United States of America: Vetoed Vermont Act relating to enhancing consumer privacy (HB 121) including data protection regulation

On 13 June 2023, Governor Scott of Vermont vetoed the Act relating to enhancing consumer privacy (HB 121), citing significant risks and potential legal challenges. The Governor highlighted concerns over the Bill's “private right of action”, which could position Vermont as exceptionally hostile to businesses and non-profits. Additionally, the “Kids Code” provision, aimed at protecting children, was noted as potentially violating the First Amendment. The complexity of the Bill, alongside its expansive definitions and provisions, was also mentioned as a burden for small and mid-sized businesses, potentially placing them at a competitive disadvantage. Governor Scott suggested looking towards Connecticut’s data privacy law as a model for achieving consumer data privacy and child protection without the associated risks. The Bill would have included obligations for data controllers, such as a prohibition on the use of information collected for a purpose inconsistent with the purpose for which it was initially collected and retention of personal information if the initial purpose, notice, or consent could not be determined. Furthermore, the Bill would have established consumer rights, including the right to confirm whether a controller was processing their personal data. It would also have allowed consumers to correct, update, and request the deletion of their data, as well as opt out of the processing of their personal data for targeted advertising, the sale of personal data, or profiling.