Vermont AG Calls for Private Right of Action in State Privacy Bill
"A strong data privacy bill must include a private right of action to allow … individuals to bring a lawsuit when they suffer actual damages,” Vermont Attorney General Charity Clark (D) said Monday. At a livestreamed press conference, Clark supported state Rep. Monique Priestley (D) in reintroducing a privacy bill that Gov. Phil Scott (R) vetoed last year. Priestley said the 2025 bill will also include data minimization rules, despite business concerns stemming from Maryland’s law, which includes such requirements.
Sign up for a free preview to unlock the rest of this article
Vermonters’ data is “exploited for profit” by businesses, hurting consumers through “opaque data processes and algorithmic collusion,” Priestley said. In an interview with Privacy Daily earlier this month, Priestly said she would reintroduce her privacy bill in 2025, with specific sections from the 2024 measure on child protections and data brokers spun off into separate bills (see 2412300043). Priestley said then that it was important to keep a private right of action (PRA), even though the governor said last year that he didn’t want to make Vermont a national outlier.
“If your data privacy is violated, and you suffer damages, you should be able to sue the company who violated your data privacy,” said Clark. “The attorney general represents the state and the public interest, but we cannot represent individual people. A strong data privacy bill must include a private right of action to allow those individuals to bring a lawsuit when they suffer actual damages.”
Vermont includes a PRA in its consumer protection law, noted Clark. “I don’t think Vermonters want that right taken away ... when they suffer actual damages if their data privacy is violated.” Clark supported last year’s privacy bill, which limited the PRA to sensitive data, actual damages and exempted small businesses.
The AG committed to working with the Scott administration, the legislature and others to pass the privacy bill. It’s “incredibly disturbing” that Vermont still lacks such a law, considering that the AG office received 724 data breach notifications in 2024, she said.
Data minimization rules are another key part of the state rep’s forthcoming privacy bill. “Companies should only collect the data they absolutely need to provide their services, not everything under the sun,” Priestley said. In addition, the legislation aims to “fix the broken online advertising system so that small businesses can compete and thrive without being forced to participate in a system that rewards the exploitation of personal data.” Also, Vermont must “ban the sale of sensitive data,” she said. “Hard stop.”