Private Right of Action Stripped from Vt. Privacy Bill; 'More Review to Come'
As the Vermont Senate Institutions Committee cleared a comprehensive privacy bill (S-71) in a 5-0 vote Friday, Chair Wendy Harrison (D) reminded colleagues that the legislature is in the “middle of the process.” A day earlier, the panel replaced the legislation's language with that of an industry-favored bill (S-93), which consumer privacy advocates have called weak (see 2503130053).
Sign up for a free preview to unlock the rest of this article
Before the livestreamed vote, Vermont Legislative Counsel Rik Seghal cautioned the committee it might not have had enough time to weigh the bills against each other. While similar in many ways, the bills' differences are critical, "and I fear that you don't know enough about it."
“It's not the end of the process, so there's more review to come,” Harrison said. “And if it does go through the House, it will likely come back to us.”
As amended, the bill looks much like Connecticut’s privacy law and, critically, doesn’t contain a private right of action like the original Vermont bill. However, there’s still time in Vermont’s legislative process to change course. If the Senate passes S-71, it will go to the House, where Rep. Monique Priestley's (D) bill (H-208), identical to the pre-amended S-71, remains pending.
If the Senate passes S-71, it’s expected that the House Commerce Committee, of which Priestley is a member, would next consider S-71. If that committee were to amend the bill, for example, to revive the original language, and the full House were to pass that, the measure would return to the Senate. At that point, the Senate could either re-amend the bill and send it back to the House or ask for a conference with the House to deliberate on a final version.
“I am committed to passing a strong bill with widespread public approval," Priestley (D) told us Friday before the Institutions Committee meeting.
While Consumer Reports prefers the original S-71, "we thank the committee for their continued focus on this issue and will continue to advocate for improvements as this bill moves through the additional legislative steps," CR Policy Analyst Matt Schwartz said in an email.
It was clear from testimony earlier this week that S-93 was “more palatable” to many witnesses than S-71, Sen. Joe Major (D) remarked at the Institutions Committee meeting Friday.
Earlier Friday, the committee heard testimony from three witnesses who sounded relieved it had replaced S-71 with S-93.
The private right of action proposed by S-71 before it was amended “would have immediate impacts on businesses via increased insurance costs tied to increased liability," said Robbie Adler, chief strategy officer for Faraday, a Vermont startup. Also, he supported S-93’s higher application thresholds that say a covered entity must possess data of at least 100,000 consumers, compared to 25,000 in S-71.
Scout Digital President Nathaniel White-Joyal agreed 25,000 is too low, saying that could restrict small businesses’ ability to use digital ads to find customers.
S-93 fairly and reasonably balances consumer and business interests, said Mary Hayden, Vermont Association of Area Agencies on Aging executive director. The association’s members, who already must comply with the Health Insurance Portability and Accountability Act (HIPAA), are under a “dark cloud” due to potential federal cuts to Medicare and Medicaid and underfunding due to Congress' continuing-resolution "budgeting preference,” she said.
"We are really hurting,” said Hayden, “so we are unclear on why we could be required to ... devote resources to creating a whole separate level of compliance when we are already complying with HIPAA and protecting all of our clients' data."