Attorney General Charity Clark issued a statement in response to Governor Scott’s veto of H.121, the Vermont Data Privacy Act. The bill aimed to enhance consumer privacy and implement an age-appropriate design code.
"I am extremely disappointed in the Governor’s decision to veto H.121," Clark stated. She emphasized that the bill resulted from years of public forums, research, testimony, and collaboration among various stakeholders, including the Legislature, her office, industry groups, non-profits, small and mid-sized businesses, and consumers. According to Clark, "The Governor’s Office and Administration were almost entirely absent from this process."
Clark addressed several concerns raised by the Governor's veto letter. On the issue of a private right of action, she clarified that Vermont consumers have had this right since 1967 under the Consumer Protection Act. "To say that the bill’s private right of action... 'would make Vermont a national outlier' is simply false," she said. Clark suggested that the Governor might be responding to an earlier version of the bill and highlighted that under H.121's final version, individuals could sue only for actual damages involving sensitive data.
She also noted that small and mid-sized businesses are exempt from this provision and only entities holding data for 100,000 or more consumers are subject to it. Furthermore, there is a minimum 45 to 90-day period for corrective steps before a private right of action can vest.
Regarding enforcement costs without a private right of action, Clark argued that taxpayers should not bear these costs alone: "I firmly believe the costs of violating the privacy of your sensitive data should not be transferred solely to the taxpayer."
Clark also addressed concerns about the Age-Appropriate Design Code or “Kids Code.” She pointed out that its effective date is pushed out to July 1, 2025, allowing time for clarity from ongoing court cases. Additionally, she stated her office does not anticipate needing additional resources to defend any related lawsuits.
On small businesses' concerns raised by Governor Scott, Clark reiterated that H.121 applies only to businesses holding data on 25,000 or more consumers: "This bill simply does not apply to mom-and-pop shops." She added that Vermont's law provides more flexibility than other jurisdictions’ laws.
Finally, Clark underscored what she sees as urgent needs for this legislation: protecting Vermonters from issues like facial recognition misuse and geolocation tracking apps. She stressed that H.121 represents a significant step toward aligning data privacy laws with Vermont's values: "Our data belongs to us."
Clark concluded by urging legislators to override the veto on Monday: "The Legislature has a tremendous opportunity to deliver...the most impactful consumer law enacted in decades."