The Vermont General Assembly faced a setback this week as they attempted to override Governor Phil Scott’s veto of H.121, a bill designed to implement robust data privacy protections within the state. Despite a resounding 128-17 vote in the House in favor of overriding the veto, the Senate narrowly sided with the governor in a 15-14 decision, ultimately leading to the demise of the bill.
H.121, officially known as “An act relating to enhancing consumer privacy and the age-appropriate design code,” included a crucial provision that would have allowed consumers to take legal action against companies that mishandled their sensitive information. Additionally, the bill’s “Kids Code” section aimed to ensure that online platforms catering to individuals under 18 years old adhered to strict privacy guidelines and provided age-appropriate content.
In a letter addressed to the General Assembly on June 13, Governor Scott explained his decision to veto the bill, citing concerns that the stringent data privacy measures could create an unfavorable business climate in Vermont. He also raised issues regarding the potential conflicts with the First Amendment that could arise from the provisions outlined in the “Kids Code” section. Governor Scott recommended that Vermont look to Connecticut’s data privacy laws as a more moderate alternative and urged lawmakers to monitor legal developments in California for guidance on addressing similar challenges.
For some businesses, the failure to pass H.121 may come as a relief, as it would have added another layer of compliance requirements on top of existing regulations such as the General Data Protection Regulation (GDPR) for organizations operating in the European Union. With approximately 19 states across the U.S. already implementing their own data privacy legislation, the landscape of regulatory requirements continues to evolve. While federal data privacy laws are still in the works, President Biden issued an executive order earlier in the year to establish clearer guidelines on data handling practices at both national and international levels.
The clash over H.121 highlights the ongoing debate surrounding data privacy and the challenges of balancing consumer protection with business interests. While Vermont’s efforts to enhance data privacy protections ultimately fell short, the broader conversation around regulatory frameworks and accountability in the digital age is likely to persist as technology continues to advance. As stakeholders navigate this evolving landscape, finding common ground between privacy advocates, businesses, and lawmakers remains a complex and ongoing endeavor.