when Vermont businesses tried to provide input throughout this policy-making process, they were routinely dismissed by some in the legislature as misinformed or as being influenced by big tech. This is an inaccurate characterization. Further, it has had a chilling effect on the ability of Vermont businesses to engage in the legislative process for fear of being villainized and of ramifications for their businesses. 

This bill will put Vermont businesses at a serious disadvantage, making them less competitive than businesses in other states, raising their marketing and compliance costs, and exposing them to potential legal battles. H.121, as passed by the Legislature, is unworkable. It threatens the survival of many local businesses and would put a serious dent in the Vermont economy.

H.121 could also spell the end of loyalty and other programs that many Vermonters benefit from. These programs, like airline miles, hotel and credit card points, multi-mountain ski passes, savings on gasoline, and more, are all at risk. Under the new law, it would be too difficult, expensive, and risky for businesses to continue offering these programs and benefits to Vermonters.

Unfortunately, H.121 is not balanced legislation. Vermont should join our neighboring statesby adopting a comprehensive privacy law that creates regional alignment. This would protect consumers and hold bad actors responsible while helping businesses to comply. H.121 as drafted, does not accomplish this. The 105-page document is rife with provisions that lack clarity and will lead to unintended consequences.

We urge legislators to support Governor Scott’s veto of H.121 and return next year to work on creating a better bill. Vermont can have strong privacy laws that protect consumers without hurting local businesses. Let’s find a solution that works for everyone.

Signed,

Associated Industries of Vermont

Central Vermont Chamber of Commerce

Heating and Cooling Contractors of Vermont

Vermont Association of Broadcasters

Vermont Chamber of Commerce

Vermont Fuel Dealers Association

Vermont Independent Restaurants

Vermont Retail and Grocers Association

Vermont Ski Areas Association

Vermont Technology Alliance

Vermont Vehicle and Automotive Distributors Association

Vital changes were made by the Senate Economic Development, Housing, and General Affairs Committee before they unanimously passed the data privacy bill. The legislation is now a strong consumer privacy bill without placing an undue burden on Vermont businesses. In particular, the committee removed the controversial private right of action which would result in collateral damage of rampant litigation placing undue strain on businesses and non-profits of all sizes. It instead asks a technology-based state council under the purview of the Agency of Digital Services to look into a path forward. Additionally, the bill brings it back to a place of interoperability with other New England state data privacy laws. The bill will likely be on the Senate floor for a vote next week.

Businesses testified in the House Commerce and Economic Development Committee on the importance of the Senate changes. Jim Hall, CEO of the Vermont Country Store, stated that the House-passed version of the bill would effectively slow down the economy. We encourage more businesses to reach out to their House and Senate members and ask them to support that bill as it has been amended by the Senate Economic Development, Housing, and General Affairs Committee.

The Vermont Chamber and business leaders testified this week on the importance of balancing consumer protection with support for businesses. They emphasized the need for policymakers to ensure equitable and effective data privacy legislation by addressing the following areas of concern:

1. Private Right of Action: Jim Hall, President and CEO of The Vermont Country Store gave a first-hand account of how a private right of action in privacy laws can lead to frivolous lawsuits against small businesses. A shakedown lawsuit over a California law previously cost The Vermont Country Store $100,000 over $2,000 worth of product sold.
2. Regional Compatibility: If passed in its current form, the bill would make Vermont an outlier and complicate the ability of businesses to operate within its mandates.
3. Business Education: Vermont will require a robust education plan involving Vermont’s trusted technical assistance providers to adapt to a new law. Trusted technical assistance providers need the resources and time to assist businesses through this transition.

The Senate Economic Development, Housing, and General Affairs Committee has shown that they are open to addressing the concerns of Vermont businesses, and we encourage you to contact your Senators to help ensure that they amend the legislation to be more balanced. 

The Vermont Chamber will continue to advocate for:

Removal of the Private Right of Action – The inclusion of a specific private right of action for data privacy violations poses significant risks of increased litigation, straining businesses and potentially enabling opportunistic legal actions akin to patent trolling. Empowering and supporting the Attorney General to enforce data privacy laws directly offers a more efficient path to protecting consumer interests without the potential consequences associated with a broad private right of action provision. Last month, a coalition of fourteen Vermont businesses and non-profit organizations sent a letter expressing their concerns about the bill’s private right of action.

Regional Compatibility – The version of the bill passed by the House strayed from regional compatibility, which, if passed, would make Vermont an outlier and complicate the ability of businesses to operate within its mandates. The Information Technology and Innovation Foundation projects that the absence of federal privacy legislation would burden U.S. small businesses with a $20–23 billion annual cost.

A Robust Education Plan – A 2019 California Attorney General’s report estimated initial compliance costs for small businesses at $50,000 and for mid-sized businesses at $100,000, excluding ongoing costs, which may vary depending on interstate compatibility. Amid significant concerns regarding businesses’ ability to comprehend and navigate these complex requirements, Vermont will require a robust education plan involving Vermont’s trusted technical assistance providers.  

A bill that started as closely mirroring the existing data privacy laws of neighboring states has undergone several changes in recent weeks. These changes have sparked concerns regarding its jurisdiction and the potential of making Vermont an outlier rather than keeping it regionally aligned. The bill, which is expected to pass the House Commerce and Economic Development Committee this afternoon, includes a private right of action. The Vermont Chamber testified on the increased risk of litigation and the challenges Vermont businesses may face in understanding and implementing these new changes. The Vermont Chamber will continue our efforts to address these concerns for businesses throughout the session.

Before the Town Meeting Day break, a coalition of fourteen Vermont businesses and non-profit organizations sent a letter to the committee expressing their concerns about the bill’s private right of action. They suggested that alternative measures should be prioritized, focusing on prevention, remediation, and robust enforcement through mechanisms such as empowering the Attorney General’s Office. The Vermont Chamber will continue advocating for measures that prioritize prevention, and remediation, and ensure that businesses are informed and have access to technical assistance to comply with these significant regulations.

A coalition of Vermont businesses and non-profit organizations sent a letter to the House Commerce and Economic Development Committee to raise concerns over the private right of action included in a consumer privacy bill that the committee is focusing on this session. The Vermont Chamber continues to raise business concerns related to anticipated consequences that could come from the significant unfunded mandates on Vermont businesses and non-profits (notably, the state government is now exempted from these mandates). Specifically, concerns that privacy violation allegations may lead to increased litigation that strain businesses, especially smaller enterprises that are crucial to Vermont’s economy. 

The letter, sent on Monday, February 26, stated: 

Dear Chair Marcotte and House Commerce & Economic Development Committee Members, 

As we navigate the complexities of enhancing data privacy laws in Vermont, our organizations that represent Vermont businesses, non-profits, and trade associations, find ourselves at a pivotal juncture. The proposed data privacy bill, specifically its private right of action provisions, presents a significant concern that could inadvertently exacerbate the challenges facing our state’s economy and business and non-profit communities. 

The introduction of a specific private right of action for data privacy violations risks ushering in a new era of litigiousness that our state is ill-prepared to absorb. While well-intentioned in its aim to protect consumer rights, experience from other jurisdictions tells a cautionary tale: such provisions invariably lead to a surge in litigation, placing undue strain on businesses and non-profits of all sizes, but most acutely on the small enterprises that form the backbone of Vermont’s economy. 

These legal threats do not necessarily advance consumer protection. Instead, they divert critical resources away from innovation and growth, creating an environment of uncertainty that disproportionately challenges local businesses and non-profits. This is not merely a hypothetical scenario, it is a tangible risk that could undermine our collective efforts to foster a vibrant, innovative, economic landscape in Vermont that respects consumer rights. 

While we recognize the importance of providing businesses with an opportunity to rectify potential violations, and the committee’s attempts to do this through the proposed right-to-cure period, we believe that alternative mechanisms, such as enhanced enforcement measures through the Attorney General’s Office, may offer a more effective and efficient means of achieving the dual objectives of protecting consumer interests and supporting economic growth. 

In light of these considerations, we urge a recalibration of this proposed section of bill H.121 to focus on measures that prioritize prevention, remediation, and robust enforcement through our state’s legal frameworks and strengthening the Attorney General’s Office: Empowering the Attorney General’s Office to fulfill its mission as the State’s top law enforcement agency with enhanced resources to enforce data privacy laws effectively offers a more direct and efficient path to protecting consumer interests without the collateral damage of rampant litigation. 

The committee has done extensive and important work to create a data privacy bill that will make real progress on this issue. The undersigned organizations are ready to engage in meaningful dialogue and collaborate on provisions that genuinely serve the interests of Vermonters without imposing undue risk on the businesses and organizations that drive our state’s economy. 

We appreciate your commitment to this issue and look forward to working together towards solutions that safeguard data privacy while promoting economic health and innovation in Vermont. 

Thank you for your attention and consideration. 

Sincerely, 

Vermont Chamber of Commerce 

Vermont Technology Alliance 

Common Good Vermont 

Lake Champlain Chamber 

Vermont Lodging Association 

Vermont Independent Restaurants 

Vermont Retail and Grocers Association 

Heating and Cooling Contractors of Vermont 

Vermont Fuel Dealers Association 

Vermont Ski Areas Association 

Vermont Vehicle and Automotive Distributors Association 

Vermont Specialty Food Association 

Vermont Insurance Agents Association 

Associated General Contractors of Vermont 

The legislature has introduced a new version of a data privacy bill that was discussed last year, pulling from laws in Connecticut and Oregon. The bill contains a small business exemption that will support Vermont’s smallest businesses from undue burden, but it also contains a private right of action that could lead to costly lawsuits. In the absence of comprehensive federal data privacy law, state legislatures have been passing a patchwork of different, and sometimes conflicting, laws.

These laws regulate how companies control and process personal data in an economy that is relying on it more and more. They can be important consumer protection tools but also have the potential to create confusion and challenging burdens in the marketplace. Nationally, the Information Technology and Innovation Foundation has estimated that state privacy laws could impose costs of $98 billion and $112 billion annually. Over 10 years, these costs would exceed $1 trillion. The burden on small businesses would be substantial, with U.S. small businesses bearing $20–23 billion annually.