State law will continue to remain largely silent on the collection and sale of Vermonters’ sensitive personal information after elected officials again failed to reach consensus on a comprehensive data privacy bill.
The yearslong push to put guardrails on when — and how — companies can commodify key aspects of a person’s identity has taken on new urgency in Montpelier. But the tension between strict consumer protections and their potential impact on local businesses continues to thwart compromise over an issue that states are reckoning with nationwide.
Matt Schwartz, with Consumer Reports, says lack of action on data privacy issues at the federal level has “kicked off a state-by-state battle essentially over comprehensive privacy laws.”
The debate playing out in Montpelier, and in other state legislatures around the country, according to Schwartz, has enormous implications for Americans’ relationship with, and subservience to, large technology companies such as Amazon, Google and Meta.
Bradford Rep. Monique Priestley, a Democratic data privacy hawk, said that makes it all the more important that Vermont hold out for the most protective legislation possible.
“All of the ability for us to have strong data privacy protections in the United States is really at the state level right now,” Priestley said. “And honestly, we won’t have enough leverage to get the best bill across the line unless Vermonters and small businesses, medium-sized businesses, even big Vermont brands, jump in to help us.”
Many of those businesses, however, worry they’ll become innocent casualties in privacy advocates’ battle against Big Tech.
Limiting data
Data privacy is a wonky issue whose complexity requires a technological fluency that often eludes even the lawmakers who vote on the bills.
But just about everybody involved in the privacy debate agrees that Vermonters have become unwitting participants in a global data industry that generates hundreds of billions of dollars annually from the sale of people’s personal information.
Some state and federal laws touch on data privacy, but they’re mostly limited to specific sectors, regulating only the entities — hospitals, say, or banks — that hold that data. For the most part, companies can collect and sell information about your location history, your shopping purchases, the websites you’ve visited, or the social media interactions you’ve had, unencumbered by regulation.
Megan Sullivan, with the Vermont Chamber of Commerce, said businesses are generally on board with the need for stricter government oversight.
“We are advocating at this point for a bill that will add regulation to Vermont’s business community, and that’s a challenging position to be in,” Sullivan said.
The dilemma is how to craft policy that minimizes the amount of consumer information that’s collected and sold without gumming up the works for Vermont companies who, by virtue of targeted online advertising and other 21st-century business imperatives, find themselves participating in the data-trafficking industry.
What companies are allowed to do with Vermonters’ most sensitive information — health and biometric data, for instance — has become one key point of contention in Montpelier.
“If you think of the most sensitive things that you probably don’t share with the average person when you’re walking down the street, that is the stuff that we’re trying to protect,” Priestley said.
“If you think of the most sensitive things that you probably don’t share with the average person when you’re walking down the street, that is the stuff that we’re trying to protect.”Bradford Rep. Monique Priestley
A bill approved by the Senate, modeled after a law in Connecticut, would allow for the purchase and sale of that data only if consumers give their consent.
Josh Diamond, a lawyer who represents the Vermont Chamber of Commerce, said the Senate’s approach offered clarity and transparency.
“A consumer knows they have the right to identify what data is being collected. They have the right to receive copies of that data. They have the right to correct that data, to delete that data or to even opt out of that data being utilized,” Diamond said.
And some lawmakers have made the case that tech companies’ ability to harvest a consumer’s data — with their permission — can improve the quality of the service they provide.
Chittenden County Sen. Thomas Chittenden, a Democrat, pointed to his own use of Google Gemini. “It knows a lot about me, because it’s integrated with my Google account and what I do,” he said. “So it has a much better context of what I’m asking, how I’m asking it, how to support my request.”
Others are more skeptical.
Schwartz said a Consumer Reports evaluation of such opt-out laws in other states “did not give us a high degree of confidence that these provisions are actually helping people.” It can be difficult for even tech-savvy consumers to navigate voluminous corporate privacy agreements, which sometimes require data sharing in order to gain access to platforms and services, he said.
The Vermont House took a stricter approach, putting forth a bill that would outright ban the collection of sensitive personal data.
It also sought to limit the scope of data that companies can “scrape” online. Businesses would be permitted to collect only data that is “reasonably necessary and proportionate” to their needs.
But businesses say that proposed standard doesn’t exist in state or federal law, and that, since courts have yet to weigh in on what “reasonably necessary and proportionate” means, companies would be flying blind.
“Navigating those concepts are going to put businesses at risk, because we don’t know where those clear lines are,” Diamond said.
Lobbyists representing the largest technology companies — Google, Amazon, Meta — have been working in Montpelier to kill the stricter data privacy provisions. But local companies and nonprofit organizations are sounding the alarm as well.
Molly Mahar, president of the Vermont Ski Areas Association, told Senate lawmakers earlier this year that the adoption of a “subjective gray area” would “put our businesses at unnecessary legal risk.”
A coalition of health care organizations said the stricter privacy provisions would add redundancies to their obligations under federal law, and force smaller entities to undertake a costly “legal and operational analysis.”
Jim Hall, president and CEO of the Vermont Country Store, said the House’s approach would endanger businesses such as his that have “pivoted to digital advertising as the most cost-effective way to sustain and grow our business.”
To sue or not to sue?
No issue has garnered more controversy than whether or not Vermont should let individuals sue companies that violate whatever privacy law the state ends up enacting.
Vermont would be the first state in the country to include a so-called “private right of action” in a comprehensive data privacy law. Chittenden said he worries doing so would expose business to frivolous lawsuits for technical violations.
“I’m not sure people realize that when we strip consumers of that right to sue when they’re harmed, there’s not going to be a gap that is filled by someone else.”Attorney General Charity Clark
“I see it as just creating a lot more opportunities to make it more difficult to operate a business in Vermont,” he said.
He suggested the state attorney general would be better positioned to enforce compliance.
Attorney General Charity Clark, however, said her office doesn’t have the resources, or often the standing, to file suit on behalf of residents who suffer harm when corporations misuse their personal information. Her office has been advocating in Montpelier to include the private right of action.
“I think maybe not everybody understands, the attorney general does not represent people, the attorney general only represents the state,” Clark said. “I’m not sure people realize that when we strip consumers of that right to sue when they’re harmed, there’s not going to be a gap that is filled by someone else.”
A majority of lawmakers, as well as Republican Gov. Phil Scott, are so far taking their cue from business organizations such as the Vermont Chamber of Commerce, and Vermont companies, including Burton and the Vermont Country Store, who say the private right of action would pose an undue threat.
To be continued
Last year, the Democrat-controlled Legislature managed to pass a data privacy law that included both a private right of action and a ban on the sale of sensitive personal information. But Scott vetoed the bill, and lawmakers were unable to override him.
Vermont’s Republican governor said he supports strong data privacy legislation, but he said it should be compatible with other states’ laws. Privacy advocates counter that those laws haven’t done nearly enough to check Big Tech’s power over consumers, making it imperative that states like Vermont do something different.
So, instead of sending the governor a bill that meets his benchmarks, Priestley and other House lawmakers will spend the summer trying to convince the business community that their proposal actually protects local companies from being subsumed by large national corporations. They’ll also be working with lawmakers in Massachusetts and Maine to coordinate a multi-state approach to a new data privacy standard.
Coventry Rep. Mike Marcotte, a Republican and a small business owner, has, as the chair of the House Committee on Commerce and Economic Development, been following the issue closely for the past two legislative biennia.
He said lobbyists representing Google, Meta and Amazon have used “fearmongering” to turn Vermont businesses and lawmakers against the House proposal.
“I think Big Tech is driving the bus on this one,” he said.
He said once more businesses, and voters, appreciate the threat posed by Big Tech, the more amenable they’ll be to stricter privacy regulations.
“It’s good for us to take a break,” he said, “and see where we can work together to try to put something together that everybody can support.”
