Senate advances Vermont Data Privacy Act to third reading after rejecting broader private right of action

The Senate advanced H.121, a comprehensive consumer data-privacy bill styled as the Vermont Data Privacy Act, to third reading after adopting the Economic Development, Housing and General Affairs Committee's report as amended and rejecting a separate proposal to create a broader private right of action for misuse of sensitive data.

Supporters said the bill would extend longstanding state data-broker rules and give Vermonters explicit rights over personal data, including confirmation and access, correction, deletion, portability and an opt-out from targeted advertising and profiling. "Passage of this bill would give us one of the strongest data privacy laws in the country," the senator presenting the committee report told the Senate as she summarized the bill's scope and exemptions.

The measure applies to entities that conduct business or target services to Vermonters and that either controlled or processed the personal data of at least 25,000 Vermonters during the prior calendar year or derived more than 50% of gross revenue from sale of personal data. The bill directs controllers to provide clear privacy notices, limits data processing to what is reasonably necessary, requires data-security practices, and establishes procedures for consumers to exercise rights. It includes special protections for minors and heightened rules for consumer health data, such as prohibiting sale of that data without consent and banning use of geofencing to identify people seeking medical care.

Enforcement and the private-right debate

Under the committee's report, enforcement authority rests with the Attorney General, who may issue notices of violation and allow a cure period when appropriate. Health-related provisions in the amendment also sought to exempt HIPAA-covered entities or HIPAA-regulated components of hybrid entities so healthcare providers would not be unintentionally swept into the statute.

A key area of floor contention was a proposed fourth-instance amendment that would have created a private right of action linked to Vermont's Consumer Protection Act for certain misuses of health and biometric data. Proponents from the Health and Welfare Committee described a narrow private-right approach tied to an existing consumer statute and including a cure period designed to limit frivolous suits. "We thought this was an appropriate compromise that it narrows it significantly enough and it runs it through existing law," a senator supporting the amendment said during floor debate.

Opponents warned the private right of action could invite predatory litigation against small businesses, nonprofits and health care providers, citing experience in other states under the Illinois Biometric Information Privacy Act (BIPA). One senator said business owners and nonprofit leaders had testified that private suits had threatened operations in other jurisdictions. On a roll-call vote recorded on the floor, the fourth instance failed: 13 yays, 16 nays.

Votes and next steps

After the fourth instance failed, senators voted on the remaining instances and adopted the committee report as amended (excluding the failed fourth instance) and then ordered the bill read a third time. The presiding officer reported voice votes for the adoption of the amended report and the third reading.

If enacted, the bill phases in parts of the law: expansion of the Artificial Intelligence and Data Privacy Advisory Council would take effect July 1, 2024, and the Vermont Data Privacy Act's data-broker provisions would take effect July 1, 2025, under the committee-reported timing.

The Senate also handled a set of procedural motions before the H.121 debate, including suspending rules so that H.585 would remain on the calendar for notice rather than be referred to Appropriations and relieving Appropriations of H.702 and referring it to Judiciary. The chamber recessed and scheduled additional sessions for later in the day.

The Senate transcript records repeated assurances that further technical changes and committee jurisdictional adjustments could be addressed at third reading; senators signaled they expected to continue amendment work and messaging to the House before final passage.