Updated Vt. Comprehensive Privacy Bill Surfaces Ahead of Summer Talks

The amendment to S-71 resets the Senate-passed bill, which contained language that industry favored, to something more like Priestley’s original, which included controversial private right of action and data-minimization requirements.

However, under Friday’s amendment, it no longer includes a year-by-year step down in applicability thresholds, which would have expanded how many businesses are covered by the proposed law one or two years after it takes effect. The amended bill would say that the legislation applies to Vermont businesses that control or process the personal data of at least 25,000 consumers, or at least 12,500 consumers, while deriving more than 25% of gross revenue from selling data.

The amended bill would still include a private right of action but now would only allow individuals to sue companies with annual revenue of $500 million or more, a significant increase from the $25 million threshold in Priestley’s original bill. Under another change, the bill would now define a large data holder as an entity that processes personal data of at least 200,000 Vermonters, up from 100,000 in the original.

In a section on data brokers, the amendment adds that a consumer has a “direct relationship” with a company if the consumer “has intentionally interacted with a business for the purpose of accessing, purchasing, using, requesting, or obtaining information about the business’s products or services.” And it provides examples of what is and isn’t a direct relationship.

Among other changes, the amendment matches the definition of publicly available information with the one in the Vermont kids code bill that the legislature passed on Thursday (see 2505290036).