Vt. Privacy Bill Sponsor Battles 'Intense Lobbying' Against Private Right of Action
Legislators from other states have told Vermont Rep. Monique Priestley (D) that they'd like to see someone enact a comprehensive privacy law with a private right of action (PRA), Priestley said in a livestreamed interview Tuesday with Daniel Solove, a George Washington University Law School professor.
Sign up for a free preview to unlock the rest of this article
Other states “are not necessarily adding PRAs to their laws,” said Priestley. However, their legislators who are active in privacy have told the Vermont rep “we need someone to do it,” she said. It's one reason why Priestley said she's fought for the past two years to keep a PRA in her privacy bill, H-208.
Last week, a Vermont Senate committee stripped the PRA from a bill (S-71) that was originally a copy of H-208 (see 2503140056 and 2503130053). The legislation is expected to get a full Senate vote as soon as this week. However, if S-71 passes the Senate and comes to the House, "we would aim to make things stronger," said Priestley: That could set up a situation where the House and Senate can "go to a conference and negotiate to the middle.”
Priestley said she faced “intense lobbying” to defeat her 2024 privacy bill, which passed the legislature but was vetoed by Gov. Phil Scott (R). The lawmaker estimated that lobbyists spent at least $1 million fighting it. The PRA was the most controversial piece, said Priestley. “There's a reason that it's the most lobbied … poison pill piece of a bill,” she said. “It's also the thing that will actually have teeth and hold people accountable.”
The House last year voted to override Scott’s veto, noted Priestley. But the night before the Senate was to vote on the override attempt, “I got a call from lobbyists that said that they had six of our Democratic senators rolled to vote against the bill unless I took out the PRA. I said no.”
Priestley modified the PRA for 2025’s bill. For example, to address concerns that the PRA could result in many frivolous lawsuits, this year’s bill says that complaints are limited to data brokers with at least $25 million in annual revenue, she said. Solove pushed back on including that threshold, asking if it could let smaller companies off the hook if they violate people’s privacy.
The $25 million threshold “leave[s] a gap,” Priestly conceded. However, “if we were able to … get any of this through, then it’s a starting point.” For example, if after the bill becomes law, the attorney general reports on what complaints it's receiving, “there’s always room to evolve that.”
The current Trump administration's activities have increased people’s awareness about the importance of protecting health data that could be used against them, said Priestley. Moreover, the Democrat added that federal government firings have increased people's focus on finding ways to protect employees.
That said, as with most state privacy laws, the proposed Vermont privacy measure would exempt government. "I don't know at what point there's political give to have the governments covered,” said Priestley. “I don't know if we're there yet.”