2024 Privacy Bill Failures Won't Deter Vt. and Maine Lawmakers

Maine and Vermont legislators will reintroduce comprehensive privacy bills next session, lead sponsors told us in interviews. Republican Gov. Phil Scott’s veto of Vermont’s privacy bill hasn’t discouraged supporters from seeking a private right of action (PRA) that Scott and industry opposed, Rep. Monique Priestley (D), the comprehensive measure’s sponsor, said. Meanwhile, in Maine, a veto threat from Gov. Janet Mills (D) means neither party will pursue a PRA in the upcoming session, Sen. Lisa Keim (R) told us. Mills' opposition to a PRA made it a nonstarter this session.

PRA remains a sticking point at the federal level. The House Commerce Committee last month pulled a scheduled markup (see 2406270046) on its bipartisan privacy bill that contains a PRA amid opposition from House Speaker Mike Johnson, R-La., and House Majority Leader Steve Scalise, R-La. House Communications Subcommittee Chairman Bob Latta, R-Ohio, told us before the break that the committee approved a bill that won't draw significant complications on the floor. “We know leadership had an issue. ... We don't want to have a situation where we have to try to fix things on the floor. The speaker and leader said they want to work with our chair, and so we’ll go from there.” The only path forward is approving a Republican bill out of the House and negotiating with the Democrat-controlled Senate, one tech lobbyist told us.

The Vermont bill’s failure last month could strengthen the argument against including a PRA in state and national privacy bills, Jake Parker, the Security Industry Association's senior director-government relations, said in an interview. But other privacy experts expect some states will continue pursuing PRAs.

Scott feared that Vermont's bill would create “an unnecessary and avoidable level of risk.” That's in part because the PRA “would make Vermont a national outlier, and more hostile than any other state to many businesses and non-profits,” the governor said in his veto statement last month (see 2406140017).

Vermont joined a long list of states that rejected the idea of including a PRA in privacy legislation, Parker said. So far, 20 states have privacy laws; only California's includes a PRA, but its application is limited. Although a PRA seems central to a congressional deal on privacy, the Vermont veto “strengthens the argument that maybe that’s just not an acceptable feature of international data privacy law,” the SIA official said: “Every state that’s considered this has rejected it,” and even in Vermont, the Senate voted on a bipartisan basis to sustain Scott’s veto, the official said. Vermont would have been an outlier on enforcement if the bill was enacted, Parker said: The 18 states that followed Virginia’s 2021 privacy law have mostly passed similar bills that solely task state attorneys general with enforcement duties.

“No discouragement here,” Priestley, the Vermont lawmaker, told us Wednesday. “If anything, [the veto has] strengthened the effort. We’ll be tightening up the bill and pushing [it] through House Commerce early [in] January at the start of next session.” That bill, she confirmed, will contain a private right of action.

Rep. Rachel Henderson (R) is expected to lead Republican efforts on privacy legislation in Maine next session, said Keim, who is leaving office because she's termed out. Republicans and Democrats introduced dueling privacy proposals this year. The effort to pass a bill died owing to House-Senate disagreement (see 2404180011). The majority of Democrats would prefer a PRA, but it's not viable due to the Mills veto threat, Keim said. "I would assume that both bills probably word-for-word will get resubmitted in the next session, and the battle will begin anew." The concern with a PRA is that it would benefit only “predatory” trial lawyers, and small businesses would pay the price for that behavior, she said.

Some privacy experts doubt that the Vermont veto will discourage PRA supporters. “While a private right of action is generally a heavy lift, the Vermont legislature came close and tried for the Republican governor, would have crossed the finish line,” emailed Davis Wright privacy attorney Nancy Libin, former chief privacy and civil liberties officer at DOJ. “I would not be surprised if we see legislatures in other states with more sympathetic governors try to do the same thing.”

“If anything, I think the experience in Vermont has galvanized even more lawmakers who increasingly understand that a private right of action is important to ensuring a privacy law has real teeth,” Consumer Reports Policy Analyst Matt Schwartz said. “I expect a handful of states to take up the cause in the next session and either propose legislation with, or attempt to amend their privacy bills to include, a private right of action.” Schwartz sees different dynamics in the federal debate. “The trade seems to be a preemptive bill for a private right of action, and it feels like both sides are fairly dug-in on their respective stances,” he said.

Lawmakers should consider the consequences of Illinois including a PRA in its Biometric Information Privacy Act, Libin and Parker said. “BIPA’s private right of action has been devastating for companies that have committed technical violations that have not materially impacted consumers,” Libin said. Parker noted some SIA members were sued under BIPA, while others decided not to sell their products in the state because of the high litigation risk. Even if lawmakers tried to limit a PRA’s scope, “class-action lawyers are going to find a creative way to leverage that for gain,” he said.