Concord Privacy News: 7/9/24

Governor Vetoes Vermont Data Privacy Legislation

What would have been the nation’s strictest state law on online data privacy met its demise earlier this month when Vermont Governor Phil Scott vetoed the Vermont Data Privacy Act, which was passed by Vermont lawmakers in May. Had it been enacted, the bill would have significantly restricted what personal data companies could collect and use, barred companies from selling consumers’ personal data, and allowed individuals to sue companies directly for collecting or sharing their sensitive data without their consent.

In his letter to the Vermont General Assembly, Governor Scott said that the bill “creates an unnecessary and avoidable level of risk.” He cited three areas of risk:

• Making Vermont “more hostile” than any other state due to the bill’s private right of action. Many companies called on the Governor to veto the bill for this reason, arguing that the law would put companies at a competitive disadvantage.
• Legal pitfalls associated with the “Kids Code” provision, which would require online children’s products to be age-appropriate, institute privacy by design and default, and be designed with kids’ best interests. The Governor noted that “similar legislation in California has already been stopped by the courts for likely First Amendment violations.”
• Mounting expenses and competitive disadvantages for small and medium-sized businesses due to other legislative mandates, such as a payroll tax, property tax increases, and a Clean Heat Standard.

While overall the Governor indicated there is too much risk involved with the Act as drafted, he voiced support for the state to adopt a version of Connecticut’s data privacy law. We expect to see this taken up in Vermont’s next legislative session, and we’ll keep you updated.

‍

Other Privacy News of Note

What You Need to Know About the Texas Data Privacy Law That Took Effect On July 1

Starting on July 1, 2024, consumers in Texas will have more control over their personal online data. The Texas Data Privacy and Security Act took effect on that day after being passed in 2023. According to a report from the Texas Tribune, the Texas Data Privacy and Security Act requires all businesses to obtain users’ consent before processing their sensitive personal data. The law also allows Texans to access any data a company has about them, delete it, or ask the company to stop collecting it for targeted advertising or to sell it. Read more.

Advocates Blast House for Holding Kids Online Safety Act ‘Hostage’

Advocates pushing for social media regulations to keep kids safe online blasted the House for cancelling a Thursday markup of the Kids Online Safety Act (KOSA) amid opposition to a separate data privacy bill also slated to be considered. Read more.