Privacy Please

On May 10, 2024, Vermont’s legislature passed a comprehensive data privacy law that exposes companies to consumer litigation not just for data breaches, but also any violation of consumer data privacy rights under the statute. The legislation would also prohibit the sale of sensitive data.

While many states have data privacy laws that allow consumers to sue companies after data breaches, wherein their data was shared improperly or accessed by a bad actor, Vermont’s bill also allows consumers to file lawsuits for broader misuse.

If enacted, companies primarily engaged in the sale of data or those processing more than 100,000 Vermont consumer records a year could be sued by individual consumers, or consumers as a class, for alleged misuse of their data, including the improper collection or sale of data. Gov. Phil Scott is said to be considering a veto because of the inclusion of that private right of action. However, if signed, the consumer’s right to sue will only be in effect between 2026 and 2028, the results of which will be studied to allow lawmakers to consider its effectiveness before extending or making it permanent.

Also notable is that Vermont’s law included “data minimization” provisions that limit what data companies can gather, use, or sell and allows customers to opt out of targeted advertising. As Congress debates a federal data privacy law, the inclusion of data minimization has become a contentious issue. Advocates claim that minimizing the data held is the best way to combat and limit the impact of cybercrimes. Though corporate lobbyists warn data minimization would significantly and negatively impact marketing and online sales.

This article originally appeared on Freeman Mathis & Gary, LLP. 

About the Author:

Courtney Knight is an associate at Freeman Mathis & Gary, LLP. courtney.knight@fmglaw.com