The Vermont Chamber and business leaders testified this week on the importance of balancing consumer protection with support for businesses. They emphasized the need for policymakers to ensure equitable and effective data privacy legislation by addressing the following areas of concern:

1. Private Right of Action: Jim Hall, President and CEO of The Vermont Country Store gave a first-hand account of how a private right of action in privacy laws can lead to frivolous lawsuits against small businesses. A shakedown lawsuit over a California law previously cost The Vermont Country Store $100,000 over $2,000 worth of product sold.
2. Regional Compatibility: If passed in its current form, the bill would make Vermont an outlier and complicate the ability of businesses to operate within its mandates.
3. Business Education: Vermont will require a robust education plan involving Vermont’s trusted technical assistance providers to adapt to a new law. Trusted technical assistance providers need the resources and time to assist businesses through this transition.

The Senate Economic Development, Housing, and General Affairs Committee has shown that they are open to addressing the concerns of Vermont businesses, and we encourage you to contact your Senators to help ensure that they amend the legislation to be more balanced. 

The Vermont Chamber will continue to advocate for:

Removal of the Private Right of Action – The inclusion of a specific private right of action for data privacy violations poses significant risks of increased litigation, straining businesses and potentially enabling opportunistic legal actions akin to patent trolling. Empowering and supporting the Attorney General to enforce data privacy laws directly offers a more efficient path to protecting consumer interests without the potential consequences associated with a broad private right of action provision. Last month, a coalition of fourteen Vermont businesses and non-profit organizations sent a letter expressing their concerns about the bill’s private right of action.

Regional Compatibility – The version of the bill passed by the House strayed from regional compatibility, which, if passed, would make Vermont an outlier and complicate the ability of businesses to operate within its mandates. The Information Technology and Innovation Foundation projects that the absence of federal privacy legislation would burden U.S. small businesses with a $20–23 billion annual cost.

A Robust Education Plan – A 2019 California Attorney General’s report estimated initial compliance costs for small businesses at $50,000 and for mid-sized businesses at $100,000, excluding ongoing costs, which may vary depending on interstate compatibility. Amid significant concerns regarding businesses’ ability to comprehend and navigate these complex requirements, Vermont will require a robust education plan involving Vermont’s trusted technical assistance providers.