Some Seek Override After Gov. Scott Vetoes Vt. Privacy Bill

Vermont’s comprehensive data privacy bill “creates an unnecessary and avoidable level of risk,” said Gov. Phil Scott (R) Thursday as he vetoed H-121. It was a win for tech industry opponents (see 2405300038) and a setback for consumer group supporters of the bill that would have made Vermont the first state with a broad private right of action (PRA). It's possible, however, for lawmakers to override Scott’s veto with a two-thirds vote in each chamber. Also Thursday, the Rhode Island legislature approved a privacy bill that consumer groups say is too weak.

The Vermont legislature could try to override Scott’s veto Monday. “I’m hoping my colleagues will have the guts to stand up for Vermonters on Monday,” Rep. Monique Priestley (D), one of the privacy bill’s sponsors, wrote in a LinkedIn post late Thursday. “There’s still hope, but we aren’t sure that we have the votes to override in the Senate.” Noting that Chamber of Progress thanked Scott on X for the veto, Priestly said “Big Tech lobbyists” persuaded the governor to scuttle the bill. “Vermonters deserve better, but instead we’re handing them and their loved ones over to you on a silver platter to pick apart and sell the pieces. It’s disgusting and sad.”

The PRA “would make Vermont a national outlier, and more hostile than any other state to many businesses and non-profits -- a reputation we already hold in a number of other areas,” Scott wrote to the state House. It would “negatively impact mid-sized employers, and is generating significant fear and concern among many small businesses,” he added. Also, Scott opposed the privacy bill including a kids code section similar to a California law that was temporarily enjoined. “We should await the decision in that case to craft a bill that addresses known legal pitfalls before charging ahead with policy likely to trigger high risk and expensive lawsuits.” In addition, Scott said, “the bill’s complexity and unique expansive definitions and provisions create big and expensive new burdens and competitive disadvantages” for small and medium-sized businesses. Scott is the first governor to veto a comprehensive state privacy bill.

Consumer Reports is “incredibly disappointed that Governor Scott caved to industry’s lobbying efforts and vetoed this landmark privacy legislation,” said Matt Schwartz, CR policy analyst. “Vermont consumers deserve … the ability to hold big tech companies accountable when they misuse their most sensitive information. We remain hopeful that the legislature will override this veto.” In an email Friday, Schwartz was optimistic about an override. "This bill was already approved through the legislature with strong support once." The House approved the bill on a 139-3 vote; the Senate passed it without calling roll.

Despite lawmakers' "overwhelming approval,” Scott sided “with the tech industry over protecting young people who are most vulnerable to social media’s harms,” said Nicole Gill, Accountable Tech executive director. “An override of the governor’s veto is not only necessary to secure a more just digital future for our children, but also critical in establishing accountability for Big Tech’s toxic business practices.” Design It For Us, another advocate for kids code bills, agreed. “Overturning this veto would be a much-needed step toward protecting youth from the sustained exploitation and undue harms that we experience from social media,” said co-Chair Arielle Geismar said.

NetChoice General Counsel Carl Szabo applauded the veto, saying the tech group "hopes to work with Gov. Scott and the legislature next session on effective, constitutional solutions to create a better online experience for all Vermonters and their children." This year's bill was unconstitutional, said Szabo.

Meanwhile, Rhode Island’s privacy bill passed the legislature Thursday after the House and Senate approved each other’s similar bills (S-2500 and H-7787). Each chamber voted with large majorities earlier in the week to pass its own bill (see 2406120012 and 2406110033). The legislation, which would take effect Jan. 1, will go next to Gov. Dan McKee (D). CR and other consumer privacy advocates said the measure does too little to protect consumers’ privacy and is overly friendly to industry. The bill’s supporters include TechNet & the Computer and Communications Industry Association.

“It is the Wild West on the internet in regards to the data they have on all of us that people can do just about anything with,” Senate bill sponsor Louis DiPalma (D) said in a news release. “This protects our privacy when we’re all at risk.” House sponsor Rep. Evan Shanley (D) said it’s “imperative that consumers understand how their information -- especially information relating to their children -- is shared by businesses.”