Vt. Chamber Seeks 'Regionally Compatible' Privacy Bill at Hearing

“Consumer remedies are a good thing,” argued Clark, who previously endorsed including a private right of action (see 2501270025). She cautioned legislators not to conflate the PRA in S-71 with one in the Illinois Biometric Information Privacy Act (BIPA), a state law commonly pointed to by industry to support arguments that PRAs lead to too many lawsuits, she said. BIPA’s private right provided for statutory damages, which is a “different animal” from the actual damages provided by S-71, said Clark.

Vermont could have the first comprehensive privacy law with a PRA if it enacts S-71 as written. The legislature last year approved a similar measure, also including a PRA, but Gov. Phil Scott (R) vetoed the bill including it because he was concerned about making Vermont an outlier. Rep. Monique Priestley (D), who authored S-71’s House twin H-208, edited but didn’t scrap the PRA in her 2025 bill (see 2502130013); Clark has strongly supported including the right

Meanwhile, Vermont Sen. Thomas Chittenden (D) last month introduced the alternative S-93 without a PRA, among other differences. Soon after its introduction, Priestley criticized S-93 as too weak (see 2502280035).

“If the average Vermonter knew what I knew about data privacy, they would be activists,” Clark said at Tuesday’s hearing. Vermont was the first state to pass a data broker registration law, “but since that time, we've lagged behind," she said.

At the same time, AI is ushering in an era that makes it even more critical for Vermont to have a privacy law, said the AG. "It's important for us to get ourselves straightened out when it comes to data privacy, so that we'll be ready for new technology."

Sen. Russ Ingalls (R) questioned Clark about the potential for frivolous complaints stemming from S-71’s PRA. "When there's a private right to act,” he said, “it just opens up the lawsuits.”

“It doesn’t,” interjected Clark. “We've had a private right of action in the Consumer Protection Act for 60 years” without experiencing that issue. Also, allowing individual lawsuits helps with AG office resources, she said. “Do you want to have more staff [in] my office so that we can make sure that we’re bringing those actions?” she asked. “Should taxpayers be paying for more lawyers to bring those lawsuits?”

The Vermont Chamber pushed back against Clark’s argument. "The idea that the private right of action hasn't been used in this way, I don't think accurately reflects what our business community has experienced," said Megan Sullivan, government affairs vice president. "It is a real challenge, and it is costing our businesses a lot of money.” Sen. Robert Plunkett (D) asked Sullivan if she could provide data to back up that claim. Ingalls intervened to say he could provide examples.

Dinse’s Joshua Diamond, outside counsel for the Chamber, said the PRA and other differences between S-71 and other New England privacy laws will be hard on small businesses. They “don't have access to in-house IT professionals and don't have specialized counsel, much less general counsel, to help them navigate these very technical requirements with potentially the threat of private action,” he said.

Diamond disagreed with Clark, dismissing concerns related to the Illinois BIPA. "There are liquidated damages that are available under S-71 that are very similar to Illinois,” said the business lawyer. “It talks expressly about either $5,000 or actual damages, but it doesn't stop there. There's injunctive relief, which is something that's typically left to the attorney general's office in their enforcement.” Additionally, S-71 would provide “punitive damages on top of that liquidated damage for intentional violations."

Authorizing AG enforcement only, as in the alternative S-93, “effectively creates a deterrent for bad acts,” argued Diamond. “Vermont consumers can be protected without the private right of action.”

Sullivan asked the committee to remember why the governor vetoed last year’s Vermont privacy bill. She said Scott was clear that he would sign “a bill that is regionally compatible without a private right of action.”

The debate between rival privacy bills left Sen. Joe Major (D) pondering. “Even though I'm a co-sponsor" of S-71, he said, "I just don't know at this point" which bill "is the best for consumers."

The Institutions Committee is scheduled to hear more testimony on S-71 on Wednesday and Thursday. Chair Wendy Harrison (D) said the committee would also consider S-93 on Wednesday.