Vermont’s new data privacy law, recently passed by the state’s legislature, has drawn attention for its groundbreaking provision that allows individuals to take legal action against companies for violating their privacy rights. This provision, known as the private right of action, is a significant departure from existing state laws and has the potential to hold businesses accountable for their data practices in a way that was previously unheard of.
The bill, which includes requirements for data minimization and prohibits the sale of sensitive consumer data, empowers individuals to sue companies that they believe have crossed the line in terms of data privacy. This private right of action gives consumers the ability to seek justice independently, rather than relying on state authorities to take action on their behalf. Similar provisions in other states, such as Illinois’ biometric privacy law, have already led to a surge in class action lawsuits targeting corporate data practices.
However, the Vermont bill’s private right of action has certain limitations. It is set to expire after two years and only applies to large data brokers. Additionally, the legislation includes civil rights safeguards to prevent discrimination in data collection and usage practices. Despite these restrictions, the inclusion of a private right of action in the law is seen as a major win for consumer advocates and privacy rights activists.
The passage of Vermont’s comprehensive data privacy law comes on the heels of similar legislation in California and Maryland. California’s law, like Vermont’s, allows individuals to sue companies for data breaches, but does not extend to broader digital privacy issues. Maryland’s recent legislation also reinforces the trend of states taking a proactive stance on data privacy, with 17 states now having passed their own data privacy laws.
The introduction of the American Privacy Rights Act (APRA) at the federal level by Sen. Maria Cantwell and Rep. Cathy McMorris Rodgers signals a growing national conversation around data privacy. This sweeping bill aims to make privacy a consumer right and give Americans more control over their personal data. However, there are concerns about the potential for federal legislation to preempt existing state laws, as highlighted in a letter from California Attorney General Rob Bonta and a coalition of 14 other state attorneys general.
Ultimately, the push for stronger data privacy protections at both the state and federal levels reflects a growing recognition of the importance of safeguarding personal information in an increasingly data-driven economy. The passage of Vermont’s groundbreaking data privacy law, with its innovative private right of action provision, sets a new standard for protecting consumer privacy rights and holding companies accountable for their data practices. As the debate around data privacy continues to evolve, it is clear that lawmakers at all levels are grappling with how to strike the right balance between innovation and consumer protection in the digital age.